Fourth Amendment Meets 23andMe (and other Genetic Genealogy sites)

 Is your DNA safe in the hands of 23andMe?

Is your DNA safe in the hands of 23andMe?

If you have been exposed to advertisements in any form over the last year you likely have heard of the company 23andMe. 23andMe collects individuals’ DNA for testing in order to provide genealogy and genetic health information. In light of their success, most ancestry companies now provide similar services (including Ancestry.com, MyHeritage.com, and Family Tree DNA).

These companies now have large databases of DNA that can be used to fill in the holes in criminal DNA databases. Earlier this year, a famous serial killer and rapist was arrested after his identity was discovered through tracking his genealogy. A detective who had been working the case for over 20 years reached out to GEDmatch, a company founded to help amateur and professional genealogists. GEDmatch has a database of over 1 million profiles to search for possible family connections. The detective submitted DNA from the serial killer to GEDmatch and was able to identify several relatives of the killer. From there the detective was able to map out a family tree and determine possible suspects. If you are interested in exactly how this all played out, there was a 60 Minutes special. The focus of this post is the implications this has on individuals’ rights against unlawful searches.

As I’ve written about previously, the US Supreme Court recently ruled that law enforcement officials need a warrant before obtaining cell phone GPS data from third-party providers. In the case of genetic genealogy sites, the DNA is being given voluntarily by citizens who agree to the Terms of Service of those companies. 23andMe for example includes in their terms of service the following caveat: “[Y]ou acknowledge and agree that 23andMe is free to preserve and disclose any and all Personal Information to law enforcement agencies or others if required to do so by law or in the good faith belief that such preservation or disclosure is reasonably necessary . . . .” However, is that any different than cell phone GPS data? The data that cell phone providers collect from your cell phone is theoretically given voluntarily through a terms of service agreement.

Do law enforcement agencies need a search warrant to get your DNA evidence from a genealogy website? Without any cases on point currently, the answer to that question depends on the company’s policy. For example, Ancestry.com has reported that it provided a customer’s DNA sample to police in 2014, in compliance with a search warrant. On the other hand, 23andMe has a transparency report that indicates it has not turned over any of its users data despite receiving five such requests from law enforcement. Moreover, 23andMe has gone as far as stating “we use all practical legal and administrative resources to resist such requests.”

Ultimately, the decision to turn over DNA samples to law enforcement officials is one that each company will decide for themselves. Some companies will fight requests, even those supported by search warrants, subpoenas, or court orders, and others may be willing to turn the information over with little more than a formal request. For that reason, it is important to read the “terms of service.”

If the Supreme Court is ever asked to weigh in on the constitutionality of this issue, it likely would not require a search warrant. Although acquiring someone’s DNA is most definitely an issue of privacy, the DNA is provided freely and voluntarily. Furthermore, unlike a cell phone, a genealogy test has not yet become the “pervasive and insistent part of daily life” that the Supreme Court described when analyzing this issue US v. Carpenter.