Chain of Custody, Chain of Nucleotides: Tracing a Police Request Through a Consumer DNA Database

Working Paper 24-07 | Genomic Data Governance Series

Abstract

This paper maps the procedural and legal architecture governing law enforcement access to consumer genetic databases in the United States. Drawing on company transparency disclosures, published court filings, and post-2018 case law, it identifies three distinct access pathways — voluntary cooperation, compelled disclosure, and forensic genealogy via public databases — and assesses the governance gaps each presents. A consumer-facing checklist accompanies the analysis.

1. Introduction: The Golden State Killer as Regulatory Inflection Point

The April 2018 arrest of Joseph James DeAngelo, accomplished by uploading crime-scene DNA to a public genealogy platform and identifying distant relatives, marked the first high-profile demonstration that consumer genetic databases could function as de facto identification systems for the entire related population of the United States. The technique — forensic investigative genetic genealogy — has since been credited with hundreds of identifications, including victims and suspects in decades-old cold cases. It has also generated the central governance question this paper addresses: through what legal mechanisms, and under what constraints, may the state query databases built for recreational genealogy?

2. Three Pathways to Genetic Data

Pathway one: voluntary disclosure. Private consumer platforms such as 23andMe and AncestryDNA report that the overwhelming majority of law enforcement contact is resolved without a court order, either because the company declines to cooperate or because the request involves account information rather than raw genetic data. Both companies publish transparency reports stating they disclose genetic data only upon a valid warrant, and both report having never — or almost never — turned over germline data to police. These are corporate commitments, however, not statutory entitlements.

Pathway two: compelled disclosure. Where a company does not volunteer access, the state may compel it through subpoena, court order, or warrant. The constitutional threshold matters enormously. Under the Third Circuit's decision in United States v. Katzin and the Supreme Court's reasoning in Carpenter v. United States (2018), a warrant supported by probable cause is increasingly understood as the constitutionally appropriate instrument for obtaining deeply revealing data. Whether Carpenter extends to genetic databases — which expose not only the target's information but that of relatives — remains the most consequential open question in the field.

Pathway three: the public genealogy workaround. Platforms permitting open search, principally GEDmatch and FamilyTreeDNA under opt-in regimes, are the workhorses of forensic genealogy. Because users affirmatively consent to law-enforcement matching, no subpoena is involved; the state simply uploads a profile as any other user might. Governance here rests entirely on platform terms of service and opt-in design choices — a private regulatory regime substituting for public law.

3. Case Studies

The Golden State Killer (California, 2018). Investigators used a public genealogy database under no judicial supervision, relying on standard terms of service. The identification survived; the methodological controversy did not, prompting GEDmatch to adopt an opt-in model for law enforcement matching in 2019.

The Sacramento warrant precedent. In subsequent investigations, California courts have approved warrants authorizing searches of entire database populations — a dragnet instrument that would have been unthinkable in any other evidentiary context. These warrants remain the sharpest illustration of the familial exposure problem: a single suspect's probable cause justifies querying the genomes of thousands.

4. Findings and the Consumer Checklist

Our review yields three findings: (1) statutory protection varies by state and rarely reaches compelled disclosure of genetic data specifically; (2) platform policies, not law, are currently the primary safeguard; (3) public opt-in databases operate outside the warrant framework entirely.

Consumer checklist:

• Read the platform's law enforcement disclosure policy before uploading; the major DTC companies publish warrant-preference commitments.
• On public genealogy platforms, verify your law enforcement matching setting; opt-in is the default safeguard on GEDmatch.
• Understand familial exposure: your upload identifies relatives who never consented.
• Note your state's genetic privacy statute, where one exists, and whether it addresses government access.
• Deletion requests terminate future matching but not analysis of previously uploaded data in all cases; confirm the platform's retention terms.

5. Conclusion

The current equilibrium — private promises in place of public law — is stable only so long as platform incentives align with user expectations. A statutory framework specifying warrant requirements for genetic database queries, and disclosure obligations for platforms, would convert an accident of corporate policy into a durable governance structure.