One Spit Tube, Many Stakeholders: Rethinking Consent for the Extended Family

The Asymmetry at the Heart of Genetic Privacy

Almost every framework in American privacy law assumes a one-to-one relationship: one person's data, one person's consent. Genomics breaks that assumption at a molecular level. Because close relatives share substantial portions of their DNA, an individual who submits a saliva sample to a consumer testing company reveals probabilistic information about parents, siblings, children, cousins, and, through matching databases, distant connections who have never heard of the service.

A woman in Virginia can, with a single upload, surface a half-sibling her father never acknowledged. A man in Oregon can effectively disclose a family's elevated risk of Huntington's disease to anyone with access to a shared tree. The relatives implicated in these disclosures had no notice, no opt-out, and no remedy.

What Current Law Does—and Doesn't—Cover

The Genetic Information Nondiscrimination Act of 2008 (GINA) prohibits discrimination in health insurance and employment based on genetic information, but it says nothing about consent. HIPAA treats genetic information held by covered entities as health information, yet most direct-to-consumer testing companies fall outside HIPAA entirely. The Federal Trade Commission has enforced against companies that misrepresented their privacy practices, but enforcement after the fact is a poor substitute for a consent architecture.

The regulatory action has therefore migrated to the states, and the results are instructive in their inconsistency:

• Alaska, Arizona, and Utah have enacted statutes requiring consumer genetic companies to obtain express consent for data use and, in some cases, deletion upon request—though these protections run to the individual customer, not to relatives.
• California extended deletion and consent rights under its consumer privacy regime to genetic data collected by direct-to-consumer companies.
• Florida and South Dakota have addressed genetic privacy in insurance contexts, restricting insurers' use of genetic information without consent.
• Maryland and several other legislatures have debated bills that would treat a relative's genetic information as deserving independent protection—an approach that raises its own difficult questions.

No state has yet implemented a workable mechanism by which a non-consenting relative could object to an inference drawn about them from a consenting relative's data.

The Law Enforcement Wrinkle

The familial search cases that made Golden State Killer investigations famous demonstrated the investigative power of shared DNA, but they also crystallized the privacy problem. When police identify a suspect through a relative's genealogy upload, the suspect's genetic privacy is effectively determined by a third party's hobby. Several states, including Maryland and Montana, now restrict familial DNA searching in forensic databases, but consumer databases remain largely outside these restrictions—a gap that has shifted law enforcement demand toward the private market.

Toward Kin-Aware Consent

We argue that US policy should move toward a framework with three elements:

First, tiered disclosure. Companies should be required to explain, in plain language, what a single upload can reveal about biological relatives, at the point of purchase rather than buried in terms of service.

Second, relative notification and objection rights. Where a service's matching features expose identifiable information about a non-consenting person, that person should have a mechanism to limit further sharing—particularly for sensitive inferences such as health risk or relationship discovery.

Third, a federal floor. The current patchwork means protection depends on a consumer's state of residence, an accident of geography that neither companies nor families can reasonably navigate. A baseline statute establishing deletion rights, consent requirements, and restrictions on secondary use would harmonize the market and close the forensic loophole.

A Problem That Grows With the Database

Every year, consumer databases expand and the probability that any American can be identified through a relative increases. The family consent problem will not resolve itself through market forces, because the parties most affected—non-consenting relatives—are not the companies' customers. Addressing it requires deliberate policy design that acknowledges what genomics has always implied: your DNA was never only yours.