Police can use Ancestry DNA data, but only through valid legal process: AncestryDNA requires at minimum a court order or search warrant before it will consider releasing a customer’s genetic information, and the company says it does not hand over DNA voluntarily. That is the rule for Ancestry specifically. The broader picture is more complicated, because the legal protections that apply to your genetic data depend heavily on which consumer service holds it, which state you live in, and whether a relative of yours has tested with a service that allows law enforcement matching.
What Ancestry Requires Before Releasing Your Data
AncestryDNA’s stated policy is that law enforcement must present valid legal process before the company will disclose customer information, and genetic data specifically requires a court order or search warrant. A search warrant means a judge has found probable cause that a crime occurred and that the company’s records hold relevant evidence.1Cornell Journal of Law and Public Policy. Do Not Access – Is Law Enforcement Access to Commercial DNA Databases a Substantial Privacy Concern
Ancestry’s most recent transparency report, covering the second half of 2025, shows the company received zero valid law enforcement requests for genetic data during that period. It did receive nine criminal subpoenas seeking non-genetic customer information tied to fraud and identity theft investigations, and it complied with seven of those.2Ancestry. Law Enforcement – Ancestry Transparency Report So on the record, Ancestry’s DNA database is not a routine source of leads for investigators, and the company treats genetic data as more sensitive than account records.
That said, a policy is only as durable as the company standing behind it. Policies can change. Companies can be sold. And a warrant, if a judge signs one, will get police in the door.
How the Other Major DNA Services Compare
Anyone asking about Ancestry is usually asking about consumer DNA generally. The other major services handle law enforcement access differently, and the differences matter.
23andMe
23andMe historically required a warrant and publicly stated it had resisted every law enforcement request it received. That policy is currently in flux because of the company’s 2025 bankruptcy, covered in more detail below.
FamilyTreeDNA
FamilyTreeDNA operates on an opt-in model after backlash over an undisclosed FBI arrangement. By default, your DNA profile is not available for law enforcement comparison. To make your profile searchable by police through investigative genetic genealogy, you have to go into your account settings and turn that feature on yourself.
GEDmatch
GEDmatch is the outlier, and it is the site that made investigative genetic genealogy famous. It is a free, open-access platform where users upload raw DNA data from other testing companies. Because anyone can create an account and upload a profile, police have been able to search the database the same way any other user would, without a warrant.
After public attention forced a change, GEDmatch now defaults users to opted out of law enforcement matching for violent crime investigations. Users who want their profile searchable by police must affirmatively opt in. One important exception remains: even opted-out profiles will still be compared against DNA submitted by law enforcement to identify unidentified human remains. The current terms of service state this explicitly.3GEDmatch. Terms of Service GEDmatch is now owned by QIAGEN, which acquired the forensic genomics company Verogen in 2023.4DNA Doe Project. Message About the Recent Changes at GEDmatch
The 23andMe Bankruptcy and Your Data
23andMe’s 2025 bankruptcy created a real privacy problem for its more than 15 million users. The company entered bankruptcy proceedings looking for a buyer. Co-founder Anne Wojcicki stepped down as CEO and expressed interest in buying the company herself. 23andMe said data privacy would be an “important consideration” in any sale, but that language does not have much legal force.
Federal law offers thin protection for consumer genetic data. HIPAA covers healthcare providers and insurers, not direct-to-consumer testing companies. The Genetic Information Nondiscrimination Act stops employers and health insurers from using genetic data to discriminate, but it does not regulate what happens when a DNA company changes hands. A new owner has to follow applicable law, and in most states, there is not much applicable law to follow.
23andMe says customers can still delete their accounts and request destruction of their physical saliva samples. If you have a 23andMe account and are concerned, deleting it now is more protective than waiting to see who ends up owning the data. The process runs through your account settings; the company sends a confirmation email with a final deletion button, and the deletion is not complete until you click it. California’s attorney general issued a consumer alert specifically advising residents to consider exercising their deletion rights.
When a Warrant Is Actually Required
The legal analysis begins with the Fourth Amendment, which prohibits unreasonable searches. Under the third-party doctrine, information you voluntarily share with a company gets little Fourth Amendment protection, because you accepted the risk that the company might share it with the government. Courts have used this reasoning to allow warrantless police access to bank records, dialed phone numbers, and similar business records. On that logic, DNA uploaded to a public site like GEDmatch might not be protected either, because the user chose to share it.5Colorado Law Scholarly Commons. Genetic Privacy – Late to the Third Party
The Supreme Court narrowed that doctrine in 2018 in Carpenter v. United States, holding that people keep a legitimate expectation of privacy in at least some kinds of records held by third parties. The Court required a warrant based on probable cause for historical cell-site location data and emphasized the unique nature of the data itself rather than the mere fact of sharing.6Supreme Court of the United States. Carpenter v United States No court has squarely applied Carpenter to consumer DNA databases yet. Privacy advocates argue that genetic data is at least as sensitive as location data and should get the same protection.
For private databases like AncestryDNA and 23andMe, the practical answer today is that police need a court order or search warrant because that is what the companies require. The Fourth Amendment question matters more for open-access platforms and for anyone who might challenge a search in court.
The DOJ’s Interim Policy
The Department of Justice has an interim policy on when federal investigators may use forensic genetic genealogy. It is not a statute and does not bind state or local police, though many departments follow it voluntarily.7U.S. Department of Justice. Forensic Genetic Genealogical DNA Analysis and Searching
Under the policy, federal agents may consider genetic genealogy only for an unsolved violent crime or for suspected homicide victim remains. Before turning to a consumer database, the crime scene DNA profile has to have been uploaded to CODIS (the federal law enforcement DNA system) and produced no confirmed match, and investigators must have pursued reasonable leads that failed to identify the perpetrator. A prosecutor has to approve the search. Violent crime is defined broadly to cover homicide, sexual offenses, and other serious crimes presenting a substantial and ongoing threat to public safety.8U.S. Department of Justice. Forensic Genetic Genealogical DNA Analysis and Searching>
The policy is meant to make genetic genealogy a last resort at the federal level. Because it has no force of law, though, nothing stops a local police department from skipping every step.
State Laws
A growing number of states have passed laws that specifically govern police access to consumer DNA databases. These laws go further than the DOJ policy by making the rules legally enforceable. The strictest approach requires police to obtain a search warrant based on probable cause before accessing any consumer genetic database. At least one state extends the same protection to familial DNA searches and partial matching, so police cannot go looking for your relatives’ DNA without judicial authorization either.9Montana State Legislature. Montana Code Annotated 44-6-104 – Consumer DNA or Neurotechnology Database Searches
Other states require judicial authorization plus a sworn affidavit meeting specific criteria: the perpetrator’s identity must be unknown, the crime must be a serious violent offense, a standard DNA profile must already have been run through law enforcement databases without success, and reasonable investigative leads must have been pursued. Some states also require that any consumer database used in the search notifies users that law enforcement may use the platform and obtains their express consent.10Maryland General Assembly. Maryland Code Criminal Procedure 17-102
Several other states have broader genetic privacy laws that address law enforcement access as part of a larger consumer protection framework, typically requiring valid legal process. This area is evolving quickly. Checking your own state’s law is worth a few minutes.
You Can Be Identified Through a Relative
Even if you have never used Ancestry, 23andMe, or any other consumer DNA service, a distant relative’s participation can put you within reach of investigators. That is because the technique police use, investigative genetic genealogy, works from partial matches to distant cousins. A team of genealogists takes those partial matches and builds family trees using public records, working backward to a common ancestor and forward through descendants to a small group of people who could have left crime scene DNA.
A 2018 study estimated that roughly 60 percent of white Americans of European descent could already be identified through consumer genealogy databases based on relatives’ submissions alone. There is no setting that removes you from someone else’s family tree. This is the structural feature of consumer DNA testing that individual privacy choices cannot fully address: one person’s decision to share their genetic data is effectively a decision that touches every biological relative.
Steps to Limit Your Exposure
If you use a consumer DNA service, the practical protections are these.
- On AncestryDNA, your protection is the company’s warrant requirement. If you no longer use the service, deleting your account removes your profile from the database.
- On 23andMe, given the bankruptcy, consider deleting your account and requesting destruction of your saliva sample. The deletion is not final until you click the confirmation link the company emails you.
- On FamilyTreeDNA, law enforcement matching is off by default. Check your privacy settings to confirm it is still off if that is what you want.
- On GEDmatch, you have a separate opt-in choice for allowing your DNA to be searched in violent crime investigations. Even if you stay opted out, your profile remains searchable for identifying unidentified human remains under the current terms.3GEDmatch. Terms of Service
Deleting your account and genetic data does not always destroy the physical saliva sample stored by the lab that processed it. If complete removal matters to you, check whether your provider offers a separate option to request destruction of the biological specimen, and use it.
None of this fully closes the door. A relative’s account can still surface you in a family tree, and companies can change ownership or policy. But warrant requirements, careful privacy settings, and account deletion, taken together, are the levers available to you right now.