Who Has the Right to Use Your
Genetic Data?
As DNA testing companies face data breaches and bankruptcy, the spotlight returns to an ongoing issue in genetic privacy. Forensic investigative genetic genealogy has been used for nearly a decade, but what does this practice mean for your most sensitive data?
by Melissa Russell
April 21, 2025
The data included in this article is sourced from a database of criminal and unidentified decedent cases put together by Tracey Dowdeswell. This database contains information about 1,246 cases that have been resolved using forensic genetic genealogy, and is the most comprehensive database of such information that is publicly available. You can read more about the parameters of the data here.
Please view on a desktop device for full functionality.
On average, over 500 unidentifiable human remains are recorded in the United States every year. According to data from NamUs and NCIC, hundreds of these cases remain unsolved in the system for decades. Even after the advent of DNA analysis and profiling, unidentified victims and suspects still elude investigators.
This is where forensic investigative genetic genealogy comes in. Forensic investigative genetic genealogy is the investigative process by which law enforcement analyzes “identity-by-descent” segments of DNA to locate suspects or victims through genealogical matches. It is an emerging practice that first made headlines with the resolution of the Golden State Killer case in 2018.
Since then, nearly 700 criminal cases and nearly 600 unidentified remains cases have been resolved using forensic investigative genetic genealogy. This process has revolutionized criminal investigation, and has brought closure to hundreds of families. It also raises important ethical and legal questions - Who has the right to use your genetic information? What is the legal line for conducting DNA searches?
How Does It Work?
Forensic investigative genetic genealogy works differently than other DNA investigation techniques. In the course of a regular criminal investigation using DNA as evidence, a suspect’s DNA is tested using short tandem repeat markers, or STRs, that are found on a small segment of each individual’s DNA. This process results in 20 markers to be compared between samples, and can link individuals to close familial relations.
Single-nucleotide polymorphisms, or SNPs, however, can do much more. These markers speak to the very essence of what we are as humans. From SNP testing, you can glean much more sensitive information about an individual (such as physical appearance, geographic origin, and disease risk) than from STR markers. As technology and interpretation advances in the next 5-10 years, the process will likely become even more comprehensive.
These SNP profiles are what is analyzed when you send your DNA to a direct-to-consumer DNA testing company like ancestry.com or FamilyTreeDNA. These profiles are also what investigators use in forensic investigative genetic genealogy.
Where Does the DNA Data Come From?
Over 40 million people have sent in samples to direct-to-consumer DNA testing companies over the years. As these private companies began to gain popularity, the site GEDmatch started as a way to consolidate the information gleaned from all of this data. Customers can upload the data they’ve received from any consumer DNA testing company to GEDmatch and search for familial connections from a database that is beyond the scope of any individual DNA testing company.
GEDmatch quietly began partnering with law enforcement to aid in criminal investigations, but did not explicitly inform its users that their data was being used this way. The public became aware of the practice after the resolution of the Golden State Killer case, and GEDmatch amended its policies to allow an opt-in or opt-out feature for users.
When creating an account on one of these DNA testing sites, users must now choose whether or not they consent to their DNA being used by law enforcement. However, since these organizations are privately owned, they can change their consent policies at any time. GEDmatch has already updated their opt-in policy to specify that users can no longer choose to opt out of using their DNA data for the identification of unidentified human remains. And in some cases, GEDmatch has allowed law enforcement to search the DNA data of those who opted out of sharing their data.
In the dataset above, we can see that over 45% of the confirmatory samples came from a living relative or through a DNA warrant. It should also be noted that nearly 20% of the samples were obtained through “surreptitious sampling,” a process by which law enforcement obtains a DNA sample from an item that a suspect discards, like a disposable coffee cup or a cigarette butt. Because the item is considered publicly available once discarded, this type of sampling is legal and has been used to solve a number of high profile criminal cases, including the Golden State Killer case in 2018.
How is Your Data Being Used?
In criminal cases, investigators typically run DNA samples through the Combined DNA Index System (CODIS), which warehouses DNA samples from convicted criminals (and others). Law enforcement investigators are required by the Department of Justice to run samples through CODIS before using other means of investigation, including forensic investigative genetic genealogy. After exhausting conventional methods of DNA testing, investigators can upload DNA data collected at a crime scene to the GEDmatch Pro database (or a similar one from another company) to scan for potential matches. DNA testing companies have placed restrictions on the circumstances under which investigators can use their data - right now, they can only be used when investigating violent criminal cases or to identify unidentified human remains.
Once investigators have the DNA data, they typically send it to another private company for analysis and comparison. This roster of companies includes DNA giants like Bode, Othram, and Parabon. Analysis of the data will result in a centimorgan number, which indicates the level of familial connection between two samples. Investigators can then use this data to seek out living relatives whose DNA they believe will bring them closer to a direct DNA match.
Where Do We Go From Here?
Since 2018, some states have since instituted laws about DNA data collection and use. Maryland and Montana were the first to do so in 2021, and now requires judicial authorization before law enforcement can use corporate DNA databases for investigative purposes. Overall, however, forensic investigative genetic genealogy operates with very few regulations and oversight.
As you can see from the dataset above, most of the criminal cases involving forensic investigative genetic genealogy remain open or are currently pending in court. The jury is still out on the how often this emerging technique will be accepted as admissible evidence. But as you can see, several cases that involved forensic investigative genetic genealogy have already made their way through the court system.
In all, forensic investigative genetic genealogy is a godsend to law enforcement. Cases that have haunted their offices for decades can now be resolved, and victims’ families are afforded long-awaited closure. Nearly half of the criminal cases investigated through this technique involved suspected serial murderers and/or rapists.
But as the use of this technology continues to develop over the next decade, the pressing issues of privacy and informed consent cannot be ignored. No organization should have the right to use an individual’s most sensitive information without their explicit and informed consent. Hopefully, further oversight into forensic investigative genetic genealogy can ensure that this incredible tool can be used for justice in a way that does not infringe on our right to privacy.