The argument against, stated at its strongest, is that the people who uploaded their DNA to GEDmatch did not consent to law enforcement use, and that their lack of explicit objection cannot be construed as consent to a use they were not told about. Their genetic data represents not only their own genetic information but also partial genetic information about all of their relatives — relatives who may never have used any genetic testing service and whose privacy interests are implicated by others’ decisions to upload. The use of their data, without their knowledge, sets a precedent for the proposition that consumer genetic databases are effectively available to law enforcement investigation regardless of users’ intentions or expectations.
The proportionality question — whether the value of solving violent crimes justifies the privacy implications — is one on which reasonable people have taken different positions. The Department of Justice guidelines of 2019, which restricted the method to violent crimes and cases involving unidentified remains, reflected a position that the method’s use should be limited to cases where the stakes are high enough to justify the privacy implications. Whether that line is drawn in the right place, and whether the guidelines are adequate to address the full scope of the privacy implications, has been debated.
Some have argued that the consent problem is more fundamental than the violent-crimes restriction addresses: that even for violent crimes, the use of genetic data submitted to a genealogy database for unrelated purposes, without the knowledge of the people whose data is used, is a form of appropriation that requires explicit authorization from those people or their representatives. Others have argued that the law enforcement use of publicly accessible databases — ones that any member of the public with a DNA file can access — does not implicate the same privacy interests as the use of sealed records or private communications.