By 2018, GEDmatch had accumulated profiles from millions of users, primarily people engaged in family history research, adoptee searches, and ancestry investigation. The site was run on a volunteer basis and was available free of charge for its core features. It was not designed for law enforcement use. It had no specific terms of service addressing law enforcement access.
The investigators who uploaded the Golden State Killer’s DNA profile to GEDmatch in the fall or winter of 2017 were operating in this ambiguous environment. There was no specific law authorizing or prohibiting the use of consumer DNA databases for investigative purposes. There was no established framework for how such databases should respond to law enforcement requests or uploads. The investigators simply used a publicly accessible tool that was available to anyone with internet access and a DNA data file.
The upload produced the distant-relative matches that began the genealogical work. The site’s functionality worked as designed: it identified DNA segments shared between the uploaded profile and existing users. The investigative significance was novel; the technical process was routine.
After DeAngelo’s arrest in April 2018, the novelty of the investigative technique became a subject of public discussion that the site’s operators had not anticipated. The case generated substantial media coverage of how the identification had been made, which exposed the investigative use of GEDmatch to a broad audience that had not previously been aware of the possibility.
GEDmatch responded to the public attention by updating its terms of service. In May 2019, the site changed its default: law enforcement access became opt-in rather than a default permission. Users who wanted their profiles to be available for law enforcement comparison had to actively choose that option. About 260,000 users had opted in by May 2020.