Whose consent travels across borders

A DNA sample does not need a passport.

It can be recovered in one country, converted into a genetic profile, and compared with relatives whose family-history testing happened somewhere else. A match may point toward a person who never bought a kit, never uploaded a file, and never clicked “I agree.”

That is one of forensic genetic genealogy’s most powerful features. It is also the source of one of its hardest questions: when genetic information is shared across a family, whose consent should count?

The question deserves more than a slogan. Forensic genetic genealogy, often shortened to FGG, has helped restore names to unidentified people and generate leads in long-unsolved violent crimes. Those outcomes matter. A person who was buried without a name can be returned to a family and remembered as a life, not a case number.

But acknowledging that good does not make the privacy question disappear. It makes careful rules more important.

A match is not confined to the person who tested

Consumer genealogy databases are built around relatives. A person uploads a DNA profile to explore ancestry, find cousins, or build a family tree. Depending on the service and the settings selected, that profile may also be available for comparisons connected to law-enforcement investigations.

Investigators do not usually need a close relative to appear. A more distant cousin can be enough to place an unknown person within a family network. Genealogists then use public records, family trees, geography, ages, and other information to narrow the possibilities.

That means the person ultimately identified may never have used a genealogy service at all.

This is not because one relative’s DNA is identical to another’s. It is because biological relatives share detectable stretches of inherited DNA. One person’s decision can therefore reveal information about people who made a different decision—or no decision.

Genomic data is relational. That is the heart of the consent problem.

Borders make the relationship harder to govern

Families move. Records cross oceans. Consumer DNA companies may serve customers in many countries, while laboratories, investigators, database operators, and the person being sought may all be in different jurisdictions.

The United States has no single, comprehensive national statute written specifically to govern every use of forensic genetic genealogy. The U.S. Department of Justice’s interim policy limits federal use to serious violent crimes and unidentified remains, requires investigators to use services that provide notice of law-enforcement access, and describes FGG as a lead-generating technique rather than proof of identity. But that policy binds covered Justice Department investigations; it is not a universal law governing every state agency or private database. State rules and company policies add further layers, producing a patchwork rather than one national standard.

Europe is not governed by a simple “GDPR bans it” rule. The General Data Protection Regulation treats genetic data as specially protected information in ordinary civil and commercial processing. Police and criminal-justice processing, however, is governed principally by the EU Law Enforcement Directive as implemented in each member country. That framework requires a legal basis, necessity, proportionality, safeguards for sensitive data, and rules for transfers outside the European Union.

Individual countries may impose additional restrictions through their criminal procedure, forensic DNA, medical, or bioethics laws. As a result, a technique considered available under policy in one jurisdiction may be limited, require judicial authorization, or lack a clear legal pathway in another.

The divide is therefore real, but it is not neat. “Europe” is not one police code, and “the United States” is not one privacy rule.

The identified person may be a victim

Privacy discussions can become abstract quickly. Unidentified people should bring them back to earth.

For families of the missing, a restored name can end years of uncertainty. For a person buried as a John or Jane Doe, identification restores a basic part of human dignity. It can reconnect remains with relatives, correct a death certificate, and allow a life story to replace an evidence label.

International kinship searching is already used for humanitarian identification. INTERPOL’s I-Familia system, which is distinct from consumer-database FGG, compares DNA from missing people or unidentified remains with profiles voluntarily supplied by relatives across member countries. It was designed for cases in which direct identification is not possible and includes dedicated kinship-matching safeguards.

That example shows the benefit of crossing borders: a family connection may exist in another country even when no useful match exists at home.

It also shows why consent cannot be treated as a box checked once for all future purposes. A relative who knowingly provides a sample to identify a missing family member is participating in a defined process. A genealogy customer who uploaded years earlier for ancestry research may not have understood that the same family connection could later assist an investigation abroad.

Those situations are not morally or legally identical.

A genealogy lead is not a verdict

Another safeguard is evidentiary restraint.

An FGG result can identify a family line or suggest a particular person. It does not, by itself, establish that the person committed a crime. Investigators ordinarily must confirm an identity through a separate, direct DNA comparison and then evaluate the full evidence.

That distinction protects everyone involved. It protects innocent relatives whose names appear during family-tree research. It protects a person identified as a possible source of crime-scene DNA, who remains presumed innocent unless proven guilty in court. And it protects victims and their families from claims that outrun the evidence.

In an unidentified-remains case, the same discipline applies: a genealogical hypothesis should be confirmed through independent records, direct comparison, or other appropriate forensic methods before a public identification is announced.

FGG is a method for developing information. The lawful authority to use it, the safeguards surrounding it, and the evidence required afterward are separate questions.

Better rules can preserve the benefit

The choice is not between using forensic genetic genealogy without limits and abandoning a method that restores names.

A more durable framework would make several things clear: which cases qualify; which databases may be searched; what users were told; whether international access is permitted; who authorizes a search; how uninvolved relatives are protected; how long profiles and research notes are retained; and what independent confirmation is required before action or public identification.

Cross-border cases also need an answer to a basic jurisdictional question: does access that is technically possible remain lawful when the investigating country, the database, the tested relative, and the person being identified are subject to different rules?

That answer should not be improvised after a match appears.

Forensic genetic genealogy can return a name to someone who lost it. It can give a family an answer that geography once kept out of reach. Those are genuine public goods.

The strongest way to protect them is not to dismiss consent concerns, but to meet them honestly—with transparent permissions, narrow uses, independent confirmation, and rules strong enough to travel as far as the DNA does.

Sources: U.S. Department of Justice, Interim Policy on Forensic Genetic Genealogical DNA Analysis and Searching (2019) · EU Directive 2016/680 (Law Enforcement Directive) and Regulation 2016/679 (GDPR) · INTERPOL I-Familia.