In 2018, investigators used DNA obtained from genealogy websites to identify Joseph James DeAngelo Jr.—better known as the Golden State Killer—who later pleaded guilty to 26 counts of murder and kidnapping. He is currently serving multiple life sentences.

The case marked a groundbreaking moment in forensic science. Detectives were able to identify DeAngelo Jr. by connecting him to DNA submitted to genealogy websites by distant relatives, helping bring long-awaited justice to victims and their families.

Supporters say genealogy aids police, critics warn it implicates relatives

While many supporters call the use of DNA profiles good police work, critics have raised data privacy and informed consent concerns about the Golden State Killer case and subsequent cases involving police departments that create fake profiles and conduct searches without a warrant, indirectly involving relatives of a suspect, whether they had anything to do with the crime or not.

“It’s perfectly legal for law enforcement to follow people around and wait for them to leave a discarded sample of their genetic information, for example, a cup, pizza crust, something like that,” Malia Fullerton, a professor of bioethics at the University of Washington, said. “The people who created these databases, and the vast majority of people who use them for genealogical purposes, were concerned about law enforcement coming in to make use of this information, not in order to expand a family tree, but to indirectly identify relatives.”

Fullerton said people upload their DNA to private genealogical companies to research family trees or trace their ancestry, not to assist in criminal investigations. Even when users consent to share their data, their relatives, including siblings who share close to 50% DNA, have often not agreed to do the same.

“Let’s say my brother is a genealogy buff and he decides he doesn’t care about his genetic privacy. He wants to find relatives in our far-flung family, and so he decides to upload his genomic information to one of these databases that law enforcement could access,” Fullerton said. “The fact that my brother uploaded his genetic information would allow me potentially to be indirectly identified. And I had no say.”

In the Golden State Killer case, investigators said they submitted crime scene DNA to FamilyTreeDNA, which created a profile. They then used fake accounts to search the database for matches. A close relative was found on MyHeritage, police said, helping them break open the cold case.

“I think on balance, it is a good thing,” Fullerton said. “However, it is right now kind of a Wild West. It’s not really very well regulated.”

Following the case, most major consumer DNA testing companies created additional barriers to law enforcement access. The U.S. Department of Justice also adopted restrictions on the use of genealogical databases for criminal investigations. But so far, only Maryland has passed legislation that provides legal guidelines for how law enforcement may use and store such sensitive data.

The lack of regulation raises concerns about potential misuse, including the risk of data breaches at police departments holding DNR-related information as part of their cases.

“If somebody hacks into my credit card or something, and, like, steals my identity, I can get a new credit card,” Fullerton said. “I cannot get a new genome. My genome is the genome that my parents gave me.”