Sure, and employers aren't legally allowed to discriminate based on criminal record unrelated to the job, but that has never stopped them.
I think they are allowed to discriminate based on felony convictions etc... at least in the states.
A blanket policy of excluding all felons without a legitimate business justification may violate Title VII of The Civil Rights Act of 1964 due to disparate impact.
Can you get around the law by phrasing a question to 23andMe. A health insurance company could call them up and ask if so and so have genes that has an increased risk of contacting x disease ? Technically they are not selling the information so they are not breaking any laws but it's still valuable to the insurance company.