The central tension is between the investigative value of the method and the privacy implications for people who submitted their DNA to genealogy databases with no expectation that it would be used in criminal investigations. The distant relatives whose profiles produced the initial matches in the Golden State Killer case did not consent to law enforcement use of their DNA. They uploaded their data to find relatives and learn about their ancestry. Their profiles were used, without their knowledge, to build a family tree that eventually pointed toward a suspect in a murder investigation.
These individuals were not harmed in any direct sense by this use of their data. They were not suspects. They were not named publicly. Their profiles were used as starting points for genealogical research, and the investigative result was the arrest of a man who had killed thirteen people and committed dozens of additional crimes. From the perspective of the investigation’s outcome, it is difficult to argue that the use of their data caused them harm.
From the perspective of privacy and consent, the use of data submitted to a genealogy site for an investigative purpose those users did not know about or agree to is a different matter. It means that anyone who has uploaded their DNA to a consumer genealogy database has potentially made some of their family members searchable in connection with any unsolved crime where investigators have suitable biological evidence. The person who uploads their DNA does not, by doing so, become responsible for anything. But their genetic data becomes part of a search space that investigators can use, with or without their knowledge.