Both GEDmatch’s and FamilyTreeDNA’s terms of service outline their policies for law enforcement use. But for many users, solving crimes is not their main motivator for signing up for these sites. Plus, not everyone reads the terms of service, and companies can not only change them at any time but may even break their own terms.

That’s why David Gurney, who helped draft the terms of service for the DNA Justice Foundation, wanted to make sure that users fully understand what they’re signing up for—a database whose sole purpose is aiding law enforcement. The site isn’t a consumer genealogy tool, and users don’t have access to their own matches. Law enforcement agencies can use the database only to investigate certain crimes, including murder, nonnegligent manslaughter, rape and sexual assault, abduction, robbery, aggravated assault, terrorism, and imminent threats to public safety. (These are similar to GEDmatch and FamilyTreeDNA’s terms.) 

“I don't think anybody could agree to these terms of service and not understand what they're getting into,” says Gurney, an assistant professor of law and society and director of the Investigative Genetic Genealogy Center at Ramapo College in New Jersey.

Yet there are still risks in uploading your DNA data to any of these databases—even a nonprofit one. You or a family member could be swept into a criminal investigation just because you share a portion of DNA with a suspect. Genetic genealogists work with investigators to narrow down suspects based on factors like their presumed age and where they were living at the time of the crimes, but the leads they generate are just that: leads. And sometimes, leads are wrong. Before police arrested DeAngelo, they had identified another member of his family—who was innocent. 

And there are security concerns. In 2020, GEDmatch reported that hackers orchestrated a sophisticated attack on its database. The breach overrode the site’s privacy settings, meaning the profiles of users who did not opt in for law enforcement matching were temporarily available for that purpose.

Jennifer Lynch, surveillance litigation director for the Electronic Frontier Foundation, a San Francisco-based digital rights group, doesn’t think a nonprofit DNA database is a panacea for these issues. “It doesn...