Cousins, Clues, and Custodians: The Governance Debt of Hybrid Genealogy Platforms

Two Records, One Reidentification Engine

For most of the twentieth century, American genealogy ran on paper: census schedules, ship manifests, county marriage licenses, the microfilm reading rooms of Salt Lake City. The last decade changed the substrate. Platforms such as Ancestry and MyHeritage now merge documentary research with consumer DNA matching, allowing a subscriber to graft test results onto a tree that may span generations and hundreds of named individuals.

The combination is more powerful than the sum of its parts. A family tree supplies names, dates, and relationships; a DNA match supplies biological confirmation and degrees of relatedness. Joined together, they function as an inference engine capable of attaching real-world identities to genetic information — the same capability that law enforcement famously exploited in the Golden State Killer case, but operating continuously and at commercial scale.

This working paper examines an under-theorized question: when a platform holds both records, what governance obligations arise toward the people who appear in the data without ever creating an account?

The Unconsented Subject

Consider the ordinary mechanics of an upload. A single user swabs, registers, and clicks through a terms-of-service agreement. That user's results then surface as a match to dozens of strangers: second cousins, half-siblings, descendants of a great-grandparent's undocumented affair. Each match may reveal paternity, adoption, or misattributed parentage — information the matched relatives never agreed to receive, let alone to have generated.

American privacy law handles this poorly. HIPAA does not reach consumer genealogy companies. The Genetic Information Nondiscrimination Act (GINA) restricts employer and insurer use of genetic information but imposes no consent architecture on matching algorithms. State statutes, from California's CCPA to the genetic privacy laws of Alaska and Florida, typically protect the individual who supplied the sample — not the relatives whose identities the sample exposes. The result is a structural asymmetry: one person's consent can determine the genetic exposure of an extended family, a problem this institute has examined elsewhere, but which hybrid platforms sharpen considerably.

Why Hybridization Changes the Analysis

A standalone DNA database supports matching. A standalone tree database supports documentary research. A hybrid platform supports resolution — the assignment of a genetic match to a named, located, living person, often within hours of upload.

Three features distinguish this capability:

1. Persistence. Trees are curated over years and passed between accounts, meaning identity linkages outlive the original test-taker's engagement with the service.
2. Inheritance. Tree data is frequently imported wholesale from other subscribers, so a person's name, birth date, and parentage may enter a genetic inference chain without any action by that person or their relatives.
3. Portability. Matching data can be exported, shared with third-party tools, or — in documented cases — transferred to law enforcement under a valid legal process, with the tree supplying the interpretive key.

Governance frameworks built around the individual data subject do not map cleanly onto this architecture. The effective unit of exposure is the kindred, not the account holder.

A Draft Framework for Custodial Duties

We propose that hybrid platforms be understood as custodians of kinship inference, a designation that carries several obligations:

• Relatives-facing disclosure. Terms of service should state plainly that matches may reveal living people and sensitive relationships to others, not merely that the user's own data may be shared.
• Inference controls. Users should be able to suppress their profile from matching, restrict which relatives see shared ethnicity or relationship estimates, and set defaults for posthumous account transfer.
• Tree-data provenance. Platforms should track whether a living person's details were entered by that person, a relative, or a third party, and apply heightened protections to the latter.
• Law-enforcement intermediation. Any disclosure to government actors should pass through a documented process, consistent with the Department of Justice's 2019 interim policy on forensic genetic genealogy, which itself remains advisory rather than binding on private platforms.

Open Questions for the Field

This paper is a provocation rather than a conclusion. Among the questions we invite comment on: Should relatives hold a cause of action against a platform for unwanted relationship disclosures? Can consent be meaningfully delegated by a test-taker on behalf of identifiable kin? And does the First Amendment's protection of published genealogical research constrain any regulatory approach?

The genealogical impulse is old; the dossiers it now produces are not. Closing the governance gap will require treating family trees not as scrapbooks, but as the identity infrastructure they have quietly become.