Analysis5 min read

How Forensic Genetic Genealogy Works, and the Rules Around It

July 17, 2026 · Updated October 5, 2026 · Cory

On April 24, 2018, investigators arrested Joseph James DeAngelo, a 72-year-old former police officer, at his home in Citrus Heights, California. His DNA was not in any police database. What investigators found instead were his distant relatives, people who had uploaded their own DNA results to a free genealogy website called GEDmatch. From those cousins, a genealogist built family trees until the branches pointed at one man. On June 29, 2020, DeAngelo pleaded guilty to 13 counts of first-degree murder and 13 counts of kidnapping.

The method is called forensic investigative genetic genealogy, often shortened to FIGG or IGG. This post covers how it works, which databases police are allowed to search, and the rules that were written after the DeAngelo arrest. A separate post on this site looks at the cases it has solved and the places it falls short.

Why the police database came up empty

Standard forensic DNA work compares 13 to 20 short tandem repeat markers, or STRs, between a crime scene sample and samples on file, according to the Justice Department. Those profiles go into the FBI's Combined DNA Index System, CODIS. As of June 2026 the national index held about 20.3 million offender profiles, 6.4 million arrestee profiles and 1.5 million crime scene profiles. A search produces a lead only when the person who left the DNA is already in it.

That was the wall in the Golden State Killer case. DNA linked the East Area Rapist and Original Night Stalker crimes in 2001, but the profile matched no one in CODIS. The offender behind 13 murders, more than 50 rapes and over 100 burglaries across California between 1974 and 1986 stayed unnamed for another 17 years.

A different kind of DNA profile

Genetic genealogy starts with a different test. A lab develops a SNP profile, short for single nucleotide polymorphism, from the crime scene sample. Consumer DNA tests read hundreds of thousands of these markers, far more than the STRs used in CODIS. That density is what lets software estimate how much DNA two people share, and so roughly how they are related.

Police cannot run that profile through 23andMe or AncestryDNA. 23andMe says it releases customer data only in response to a valid court order, subpoena or search warrant. What investigators can search are databases where people chose to upload their results and where the terms allow police use, chiefly GEDmatch and FamilyTreeDNA. Customers of the big testing companies can download their raw data and upload it there.

Building the family tree

The database returns a list of people who share DNA with the unknown profile, ranked by how much they share. In most forensic cases the best matches are distant: second, third or fourth cousins. A genealogist then builds each match's family tree backward through public records such as birth and death certificates, census sheets, marriage records and obituaries.

The goal is to find where several matches' trees meet at a common ancestral couple. From that couple, the genealogist works forward through every descendant and narrows the list by age, sex and where each person lived when the crime happened. What comes out is a lead, not an identification.

The confirmation is old-fashioned. Investigators collect DNA the person has left behind and run a standard STR comparison against the crime scene profile. In DeAngelo's case, samples came from his car door handle and from a tissue in his trash, and both matched. The match that goes to court is that STR comparison, not the family tree.

How far the method reaches

A 2018 study in Science led by Yaniv Erlich analyzed data from about 1.28 million people who had used consumer genetic tests. It estimated that about 60 percent of searches for Americans of European descent would turn up a third cousin or closer, enough in many cases to identify someone using a family tree plus age and location. The authors projected that a database covering about 2 percent of a population would put almost everyone in that population within reach.

That estimate was for one ancestry group. The method works only as well as the relatives who have uploaded, so its reach is not the same for every family or every community.

The rules came after the arrests

GEDmatch's own terms changed first. In May 2019, after police in Utah used the site in an assault case that fell outside the limits it had published, GEDmatch set every existing profile to opt out of law enforcement matching. Since then, police see only users who have chosen to opt in. A forensic genomics company, Verogen, bought GEDmatch in December 2019 and said users would keep that choice. Qiagen bought Verogen in January 2023.

The Justice Department issued an interim policy that took effect on November 1, 2019. It covers federal agencies and any agency using Justice Department money for genetic genealogy. Under it, the technique is for unsolved violent crimes, meaning homicides and sex crimes, and for identifying human remains, and only after a CODIS search has found no match and reasonable leads have been pursued. Investigators may use only services that tell their users that police may search them.

States followed in 2021. Maryland and Montana passed the first laws restricting police searches of consumer genealogy databases. Maryland requires a judge's approval before a search, limits it to murder, rape, other felony sexual offenses and serious threats to public safety, and requires that CODIS and other reasonable leads be tried first. Montana requires a warrant. Utah passed its own limits in 2023, restricting searches to violent felonies and missing or unidentified people and adding requirements for prosecutor approval and warrants.

The privacy question

The person a genetic genealogy search identifies usually never uploaded anything. Their cousins did. That is the core of the privacy debate. One person's decision to share a DNA file can expose dozens of relatives who never agreed to it, including people who become suspects and turn out to have nothing to do with the crime.

Courts have not settled how the Fourth Amendment applies. Prosecutors point to the third-party doctrine, the Supreme Court rule that people generally have no reasonable expectation of privacy in information they voluntarily hand to someone else. The Court has not ruled on genealogy databases, and in its 2018 Carpenter decision it declined to stretch that doctrine to cover cell phone location records.

Ownership matters too. 23andMe filed for bankruptcy in March 2025, and in June 2025 a court approved its sale for $305 million to TTAM Research Institute, a nonprofit formed by co-founder Anne Wojcicki. The buyer is obligated to honor 23andMe's existing privacy policies and user consents. The genetic data of millions of customers changed hands in a court-supervised sale.

Here is the short version of what happens when a police department announces that genetic genealogy found its suspect. A SNP profile was compared against people who opted in to police matching. A genealogist built family trees from public records. Then a conventional DNA test on something the suspect threw away did the confirming. Whether that trade between solved cases and family privacy is worth it is a question the law is still answering.

Sources

Found an error? Tell us. Corrections are dated and listed on the corrections page.

All Posts

Analysis7 min read

Genetic Genealogy Cases: What It Has Solved and What It Cannot Do

January 20, 2025

From Angie Dodge to the Boy in the Box: cases genetic genealogy solved, the wrong turns along the way, and the limits courts and families still face.

Analysis6 min read

How digital forensics changed modern investigations

October 9, 2026

Digital evidence went from a niche hobby in the 1980s to a cornerstone of modern criminal investigations.