DNA Testing and Law Enforcement: How It Actually Works

The Golden State Killer case in April 2018 changed the public conversation about consumer DNA testing. California investigators identified the suspect by uploading crime-scene DNA to GEDmatch and matching it to the suspect’s third and fourth cousins, then narrowing down through traditional genealogy research. The technique, called forensic genetic genealogy or investigative genetic genealogy, became a routine investigative tool in the years that followed.

What is less well understood is that not all consumer DNA databases work this way. Different services have very different policies about law enforcement access, and the differences matter if this is something you care about.

Three distinct mechanisms

The phrase “law enforcement used DNA testing” covers three very different mechanisms. Keeping them separate is most of the work.

Voluntary matching databases. Services like GEDmatch and (under specific settings) FamilyTreeDNA allow users to opt in to having their DNA data matched against crime-scene profiles. Law enforcement uploads the unknown profile and finds relative matches. This is what powers most forensic genetic genealogy work.

Subpoena and warrant access to consumer companies. AncestryDNA and 23andMe do not let law enforcement query their databases freely. Access requires a subpoena or warrant, the company reviews the legal sufficiency, and the company can challenge requests it considers improper. Both companies publish annual transparency reports.

Direct testing by law enforcement labs. This is the traditional approach: a sample is collected directly from a person and tested in a forensic lab using the FBI’s CODIS system. It does not involve consumer DNA databases at all.

The first two are what consumer testing companies’ policies govern. The third has been around for decades and is not what changed in 2018.

GEDmatch

GEDmatch is a third-party genealogy site that accepts raw DNA data uploads from any major consumer testing company. It does not sell a kit; it provides matching and analysis tools for uploaded data.

After the Golden State Killer case, GEDmatch revised its policy in 2019 to make law enforcement matching opt-in by default. Existing users had to affirmatively opt in. Verogen, which acquired GEDmatch in 2019, later was acquired by Qiagen. The opt-in framework has remained in place.

If you have a GEDmatch account and want to control law enforcement matching, log in, go to your account settings, and confirm your matching preference is set the way you want.

FamilyTreeDNA

FamilyTreeDNA, in 2019, became the first major consumer testing company to allow opt-in law enforcement matching. Users can choose under “Law Enforcement Matching” in their account preferences whether their data participates in matching against forensic profiles.

This is unique among the major consumer companies. AncestryDNA and 23andMe do not have this dial because they do not allow open matching, period.

AncestryDNA and 23andMe

Both AncestryDNA and 23andMe state in their privacy policies that they do not voluntarily cooperate with law enforcement queries. Access requires a valid subpoena or warrant. Both companies have stated they will challenge overbroad requests.

Both publish annual transparency reports. Historically, the numbers have been low: a small number of requests per year, with the company complying with a fraction of them. The exact figures shift year to year; check the companies’ published reports for current data.

If a request involves your specific data, you do not get a notification under most legal processes. The company complies with the legal order; the customer is generally not a party.

What forensic genetic genealogy actually requires

A few details worth understanding about the technique itself.

It works best when you have a relatively close relative (third cousin or closer) in the database, ideally with a public family tree. Without the family tree, the genetic match alone usually does not identify a specific person; investigators have to do traditional genealogy work to narrow from “this match’s family branch” to “this individual.”

It identifies relatives, not the original tester. If your second cousin has uploaded to GEDmatch and opted in, and you have never tested, you can still be relevant to an investigation involving a relative of yours.

It has had verified successes. As of the mid-2020s, forensic genetic genealogy has been cited in the identification of suspects in hundreds of cold cases and the identification of unidentified human remains. It has also raised civil liberties concerns that academic and legal scholars are still working through.

Practical implications for users

A few decisions to think about, given the above.

If you have tested with AncestryDNA or 23andMe and have not uploaded your raw data anywhere else, you are subject to the subpoena-or-warrant standard for your specific data. Your relatives’ decisions to upload to GEDmatch or FTDNA may still implicate you indirectly.

If you have uploaded to GEDmatch or FTDNA, check your matching preferences. They are not hidden, but they are not always front-and-center.

If you have a personal reason to avoid any potential law enforcement matching (sensitive employment, advocacy work, personal safety concerns), the cleanest path is to not upload to GEDmatch or FTDNA, and to consider whether testing at all is the right call. See is it safe to do a DNA test in 2026 for the broader framework.

What this is not

A few things this is not, to be clear. It is not a way for police to pull your DNA profile out of AncestryDNA on a whim. It is not anonymous: an opt-in match links back to a real account with a real email. And it is not specific to any one suspect; the technique can be (and has been) used to identify both perpetrators and unidentified remains.

For the related questions, see can DNA test data be sold, who owns your DNA after a test, and DNA test privacy policies compared.

This piece is part of our Genetic Data Privacy guide.