Can Police Use Your DNA Test? Forensic Genealogy Explained

How forensic genetic genealogy works

The method is often called investigative genetic genealogy. It starts with DNA left at a crime scene or from unidentified remains, which does not match anyone in the standard criminal DNA index (CODIS). A lab turns that evidence into a genotype file of the kind consumer tests produce, and investigators upload it to a genealogy database that permits law enforcement use.

The database returns a list of users who share stretches of DNA with the evidence. Genealogists then build family trees from those distant relatives, narrow the possibilities using age, location and family structure, and arrive at a small number of candidates. Police then obtain a reference sample from a candidate, sometimes a discarded item, and run a conventional forensic test against the crime-scene profile.

The best-known example is the 2018 arrest in the Golden State Killer case. NPR reported that investigators uploaded a profile built from the crime-scene DNA to GEDmatch, found that a relative of the suspect had uploaded their own DNA, and worked outward through the family tree until a discarded item with the suspect's DNA matched.

Which services allow police to search

Policies differ, and have changed since 2018. The table summarises what we could verify in October 2026. Where a source is dated, we say so.

Terms of service can change after acquisitions, as we saw in the 2025 23andMe sale, covered in our 23andMe timeline. Reread the current policy of any service that holds your DNA.

What rules constrain police

Federal policy. The US Justice Department published an interim policy on forensic genetic genealogy, effective November 1, 2019. In summary, investigators should search only services that tell users and the public that police may use them, should identify themselves as law enforcement, and should generally focus on unsolved violent crimes such as homicides and sexual assaults or on unidentified remains thought to involve a homicide. It also says a genetic match alone cannot justify an arrest, and that a suspect must be confirmed with standard forensic DNA testing against the CODIS profile. The policy sets rules for the Justice Department itself, and other agencies follow their own practices or state law.

State law. The National Conference of State Legislatures reports that Maryland and Montana passed the first state laws on this in 2021. Each requires police to get a court order before accessing a consumer genetic database, and Maryland also limits access to databases whose users were told their data could be used for investigations. Utah followed in 2023 with a law setting when police may request a genealogy database or service, restricting arrests based on certain genetic information, and creating procedures for destroying DNA specimens and remedies for violations.

These laws are a patchwork. If you live outside those states, the main protection is the policy of the company you choose.

You do not have to test to be found

The method works through shared DNA, so a relative's upload can narrow a search toward your branch of the family even if you have never tested. That is the core privacy trade-off, and it is why one person's choice affects many. We explore the family side in your DNA is shared: how one relative's test affects the family.

What a match does and does not prove

• A match is a lead. A distant cousin match says two people share an ancestor, not that either did anything.
• Confirmation is separate. Under the federal policy, identity is confirmed by a conventional forensic test, not by the genealogy match.
• Errors in family trees happen. Records, adoptions and unreported parentage can mislead. That is one reason the confirmation step exists.

Genetic privacy law also covers other ground. The Genetic Information Nondiscrimination Act is about health insurance and employment, not policing, as we explain in our GINA guide.

What you can do

1. Check each service's law enforcement setting or policy for every site where your DNA or raw data sits.
2. Think before uploading raw data to a third-party genealogy site. It is a separate decision from taking a test.
3. Talk to relatives who may upload, since their choice affects you.
4. Delete what you do not need. Our guide to deleting your DNA data explains the limits.
5. Ask about the policy before you buy. Add it to the list in our privacy comparison.

Bottom line

Forensic genealogy is a real investigative tool with real safeguards on paper and uneven rules in practice. Whether police can search your DNA depends mainly on which database holds it and what you chose. You can control your own settings, but not your cousins'. Choose services with clear, opt-in policies, and read the law-enforcement section before you upload anything.

Common questions

Medical disclaimer. GenomeTesting.org publishes educational content about genetics and consumer genomic testing. Nothing here is medical advice, a diagnosis, or a substitute for care from a qualified clinician or genetic counsellor. Decisions about testing, treatment, or interpreting your own results should be made with a healthcare professional who can see your full history.