For most of its history, genetic genealogy was a pursuit with no particular connection to law enforcement. People tested their DNA, built family trees, and connected with distant cousins. The databases that grew from that activity were tools for research and reunion. That changed decisively in April 2018, and the genealogy community has been grappling with the consequences ever since. The questions raised by law enforcement access to consumer genetic databases — about privacy, consent, effectiveness, and legal frameworks — have grown more complex, not less, in the years since. Recent developments in 2025 and 2026 have added new urgency to a debate that touches every person who has ever submitted a DNA sample to a consumer testing company.
This article provides an overview of how the practice of forensic genetic genealogy developed, which databases are being used and under what conditions, what the current legal and policy landscape looks like, and where things appear to be heading.
The Turning Point: The Golden State Killer Case
The event that brought forensic genetic genealogy into mainstream awareness was the April 2018 arrest of Joseph James DeAngelo Jr.[1], identified as the perpetrator of a decades-long series of murders and sexual assaults in California that had come to be known as the Golden State Killer crimes. Investigators uploaded a DNA profile developed from crime scene evidence to GEDmatch, a free third-party platform where genealogy researchers upload raw DNA data from commercial testing companies to find matches across company boundaries. Working from distant cousin matches in GEDmatch’s database, investigators and genealogists spent months building out DeAngelo’s family tree, ultimately identifying him as the suspect. He was arrested after investigators obtained discarded DNA samples to confirm the match.
At the time, law enforcement’s use of public consumer DNA databases was entirely unregulated. GEDmatch had not been informed that investigators were using the platform; they had simply uploaded the crime scene DNA profile the same way any consumer would upload their own. The case demonstrated, dramatically and publicly, that a large consumer genetic genealogy database could serve as a powerful investigative tool — and that no law or policy governed how, or whether, it could be used that way.
How Forensic Genetic Genealogy Works
The technique that solved the Golden State Killer case has come to be known formally as Forensic Genetic Genealogical DNA Analysis and Searching (FGGS). The process involves several steps. A forensic DNA profile is developed from crime scene biological material — a method substantially more sophisticated than standard DNA profiling. That profile is uploaded to a consumer genealogy database, where it is compared against the profiles of database members to identify distant relatives — typically third or fourth cousins who share small amounts of DNA with the unknown individual. Skilled genetic genealogists then use documentary research to build family trees from those matches, progressively narrowing the search until a specific individual can be identified as a likely suspect or victim. The DNA match identifies the family; the genealogy research identifies the person.
This approach is far more powerful than searching the Combined DNA Index System (CODIS), the federal law enforcement DNA database established by the DNA Identification Act of 1994. CODIS contains profiles only of convicted offenders and certain arrestees, representing a limited fraction of the population, and can only be searched for exact or near-exact matches. Consumer genealogy databases, by contrast, contain profiles from millions of ordinary citizens who have never had any contact with the criminal justice system — and because DNA is inherited, a match in a genealogy database can implicate relatives of database members who have never tested at all. This is a critical point: when you upload your DNA to a consumer genealogy database, you are potentially making genetic information about all of your biological relatives searchable by law enforcement, without those relatives’ knowledge or consent.
🔬 Which Databases Are Being Used — and Under What Rules
Not all consumer genetics databases are equally accessible to law enforcement, and the policies governing access vary significantly by platform. Understanding the differences is important for any genealogy researcher making decisions about where to upload their data.
GEDmatch is the platform most heavily associated with forensic genetic genealogy. After the Golden State Killer case brought unwanted attention, GEDmatch shifted to an opt-in model in May 2019[2] — meaning users must actively choose to make their profiles available for law enforcement searches. This change reduced the searchable database by approximately 90%, from roughly 1.4 million profiles to about 140,000. GEDmatch was subsequently acquired by Verogen, a forensic genomics company (itself later acquired by QIAGEN), which launched a separate law enforcement portal called GEDmatch PRO. In 2020, GEDmatch experienced a data breach in which user opt-out settings were temporarily overridden, briefly making all profiles available to law enforcement searches — an incident that resulted in ongoing litigation. The current opt-in policy remains in place, with users making an explicit choice about whether their kit participates in law enforcement searches.
FamilyTreeDNA (FTDNA) is the only major DTC testing company to actively and openly cooperate with law enforcement. After it emerged in 2019 that the Federal Bureau of Investigation (FBI) had been uploading crime scene DNA to FTDNA’s database without the company’s knowledge, FTDNA revised its terms of service to formally permit law enforcement use — but restricted to investigations of homicide, sexual assault, and abduction, and requiring law enforcement to identify themselves rather than pose as ordinary users. FTDNA uses an opt-out model: users are included in law enforcement searches by default and must actively choose to exclude themselves. This remains the standard today.
AncestryDNA and 23andMe have taken significantly more restrictive positions. Both companies’ policies require law enforcement to obtain a valid search warrant or court order before any user data is released — and both have committed to notifying affected users of law enforcement requests when legally permitted to do so. Neither platform allows law enforcement to upload crime scene DNA profiles for comparison against consumer databases.
MyHeritage takes one of the strongest privacy stances in the industry. Its terms of service explicitly prohibit law enforcement and government agencies from using its platform, and it does not participate in forensic genetic genealogy programs of any kind.
The 23andMe Bankruptcy: A Warning About Data Vulnerability
The most significant genetic data privacy event of 2025 was the bankruptcy and subsequent sale of 23andMe — and its implications extend well beyond the immediate transaction. In March 2025, 23andMe filed for Chapter 11 bankruptcy[3] protection after years of declining revenue and following a 2023 data breach that compromised the personal information of approximately 6.9 million users. The bankruptcy placed the company’s database of more than 15 million genetic profiles — one of the largest private collections of human genomic data ever assembled — on the auction block.
An initial agreement to sell the company to Regeneron Pharmaceuticals for over $250 million was ultimately superseded when TTAM Research Institute, a nonprofit controlled by 23andMe co-founder Anne Wojcicki, acquired the database for $305 million[4]. The transaction closed in July 2025, after contentious legal proceedings in which 28 state attorneys general, a court-appointed Consumer Privacy Ombudsman, and members of Congress raised concerns about whether genetic data could be transferred without affirmative consent from the 15 million individuals whose most intimate biological information was at stake.
The outcome — TTAM acquiring the data with pledged but not legally binding privacy commitments — satisfied neither privacy advocates nor legal scholars. Several states, led by California, objected that users whose data predated the transaction had not been given a meaningful opportunity to consent to the transfer, and California’s appeal of the bankruptcy court’s decision was still pending as of early 2026. Meanwhile, Congress held hearings on the national security implications of the transaction, with members raising concerns about foreign adversary access to American genetic data.
The core legal problem the 23andMe bankruptcy exposed is structural: U.S. bankruptcy law’s Section 363(b)(1)(B) provides some protection for personally identifiable information (PII) in corporate asset sales, but it does not expressly include genetic data — leaving a significant gap that lawmakers have been urged to close. The 23andMe case illustrated that a company holding millions of genetic profiles can go bankrupt, and the profiles can be sold to a new owner, without any mechanism requiring fresh consent from the individuals whose DNA is at stake.
The Regulatory Landscape: Patchwork and Evolving
Federal regulation of forensic genetic genealogy and consumer genetic data privacy remains fragmented. The most significant federal action has been the Department of Justice (DOJ) interim policy on FGGS, which establishes guidelines for how federal law enforcement and federally funded state and local agencies may use genealogy databases. The policy requires that law enforcement first exhaust traditional investigative methods — including searching CODIS — before resorting to consumer database searches. It prohibits investigators from posing as ordinary users on platforms that don’t permit law enforcement access, and requires investigators to disclose their law enforcement status. The policy limits FGGS use to serious violent crimes and unidentified remains cases.
Critics have noted that the DOJ policy, while a meaningful step, does not require a warrant for law enforcement to search consumer genealogy databases — a significant omission given that consumer DNA profiles contain vastly more sensitive information than the noncoding regions included in CODIS profiles. The policy also applies only to federal agencies and federally funded state programs, leaving state and local law enforcement largely free to operate outside its constraints.
At the state level, the landscape has developed rapidly. Maryland and Montana were early movers, with Maryland requiring judicial supervision and affirmative consumer consent for forensic genealogy use, and Montana requiring a search warrant for government access to consumer DNA databases. Montana’s warrant requirement took effect June 1, 2025.[5] Texas and Tennessee passed genetic privacy laws that permit law enforcement access with valid legal process but do not require a warrant. California’s Genetic Information Privacy Act (GIPA) imposes specific requirements on DTC genetic testing companies, including opt-in consent requirements for law enforcement access.
In 2026, the legislative pace has accelerated. South Dakota enacted Senate Bill (SB) 49 regulating DTC genetic testing companies, effective July 1, 2026. Utah enacted legislation aimed at preventing foreign adversary access to genetic sequencing data, effective January 1, 2028. Multiple other states have bills under consideration. The result is a rapidly evolving but highly inconsistent state-by-state framework — what legal scholars have called a patchwork — that provides meaningfully different levels of protection depending on where a consumer happens to live.
The Genuine Controversy: Arguments on Both Sides
The debate over law enforcement access to genetic genealogy databases is genuinely contested, and the arguments on both sides deserve honest consideration.
The case for access: Forensic genetic genealogy has solved cold cases that had resisted every other investigative approach for decades. Beyond the Golden State Killer, hundreds of cases — including homicides, sexual assaults, and the identification of unidentified human remains — have been resolved using the technique. Victims’ families who waited decades for justice, and who would have waited indefinitely without this approach, have received answers. Proponents argue that making this technique unavailable, or so restricted as to be ineffective, has a real human cost — measured in unsolved murders, unidentified victims, and perpetrators who remain free to offend again.
The case for restriction: Consumer genealogy databases were built on the participation of millions of people who submitted their DNA for personal research purposes, not to participate in government surveillance programs. When a person uploads their DNA to GEDmatch or FamilyTreeDNA, they are also making searchable information about all of their biological relatives — people who never consented to any database at all. Commercial DNA profiles are far more sensitive than CODIS profiles: they can reveal ethnic background, disease predispositions, and biological family relationships. There is documented evidence of law enforcement misuse — FBI investigators who accessed databases without disclosure, a GEDmatch breach that temporarily violated users’ opt-out settings, and ongoing litigation over unauthorized data access. And FGGS has been used not just for the most serious violent crimes but in cases that fall well short of the standards advocates claim justify the technique.
The genealogy community itself is divided. Many researchers who care deeply about privacy believe that forensic genealogy, carefully regulated and transparently disclosed, serves a legitimate public interest. Others believe that any law enforcement access to consumer databases — regardless of the protections in place — represents an unacceptable intrusion into a space that research participants never intended to make available for government use.
What This Means for Dillman Researchers
For members of the Dillman Family Association (DFA) who have uploaded DNA data to consumer databases, the practical implications are real and worth considering. If you have a kit on GEDmatch, you can review and change your law enforcement opt-in/opt-out setting at any time by logging into your account and editing your kit preferences. If you have tested at FamilyTreeDNA, your default setting is opted in to law enforcement searches; you can change this in your account privacy settings. AncestryDNA and MyHeritage do not permit law enforcement database searches without a court order, and MyHeritage prohibits them entirely.
These are personal decisions that depend on your own values and comfort with the tradeoffs involved. What matters is that you make the decision actively and knowingly, rather than accepting whatever default setting a platform has chosen for you.
The DFA’s Dillman DNA Project page provides information about the genetic genealogy research being conducted across Dillman lines. For researchers concerned about privacy, it is worth reviewing the privacy policies of any platform where you have uploaded DNA data, and checking your current settings.
Looking Ahead
The trajectory of this issue points toward more regulation, not less — but the pace and consistency of that regulation remain uncertain. Several forces are pushing toward stronger protections: the 23andMe bankruptcy demonstrated concretely that consumer genetic data can be bought and sold without users’ meaningful consent; public awareness of forensic genetic genealogy has grown substantially; and a bipartisan coalition of state attorneys general has demonstrated willingness to challenge corporate and legal assumptions about genetic data privacy.
At the same time, law enforcement advocates are pushing back against restrictions that they argue will reduce the effectiveness of a technique that has solved real crimes. The DOJ’s interim FGGS policy is expected to be finalized, and federal legislation — though slow-moving — continues to be proposed and discussed.
What seems clear is that the era of entirely unregulated law enforcement access to consumer genetic databases — the situation that existed before April 2018 — is over. What replaces it, and how consistently it protects consumers across the patchwork of state and federal rules, remains an open and actively contested question that will shape the landscape of both genetic genealogy and criminal justice for years to come.
This article is intended as an informational overview of a complex and evolving legal and policy area. It does not constitute legal advice. Readers with specific questions about their rights regarding genetic data privacy should consult a qualified attorney. Laws and policies in this area are changing rapidly; information current as of May 2026 may be superseded by subsequent developments.
Sources
- Department of Justice, “Attorney General Announces Arrest in Golden State Killer Investigation,” April 25, 2018, justice.gov (accessed May 2026).
- GEDmatch, “Privacy and Security Policy,” May 2019, gedmatch.com/privacy-security/ (accessed May 2026).
- U.S. Bankruptcy Court, Eastern District of Missouri, Case No. 25-40976, March 23, 2025, cited in Wikipedia, “23andMe,” en.wikipedia.org/wiki/23andMe (accessed May 2026).
- TTAM Research Institute acquisition, July 14, 2025, cited in Wikipedia, “23andMe,” en.wikipedia.org/wiki/23andMe (accessed May 2026).
- Montana Legislature, SB 518 (2025), leg.mt.gov (accessed May 2026).
AI Disclosure: This article was researched and written with the assistance of Claude, an AI assistant developed by Anthropic. All facts have been reviewed for accuracy, but readers are encouraged to verify information independently, particularly for time-sensitive details such as legislation and policy changes.
Discover more from Dillman Family Association
Subscribe to get the latest posts sent to your email.