At-home DNA tests have given law enforcement a tool that did not exist a decade ago: the ability to identify an unknown suspect by matching crime scene DNA to that suspect’s distant relatives in a consumer genealogy database. The technique, called forensic genetic genealogy, has contributed to more than 400 resolved investigations through a single database alone since 2018. It has also created privacy questions that courts and legislatures are still working through, because your spit sample can expose cousins who never agreed to anything.
Why Consumer Databases Opened a New Door
Police have long had their own DNA database. CODIS, the FBI’s Combined DNA Index System, holds over 19 million offender profiles, 6 million arrestee profiles, and roughly 1.4 million forensic profiles as of late 2025.1Federal Bureau of Investigation. CODIS-NDIS Statistics But CODIS only helps if the person who left DNA at a crime scene has already been arrested or convicted. If they haven’t, the sample sits in evidence with nothing to match.
Consumer genetic testing filled that gap by accident. Millions of ordinary people have uploaded their DNA to companies like 23andMe, Ancestry, and GEDmatch out of curiosity about ancestry or health. None of them had to be suspected of anything. Investigators realized that if they could get a crime scene profile into one of those databases, they could identify genetic relatives of the unknown person and then work forward through family trees to a suspect.2Bureau of Justice Statistics. Combined DNA Index System The Golden State Killer case in 2018 was the first widely publicized use of this approach, and it set off rapid adoption nationwide.
How the Technique Works
The starting point is a crime scene sample that has already failed to match anything in CODIS. A specialized lab reanalyzes the sample to generate a profile based on single nucleotide polymorphisms, or SNPs. These are the same markers that consumer DNA kits use, which is what makes cross-referencing possible.
Investigators upload the SNP profile to a genealogy database that permits law enforcement searches. The database returns a ranked list of genetic relatives sorted by how much DNA they share with the unknown sample. A strong match might indicate a second or third cousin; a weaker one might point to someone further out.
From there, genealogists build family trees backward through generations using public records, obituaries, and census data, then trace descendants forward to narrow the pool to a handful of people who could be the source. Once a suspect emerges, investigators collect a confirmatory sample from something that person discarded in public, like a coffee cup or a cigarette butt, and test it against the original crime scene evidence using traditional forensic methods.3National Institute of Justice. DNA – A Prosecutors Practice Notebook – Abandoned Sample The genealogy narrows the field. The DNA match confirms identity.
Which Companies Let Police In
Not every DNA company treats law enforcement the same way, and the differences matter if you are deciding where to upload your data.
GEDmatch
GEDmatch holds approximately 1.2 million profiles and runs a separate law enforcement portal called GEDmatch PRO. Searches are restricted to violent crimes, defined as murder, manslaughter, aggravated rape, robbery, or aggravated assault, and to identifying human remains.4GEDmatch. Terms of Service Users pick a privacy tier at upload, and only those who explicitly opt in appear in law enforcement comparisons. Investigators see a name or alias, email address, and the amount of shared DNA, not the underlying genetic data.5GEDmatch. Community Safety
FamilyTreeDNA
FamilyTreeDNA processes forensic samples for law enforcement on a case-by-case basis and creates investigative accounts with the same matching access a regular user has. Searches are limited to identifying remains or investigating violent crimes, and anything beyond basic match results requires a court order or subpoena.6FamilyTreeDNA. IGGM Frequently Asked Questions
Ancestry and 23andMe
The two largest consumer DNA companies have taken a harder line. Ancestry’s stated policy is that it does not voluntarily cooperate with law enforcement and will only hand over customer data when compelled by a valid court order, and it says it reviews every request and pushes back on overbroad ones.7Ancestry. Ancestrys Position on Law Enforcement and Your Privacy 23andMe says it will comply only with court orders, subpoenas, or search warrants it determines to be legally valid, and reported in its last transparency report that it had never released customer information to law enforcement.823andMe Customer Care. How 23andMe Responds to Law Enforcement Requests for Customer Information
The Rules Investigators Must Follow
The Department of Justice issued an interim policy in 2019 that governs when federal investigators and federally funded agencies can use forensic genetic genealogy. The rules are tighter than most people assume.
Investigators can only pursue genetic genealogy for an unsolved violent crime or to identify what they reasonably believe to be the remains of a homicide victim. Before starting, they must have uploaded the forensic profile to CODIS, run those searches, and come up empty, and they must have pursued other reasonable leads. When applicable, the case must be entered into the National Missing and Unidentified Persons System and the FBI’s Violent Criminal Apprehension Program database.9United States Department of Justice. Interim Policy Forensic Genetic Genealogical DNA Analysis and Searching
Even after clearing those hurdles, the investigating agency must consult with a prosecutor, and both must agree that the sample is suitable and that genetic genealogy is a necessary and appropriate step. A prosecutor can authorize the technique for other violent crimes beyond homicide and sexual offenses, but only when there is a substantial and ongoing threat to public safety or national security. The policy remains interim and has not been finalized as of 2026.
States are starting to write their own rules on top of that. Maryland and Montana were the first to pass laws specifically restricting law enforcement use of forensic genetic genealogy. These laws generally require judicial authorization before a search, limit the technique to serious violent crimes, and require investigators to exhaust CODIS and other leads first. Some go further by requiring written informed consent before collecting DNA from third parties identified through genealogy, mandating destruction of samples when an investigation ends, and creating criminal penalties for violations. Most states still have no statute on the subject, so investigators there operate under general Fourth Amendment principles and whatever internal policies their agency has adopted.
What This Means for Your Privacy
The structural problem with forensic genetic genealogy is that your DNA is not only yours. When you upload a sample, you expose genetic information shared with every blood relative you have. A second cousin who never spit into a tube can still be identified through your account. That cousin never consented.
Traditional surveillance targets a known individual. Genetic genealogy starts with an unknown person and works outward through a web of relatives, most of whom have no connection to any crime. The technique inherently sweeps in genetic information from uninvolved family members on its way to a suspect.
The Fourth Amendment Question Is Unsettled
Whether police need a warrant to search a consumer DNA database remains an open legal question. The most relevant Supreme Court precedent is Carpenter v. United States (2018), in which the Court held that the government’s acquisition of cell-site location records from a wireless carrier was a search requiring a warrant, even though those records were held by a third party. The Court declined to extend the third-party doctrine, which generally strips privacy protections from information you voluntarily share with a business, to deeply revealing digital records.10Supreme Court of the United States. Carpenter v United States
Legal scholars have argued that Carpenter‘s logic should extend to genetic data, which is arguably even more revealing than location records. Courts have not yet embraced that argument in the genetic genealogy context. In the handful of cases where defendants have challenged law enforcement use of consumer DNA databases, courts have largely sidestepped the Fourth Amendment question, holding that defendants lacked standing or that individuals have no expectation of privacy in genetic material used for identification.11PubMed Central. Familial Searches, the Fourth Amendment, and Genomic Control No appellate court has issued a definitive ruling on whether a warrant is constitutionally required.
Discarded DNA Requires No Warrant
Once genealogy points investigators toward a suspect, the confirmatory sample typically comes from something the person threw away in public. Under current law in most jurisdictions, this requires no warrant. The legal theory is that you abandon your privacy interest in items you discard, a principle rooted in decades-old cases about curbside garbage.3National Institute of Justice. DNA – A Prosecutors Practice Notebook – Abandoned Sample Critics argue that extracting and analyzing DNA from a tossed cup is more invasive than rifling through someone’s trash, and that Carpenter‘s caution about applying old rules to new surveillance capabilities should apply.
What Happens If the Company Fails
The risk from consumer DNA testing is not only police access. In early 2025, 23andMe filed for bankruptcy, immediately raising the question of what would happen to the genetic data of its roughly 15 million customers. The company stated that customer data privacy would be an “important consideration” in any sale and that a new owner would have to comply with applicable law. As a direct-to-consumer genetics company, 23andMe is not covered by HIPAA, the federal health privacy law that governs hospitals and insurers.
The bankruptcy judge who oversaw the case acknowledged that selling genetic data is “a scary proposition” but noted that lawmakers had not banned it. In mid-2025, the company’s assets were acquired for $305 million by a nonprofit founded by 23andMe co-founder Anne Wojcicki, which pledged to improve privacy policies and continue allowing customers to delete their data. State attorneys general urged customers throughout the process to consider deleting their data and destroying any stored samples before a sale closed.
At least eleven states have enacted laws giving consumers some control over how their genetic data is used, typically including a right to request deletion and a requirement that law enforcement obtain a warrant or subpoena. The majority of states have no such protections.
Where the Technique Fails
Forensic genetic genealogy is powerful, but it is not foolproof, and the failure modes matter if you are a relative who gets pulled into an investigation by mistake.
The technique depends on having enough consumer profiles in a database to generate useful matches. GEDmatch’s 1.2 million profiles represent a fraction of the U.S. population, and the share of users who opt in to law enforcement searches is smaller still. If no close enough relatives have uploaded their DNA, the trail goes cold.
False positives are also real. Research has shown that when investigators use the wrong population-level genetic frequencies to evaluate a match, the rate of erroneously classifying non-relatives as relatives rises substantially.12PubMed Central. Human-Genetic Ancestry Inference and False Positives in Forensic Familial Searching If the ancestry of the person who left the crime scene DNA is misidentified, the software may flag the wrong relatives and send investigators down the wrong branch of a family tree. Performing ancestry inference on the query profile before searching can reduce this risk but does not eliminate it.
Building family trees across multiple generations using public records assumes those records are accurate. Adoptions, name changes, incomplete vital records, and non-paternity events can all mislead genealogists. That is why the confirmatory DNA step is not optional. An innocent person can end up under investigation based on a genealogical lead that turns out to be wrong, and oversight of how investigators handle those situations varies widely by jurisdiction and agency.