🧬 Genetic Relative Matching Privacy Risk Simulator

Raw Genotype Upload & SNP-Level Comparison

Direct-to-consumer (DTC) genetic testing does not sequence your whole genome. A saliva sample is run on a microarray chip that reads roughly 630,000–700,000 predetermined single-nucleotide positions (SNPs) — under 0.03% of the ~3.2 billion base-pair genome. The output is a small, portable text file of rsID / chromosome / position / genotype triplets that a customer can download and freely re-upload to platforms with far weaker privacy defaults than the company that sold the kit.

• ~630K–700K: SNPs genotyped per test (Illumina/Affymetrix array, not WGS)
• >40M: DTC tests sold worldwide (23andMe + AncestryDNA + others, by 2023)
• $79–$199: Cost of consumer test kit (vs $600+ for clinical whole-genome sequencing)
• ~1.7M: GEDmatch registered users (a free, voluntary third-party upload site)

From saliva to a searchable text file

A microarray does not read your genome letter by letter; it probes a fixed panel of ~650,000 sites chosen in advance because they vary usefully between people (ancestry-informative and disease-associated markers). The result — an "AA", "AG", or "GG" call at each position — is exported as a small raw-data file, typically 15–25 MB, in a simple tab-delimited format that every major platform can read.

That portability is the whole point of the ecosystem: a customer who tested with AncestryDNA can download the raw file and upload it, free of charge, to GEDmatch, FamilyTreeDNA, or MyHeritage to search for relatives who tested elsewhere. But each new upload target has its own retention policy, security posture, and terms of service — and the customer's consent decisions from the original testing company (marketing use, research use, law-enforcement matching) do not travel with the file.

One upload, several unrelated audiences

The reason relative-matching feels effortless is that the underlying database is not just "your matches" — it is a shared, growing pool that every future uploader will also be compared against, indefinitely, unless the file is manually deleted. A file uploaded in 2016 for a hobbyist genealogy project is still being compared against every new user in 2026.

This single design choice — persistent, promiscuous comparison against all future uploads — is what later enables both the benign use case (finding a birth parent) and the two higher-risk use cases covered in later stages: forensic triangulation of unrelated suspects, and population-scale statistical re-identification of people who never personally tested.

IBD Segment Matching & the Relative-Match Network

Matching algorithms (variants of GERMLINE and hap-IBD) scan two phased genotype files for long, unbroken stretches where the SNP sequence is identical — a signature that both people inherited that stretch from a shared ancestor. Each stretch is measured in centimorgans (cM), a unit of recombination probability, not physical length. Summed across the genome, total shared cM predicts relationship degree with surprising precision.

• ~7,440 cM: Total autosomal genome length (sum across the 22 autosomes)
• ~3,720 cM: Parent–child shared cM (always ~50%, deterministic)
• ~2,613 cM: Full-sibling shared cM (avg) (range 2,209–3,384 cM)
• ~73 cM: 3rd-cousin shared cM (avg) (range 0–234 cM, can be undetectable)

What a centimorgan actually measures

A centimorgan is not a distance on the chromosome; it is a unit of recombination frequency — roughly a 1% chance that a stretch of DNA will be broken apart by crossover in one generation. Because each generation of meiosis shuffles and shortens inherited blocks, the number and length of IBD segments shrinks predictably (roughly by half) with each additional generation of separation between two relatives.

Matching engines phase each customer's genotype (statistically inferring which alleles came from which parent) and then run a sliding-window comparison across millions of SNPs, flagging any window where two people's haplotypes match continuously above a minimum length — commonly 7 cM / 700 SNPs as a detection floor, since shorter runs are increasingly likely to be identical by chance ("identical by state") rather than by descent.

From shared cM to a relationship guess

The Shared cM Project — a crowdsourced dataset built by genetic genealogist Blaine Bettinger from over 60,000 known-relationship data points — is the reference table the whole industry effectively relies on to convert a raw cM total into a probability distribution over possible relationships. The ranges overlap: 900 cM could mean a first cousin, a half-aunt, or a great-grandparent, and disambiguating requires additional context (age, known family members, X-chromosome matching, triangulated segments).

Companies also tune their minimum-match thresholds, trading sensitivity for noise. AncestryDNA removed its speculative sub-8cM "Timber"-filtered matches in 2020, cutting a large share of low-confidence matches while keeping detection of true distant cousins largely intact — a direct illustration of how a single threshold parameter reshapes the whole visible relative network.

Law-Enforcement Triangulation — The Golden State Killer Method

In April 2018, investigators identified Joseph James DeAngelo as the Golden State Killer — responsible for at least 13 murders and 50 rapes across California in the 1970s–80s — by uploading a crime-scene DNA profile to GEDmatch, pulling a list of distant cousin matches, and reconstructing the family trees behind those matches until every branch converged on one living man. No database search directly named a suspect; genealogy and geography did.

• Apr 2018: DeAngelo identified (via GEDmatch forensic genetic genealogy)
• ~10–20: Distant matches used (in the 3rd–4th cousin range)
• >1,000: Family tree reconstructed (relatives mapped by genealogists)
• >600: FGG cases solved by 2023 (per genetic-genealogy firms, e.g. Parabon)

How forensic genetic genealogy (FGG) actually works

Crime-scene DNA is genotyped on the same SNP-array technology used by consumer kits (not the STR panel used for CODIS database searches), converted to a compatible file format, and uploaded to one of the small number of databases that historically permit law-enforcement search — chiefly GEDmatch and FamilyTreeDNA, since 23andMe and AncestryDNA do not allow it.

The search returns a list of genetic matches, almost always distant (3rd–4th cousin or further, since the true suspect is rarely already in the database). Genealogists then work backward from each match using public records — obituaries, census data, marriage records, social media, newspaper archives — reconstructing each match's family tree until two or more trees intersect at a shared ancestral couple. Age, sex, geography, and known family structure narrow the descendant branches down to specific living individuals, one of whom becomes the investigative lead — never sole probable cause on its own; a confirmatory sample (e.g. discarded trash) is still required.

Policy response and legal guardrails since 2018

The Department of Justice issued an interim policy in September 2019 restricting federal use of FGG to violent crimes and unidentified-remains cases, only after conventional CODIS searches are exhausted, and only on databases with an explicit opt-in for law-enforcement matching.

Maryland passed the first US state law specifically governing FGG in 2021, requiring judicial pre-authorization, restricting use to serious violent crimes, and mandating additional oversight of genealogist methodology; Montana enacted comparable restrictions the same year. GEDmatch itself was acquired by Verogen, a forensic genomics company, in December 2019 — folding a hobbyist genealogy site directly into the forensic DNA industry.

Third-Cousin Reach — How Small Databases Cover Whole Populations

The most consequential finding in this field is not about people who tested — it is about people who never did. Yaniv Erlich and colleagues showed in Science (2018) that a reference database covering as little as ~2% of a target population is enough to return a third-cousin-or-closer match for the overwhelming majority of individuals of that ancestry, because the number of third cousins any one person has (typically several hundred) grows combinatorially with each additional generation of ancestors.

• ~2%: DB coverage for ~99% 3rd-cousin reach (Erlich et al., Science, 2018)
• ~60%: US pop. of European descent already reachable (estimated as of the 2018 study, via existing DBs)
• ~12%: Y-STR surname re-identification success (Gymrek et al., Science, 2013)
• ~200–850: Avg. third cousins per person (depending on family size assumptions)

The combinatorics of long-range familial search

Every person has 2 parents, 4 grandparents, 8 great-grandparents — the number of ancestors doubles each generation back. Run the same logic forward and sideways: a typical person has on the order of a few hundred living third cousins, all descended from the same set of great-great-grandparents. If even a small, unrelated-seeming fraction of the population has tested, the odds that at least one of those hundreds of third cousins is in the database climbs rapidly toward certainty — which is exactly the mechanism Erlich's team modeled and validated against real genealogical databases.

The practical consequence: genetic anonymity is a population-level property, not an individual choice. Declining to test yourself does not remove you from this net if enough of your distant relatives have tested — a form of privacy loss with no personal opt-out.

The 2013 precedent — surname inference from "anonymous" research data

Five years before the Erlich database-coverage study, the same research group (Gymrek, Erlich et al., Science, 2013) demonstrated a related attack: cross-referencing Y-chromosome short tandem repeat (Y-STR) profiles from supposedly de-identified genetic research participants (in datasets like the 1000 Genomes Project and CEPH) against recreational genetic-genealogy surname databases. By matching Y-STR haplotypes to surname clusters and combining that with public demographic data (age, state of residence), the team correctly inferred the surnames — and identified the individuals — of about 12% of tested male research participants, despite those participants having been promised anonymity as a condition of enrollment.

Privacy Safeguards, Data Breaches, and the Regulatory Patchwork

Legal protection for genetic data is fragmented across federal law, state statutes, and corporate terms of service that can change at any time — and, as the 2023 23andMe breach and 2025 bankruptcy filing showed, a genetic database itself can become a corporate asset subject to sale, seizure, or theft, independent of the privacy promises made when the data was first collected.

• 6.9M: 23andMe accounts exposed (Oct 2023) (via credential stuffing + relative scraping)
• 0: GINA coverage gap (no protection for life/disability/LTC insurance)
• ~14: US states with dedicated genetic-privacy law (e.g. CA GIPA, MD, MT, UT, AZ, as of 2024)
• Art. 9: GDPR genetic-data classification ("special category," explicit consent required)

The GINA gap and the limits of federal protection

The Genetic Information Nondiscrimination Act (GINA, 2008) prohibits health insurers and employers from using genetic information to deny coverage or employment. It is a meaningful and frequently-cited protection — but it explicitly does not extend to life insurance, disability insurance, long-term-care insurance, or law-enforcement and government use, leaving several of the highest-stakes use cases entirely outside federal genetic-discrimination law. No comprehensive federal genetic-privacy statute fills that gap as of 2026.

The 23andMe breach and its downstream harms

In October 2023, attackers used credential stuffing — reusing passwords leaked from unrelated breaches — to access a comparatively small number of 23andMe accounts directly, then exploited the opt-in "DNA Relatives" matching feature to scrape profile data belonging to those accounts' connected matches. The result: roughly 6.9 million users' data (names, approximate locations, ancestry estimates, some self-reported traits) ended up for sale on hacking forums, including lists explicitly curated and marketed by ancestry — for example "Ashkenazi Jewish" and "Chinese"-surname subsets — raising concrete fears of ethnically targeted harassment.

23andMe subsequently updated its terms of service to limit customers' ability to pursue class-action litigation over such incidents, drawing public criticism, and filed for Chapter 11 bankruptcy in March 2025.

State laws, GDPR, and the database-as-asset problem

California's Genetic Information Privacy Act (GIPA, effective 2022) is among the most specific US state laws: it requires DTC genetic-testing companies to obtain separate, explicit consent for research use, marketing use, and law-enforcement disclosure, and to destroy a customer's biological sample on request. The EU's GDPR classifies genetic data as a "special category" under Article 9, requiring explicit consent and carrying fines up to 4% of global revenue — though enforcement against US-headquartered DTC firms has been limited in practice.

None of these frameworks anticipated a scenario where the database itself changes hands. When 23andMe filed for bankruptcy, its genetic database of more than 15 million profiles became a sellable corporate asset, prompting more than two dozen US state attorneys general to publicly urge customers to delete their data immediately — a reminder that, unlike a password, genetic data cannot be reset once it has been exposed or transferred.