This has implications for family members who have not themselves uploaded to any database. If a first cousin uploads their DNA to GEDmatch, that upload represents a partial genetic record of every one of that cousin’s relatives — including relatives who have chosen not to use any genetic testing service. The choice to upload is individual, but the genetic information it represents is shared across a biological family.
The U.S. Department of Justice issued interim guidelines in September 2019 that described a framework for investigative genetic genealogy at the federal level. The guidelines restricted the use of the method to cases involving violent crimes or the identification of human remains. They required investigators to exhaust other investigative approaches before using genealogy databases. They required investigators to identify themselves to the database before uploading profiles. And they prohibited using genealogy database profiles to search for genetic disease risk or psychological characteristics.
These guidelines applied to federal and federally funded investigations. Most state and local investigations are not federally funded in the relevant sense, and the guidelines did not establish binding rules for state and local law enforcement agencies. States have since moved at different speeds to develop their own frameworks. As of the time of this writing, the legal and regulatory landscape for investigative genetic genealogy varies by jurisdiction, and no uniform national standard applies.
The Golden State Killer case is, in this respect, more consequential as a legal and policy episode than as a technical one. The technique itself — uploading crime-scene DNA to a genealogy database and using the results for family tree research — is relatively straightforward. The questions it raises about consent, privacy, the appropriate scope of investigative access to consumer data, and the responsibilities of genealogy databases toward their users are considerably more complex and are still being worked out.