Is Forensic Genetic Genealogy Legal? What the DOJ Rules Actually Say

If you follow cold-case news, you’ve seen the phrase: a suspect was “identified through genetic genealogy.” It sounds like science closed the case on its own. It didn’t — and the rules that govern how investigators are allowed to use this technique are narrower, and more careful, than the headlines suggest.

Here’s what the rules actually say, where they apply, and why the most important sentence in them is about protecting people who are not guilty.

The Short Answer

Forensic genetic genealogy (FGG) is legal, but it is governed — at the federal level — by a written policy that treats a genetic match as a starting point, not a verdict. The clearest statement of that rule comes from the U.S. Department of Justice’s 2019 interim policy on the technique, which says a genetic association is “used by law enforcement only as an investigative lead,” and that “a suspect shall not be arrested based solely on a genetic association” generated by a genealogy service.

That single sentence is the heart of this brick. Read on for exactly what it does — and does not — mean.

What the DOJ Policy Is (and Three Things It Is Not)

In September 2019 the Department of Justice approved an Interim Policy titled Forensic Genetic Genealogical DNA Analysis and Searching, effective November 1, 2019. It set out, for the first time in writing, when and how investigators working under DOJ may use genetic genealogy.

Three caveats matter before anyone treats it as “the law of the land”:

• It is interim, not a final rule. The document is labeled an interim policy. It was meant to guide practice, not to serve as a permanent, finalized regulation. Treat it as the best available written federal standard — not the last word.
• It binds federal and participating investigations — it is not a nationwide statute. The policy applies to Department of Justice components and cases involving Department resources and interests. It is not a federal criminal statute that automatically governs every police department in the country. State and local rules on genetic genealogy vary, and many are not covered by this policy at all. So “shall not be arrested based solely on a genetic association” is a DOJ policy rule — not a universal American law you can assume applies to any given local case.
• It names no specific database. The policy speaks generally of “publicly-available open-data personal genomics databases” and “direct-to-consumer genetic genealogy services.” It does not name GEDmatch, FamilyTreeDNA, or any other service. When you see a specific database named in a news story, that’s the reporting — not the DOJ policy.

What the Policy Actually Requires

Within that scope, the policy is strict. A few key requirements, straight from the document:

• CODIS comes first. Before FGG may even be attempted, the crime-scene profile must have been uploaded to CODIS (the national DNA database) and those searches must have failed to produce a confirmed match. FGG is a fallback for cases traditional DNA databases can’t crack. (See our explainer on how CODIS differs from forensic genetic genealogy.)
• It’s limited to serious cases. The policy applies to unsolved violent crime where the sample is believed to be from the perpetrator, or to suspected-homicide unidentified human remains. It is not a tool for routine or minor cases.
• Investigators must identify themselves. Agencies must identify as law enforcement to a genealogy service, and may only use services that give explicit public notice that law enforcement may search them.
• A genetic match is only a lead. The policy states plainly that the genetic association “is used by law enforcement only as an investigative lead,” and that “traditional genealogy research and other investigative work is needed to determine the true nature of any genetic association.”
• Confirmation is required before an arrest. If a suspect is identified, standard STR DNA typing must be performed and compared directly against the crime-scene profile already in CODIS. The genealogy hit does not confirm identity — a separate, direct DNA comparison does. (This is the whole point of our brick on whether FGG is evidence or an investigative lead.)
• Data gets handled and destroyed under rules. The policy sets out consent requirements for collecting reference samples from third parties, and rules for removing and destroying genetic profiles and account data depending on how a case resolves.

The Role of Consent: Opt-In Databases

The genealogy services investigators are permitted to use are built on consent. GEDmatch, for example, runs an opt-in model: users choose whether to allow their uploaded genealogical data to be compared against law-enforcement profiles, and can change that setting. In its own words, the service lets users “opt in and enable law enforcement to solve violent crimes and exonerate the falsely accused,” and notes that law enforcement does not receive a user’s raw DNA data when they opt in — only the same limited match information any user would see.

This is the consent backbone that the DOJ policy’s “explicit notice” requirement leans on: investigators are directed to use only services that tell their users, plainly, that law enforcement may search them.

The Privacy Debate — Fairly, Both Sides

FGG is genuinely contested, and reasonable people land in different places. Laid out plainly:

• The concern. When you upload your DNA to a genealogy site, you may be exposing genetic relatives — cousins, second cousins, people you’ve never met — to a law-enforcement search they never consented to. Critics argue that an individual’s opt-in can implicate an entire extended family, and that the technique’s rules are still evolving and unevenly enforced across jurisdictions.
• The counter-argument. Supporters note that FGG operates on consent-based, opt-in databases; that it is a last resort after CODIS fails; that it has both convicted the guilty and, as GEDmatch itself emphasizes, helped exonerate the falsely accused; and that the DOJ policy’s confirmation-and-destruction rules are designed to limit misuse.

We’re not here to settle that debate. The point of this hub is to make sure you understand what the technology does and doesn’t do before you decide where you stand.

Why the “Only a Lead” Rule Protects the Innocent

It’s tempting to read “shall not be arrested based solely on a genetic association” as red tape. It isn’t. It’s a safeguard for people who are not guilty.

A genealogy match points at a family branch, not a person. Everyone on that branch — including the completely innocent — can look, at first, like a candidate. The requirement that investigators do traditional genealogy, gather non-genetic evidence, and confirm with a direct DNA comparison before an arrest is what keeps an innocent relative from being charged because of who they’re related to. The rule that a match is “only an investigative lead” is, in practice, a rule about not accusing the wrong person.

That’s the dignity thread that runs through this whole hub: the same care that gives a family answers is the care that protects the innocent from becoming a headline.

Sources: U.S. Department of Justice, Interim Policy: Forensic Genetic Genealogical DNA Analysis and Searching (approved Sept. 2, 2019; effective Nov. 1, 2019); GEDmatch — the Genetic Witness Program (opt-in consent framework). This is a plain-English explainer, not legal advice.

Related in This Hub

• Brick 1 — CODIS vs. Forensic Genetic Genealogy: what’s the difference?
• Brick 2 — How Othram works: inside a genetic-genealogy identification
• Brick 3 — Is forensic genetic genealogy evidence, or an investigative lead?

This explainer describes a 2019 DOJ interim policy governing federal and participating investigations. It is general information, not legal advice, and does not describe the law of any particular state or local jurisdiction. Rules in this area continue to evolve.