How consumer DNA databases turn a handful of distant cousins into a re-identification net for entire populations
Direct-to-consumer (DTC) genetic testing does not sequence your whole genome. A saliva sample is run on a microarray chip that reads roughly 630,000–700,000 predetermined single-nucleotide positions (SNPs) — under 0.03% of the ~3.2 billion base-pair genome. The output is a small, portable text file of rsID / chromosome / position / genotype triplets that a customer can download and freely re-upload to platforms with far weaker privacy defaults than the company that sold the kit.
A microarray does not read your genome letter by letter; it probes a fixed panel of ~650,000 sites chosen in advance because they vary usefully between people (ancestry-informative and disease-associated markers). The result — an "AA", "AG", or "GG" call at each position — is exported as a small raw-data file, typically 15–25 MB, in a simple tab-delimited format that every major platform can read.
That portability is the whole point of the ecosystem: a customer who tested with AncestryDNA can download the raw file and upload it, free of charge, to GEDmatch, FamilyTreeDNA, or MyHeritage to search for relatives who tested elsewhere. But each new upload target has its own retention policy, security posture, and terms of service — and the customer's consent decisions from the original testing company (marketing use, research use, law-enforcement matching) do not travel with the file.
The reason relative-matching feels effortless is that the underlying database is not just "your matches" — it is a shared, growing pool that every future uploader will also be compared against, indefinitely, unless the file is manually deleted. A file uploaded in 2016 for a hobbyist genealogy project is still being compared against every new user in 2026.
This single design choice — persistent, promiscuous comparison against all future uploads — is what later enables both the benign use case (finding a birth parent) and the two higher-risk use cases covered in later stages: forensic triangulation of unrelated suspects, and population-scale statistical re-identification of people who never personally tested.
Matching algorithms (variants of GERMLINE and hap-IBD) scan two phased genotype files for long, unbroken stretches where the SNP sequence is identical — a signature that both people inherited that stretch from a shared ancestor. Each stretch is measured in centimorgans (cM), a unit of recombination probability, not physical length. Summed across the genome, total shared cM predicts relationship degree with surprising precision.
A centimorgan is not a distance on the chromosome; it is a unit of recombination frequency — roughly a 1% chance that a stretch of DNA will be broken apart by crossover in one generation. Because each generation of meiosis shuffles and shortens inherited blocks, the number and length of IBD segments shrinks predictably (roughly by half) with each additional generation of separation between two relatives.
Matching engines phase each customer's genotype (statistically inferring which alleles came from which parent) and then run a sliding-window comparison across millions of SNPs, flagging any window where two people's haplotypes match continuously above a minimum length — commonly 7 cM / 700 SNPs as a detection floor, since shorter runs are increasingly likely to be identical by chance ("identical by state") rather than by descent.
The Shared cM Project — a crowdsourced dataset built by genetic genealogist Blaine Bettinger from over 60,000 known-relationship data points — is the reference table the whole industry effectively relies on to convert a raw cM total into a probability distribution over possible relationships. The ranges overlap: 900 cM could mean a first cousin, a half-aunt, or a great-grandparent, and disambiguating requires additional context (age, known family members, X-chromosome matching, triangulated segments).
Companies also tune their minimum-match thresholds, trading sensitivity for noise. AncestryDNA removed its speculative sub-8cM "Timber"-filtered matches in 2020, cutting a large share of low-confidence matches while keeping detection of true distant cousins largely intact — a direct illustration of how a single threshold parameter reshapes the whole visible relative network.
In April 2018, investigators identified Joseph James DeAngelo as the Golden State Killer — responsible for at least 13 murders and 50 rapes across California in the 1970s–80s — by uploading a crime-scene DNA profile to GEDmatch, pulling a list of distant cousin matches, and reconstructing the family trees behind those matches until every branch converged on one living man. No database search directly named a suspect; genealogy and geography did.
Crime-scene DNA is genotyped on the same SNP-array technology used by consumer kits (not the STR panel used for CODIS database searches), converted to a compatible file format, and uploaded to one of the small number of databases that historically permit law-enforcement search — chiefly GEDmatch and FamilyTreeDNA, since 23andMe and AncestryDNA do not allow it.
The search returns a list of genetic matches, almost always distant (3rd–4th cousin or further, since the true suspect is rarely already in the database). Genealogists then work backward from each match using public records — obituaries, census data, marriage records, social media, newspaper archives — reconstructing each match's family tree until two or more trees intersect at a shared ancestral couple. Age, sex, geography, and known family structure narrow the descendant branches down to specific living individuals, one of whom becomes the investigative lead — never sole probable cause on its own; a confirmatory sample (e.g. discarded trash) is still required.
The Department of Justice issued an interim policy in September 2019 restricting federal use of FGG to violent crimes and unidentified-remains cases, only after conventional CODIS searches are exhausted, and only on databases with an explicit opt-in for law-enforcement matching.
Maryland passed the first US state law specifically governing FGG in 2021, requiring judicial pre-authorization, restricting use to serious violent crimes, and mandating additional oversight of genealogist methodology; Montana enacted comparable restrictions the same year. GEDmatch itself was acquired by Verogen, a forensic genomics company, in December 2019 — folding a hobbyist genealogy site directly into the forensic DNA industry.
The most consequential finding in this field is not about people who tested — it is about people who never did. Yaniv Erlich and colleagues showed in Science (2018) that a reference database covering as little as ~2% of a target population is enough to return a third-cousin-or-closer match for the overwhelming majority of individuals of that ancestry, because the number of third cousins any one person has (typically several hundred) grows combinatorially with each additional generation of ancestors.
Every person has 2 parents, 4 grandparents, 8 great-grandparents — the number of ancestors doubles each generation back. Run the same logic forward and sideways: a typical person has on the order of a few hundred living third cousins, all descended from the same set of great-great-grandparents. If even a small, unrelated-seeming fraction of the population has tested, the odds that at least one of those hundreds of third cousins is in the database climbs rapidly toward certainty — which is exactly the mechanism Erlich's team modeled and validated against real genealogical databases.
The practical consequence: genetic anonymity is a population-level property, not an individual choice. Declining to test yourself does not remove you from this net if enough of your distant relatives have tested — a form of privacy loss with no personal opt-out.
Five years before the Erlich database-coverage study, the same research group (Gymrek, Erlich et al., Science, 2013) demonstrated a related attack: cross-referencing Y-chromosome short tandem repeat (Y-STR) profiles from supposedly de-identified genetic research participants (in datasets like the 1000 Genomes Project and CEPH) against recreational genetic-genealogy surname databases. By matching Y-STR haplotypes to surname clusters and combining that with public demographic data (age, state of residence), the team correctly inferred the surnames — and identified the individuals — of about 12% of tested male research participants, despite those participants having been promised anonymity as a condition of enrollment.
Legal protection for genetic data is fragmented across federal law, state statutes, and corporate terms of service that can change at any time — and, as the 2023 23andMe breach and 2025 bankruptcy filing showed, a genetic database itself can become a corporate asset subject to sale, seizure, or theft, independent of the privacy promises made when the data was first collected.
The Genetic Information Nondiscrimination Act (GINA, 2008) prohibits health insurers and employers from using genetic information to deny coverage or employment. It is a meaningful and frequently-cited protection — but it explicitly does not extend to life insurance, disability insurance, long-term-care insurance, or law-enforcement and government use, leaving several of the highest-stakes use cases entirely outside federal genetic-discrimination law. No comprehensive federal genetic-privacy statute fills that gap as of 2026.
In October 2023, attackers used credential stuffing — reusing passwords leaked from unrelated breaches — to access a comparatively small number of 23andMe accounts directly, then exploited the opt-in "DNA Relatives" matching feature to scrape profile data belonging to those accounts' connected matches. The result: roughly 6.9 million users' data (names, approximate locations, ancestry estimates, some self-reported traits) ended up for sale on hacking forums, including lists explicitly curated and marketed by ancestry — for example "Ashkenazi Jewish" and "Chinese"-surname subsets — raising concrete fears of ethnically targeted harassment.
23andMe subsequently updated its terms of service to limit customers' ability to pursue class-action litigation over such incidents, drawing public criticism, and filed for Chapter 11 bankruptcy in March 2025.
California's Genetic Information Privacy Act (GIPA, effective 2022) is among the most specific US state laws: it requires DTC genetic-testing companies to obtain separate, explicit consent for research use, marketing use, and law-enforcement disclosure, and to destroy a customer's biological sample on request. The EU's GDPR classifies genetic data as a "special category" under Article 9, requiring explicit consent and carrying fines up to 4% of global revenue — though enforcement against US-headquartered DTC firms has been limited in practice.
None of these frameworks anticipated a scenario where the database itself changes hands. When 23andMe filed for bankruptcy, its genetic database of more than 15 million profiles became a sellable corporate asset, prompting more than two dozen US state attorneys general to publicly urge customers to delete their data immediately — a reminder that, unlike a password, genetic data cannot be reset once it has been exposed or transferred.