Law enforcement secretly searches consumer DNA databases without warrants, and only 2 states have passed laws requiring one

Since the 2018 arrest of the Golden State Killer using GEDmatch, law enforcement agencies have used investigative genetic genealogy (IGG) in hundreds of criminal cases by uploading crime-scene DNA profiles to consumer genealogy databases and searching for partial matches among relatives of suspects. As of late 2024, a Criminal Legal News investigation found that police are searching genetic genealogy databases regardless of whether the platforms' terms of service permit it. GEDmatch changed its default to opt-out after the Golden State Killer case, but law enforcement has also accessed FamilyTreeDNA's database, and there are documented cases of police obtaining DNA profiles from newborn screening programs and medical tests — sources that have nothing to do with consumer genealogy. The privacy violation is not hypothetical. When police upload a crime-scene DNA profile and find a 3rd-cousin match, they then build a family tree of that match's relatives — potentially hundreds of innocent people — to narrow down the suspect. Every person in that extended family becomes a subject of investigation without their knowledge or consent. Extended familial searching beyond close relatives generates false leads and brings innocent people into contact with law enforcement. The 40+ million people who submitted DNA to consumer databases did not consent to becoming a distributed forensic database, and the millions more who never tested but are identifiable through relatives' DNA had no say at all. As of 2024, only Maryland and Montana have passed laws regulating law enforcement use of forensic genetic genealogy. Maryland requires judicial authorization and limits IGG to cases of murder, rape, and felony sexual offenses. Montana requires a search warrant. The remaining 48 states have no specific legal framework governing this practice. The Department of Justice issued voluntary guidelines in 2019, but they are not legally binding and apply only to federal investigations. The fundamental structural problem is that consumer DNA databases were built under privacy policies designed for genealogy hobbyists, not as forensic tools, and the legal system has not caught up to the technological reality that submitting your DNA to find your great-grandmother also makes you and every blood relative searchable by police.