I. Introduction

For over three decades, the rape and murder of seventeen-year-old Tanya Van Cuylenborg and murder of twenty-year-old Jay Cook remained unsolved until a genealogy website led investigators to a suspect in 2017.[1] The young couple planned to take an overnight trip to Seattle but never returned home as planned.[2] After four days of searching for the couple, investigators found the body of Van Cuylenborg, who had been raped and shot.[3] Two days later, investigators found Cook’s body almost seventy-five miles away from where investigators discovered Van Cuylenborg’s body.[4] Although the initial investigation proved fruitless, forensic scientists created a genetic profile of the killer based on a semen sample obtained at the crime scene.[5] Police uploaded the profile to the FBI’s Combined DNA Index System (CODIS), but the case remained cold.[6] However, in 2018, a forensic lab inputted the DNA sample into GEDMatch, a public ancestry bank, which led investigators to a single suspect.[7] The match was fifty-six-year-old William Earl Talbott II.[8] Although Talbott had not uploaded his genetic information to any genealogy site, two of his second cousins had done so.[9] Investigators obtained Talbott’s DNA from a discarded coffee cup and confirmed that he was a match for the semen found at the crime scene.[10] In 2019, Talbott was convicted of two counts of aggravated murder and sentenced to life in prison without parole.[11]

While some in society rejoice over the convictions of dangerous criminals that threaten public safety, privacy proponents are apprehensive about police using DNA databases obtained through DTC companies.[12] Tens of millions of Americans have uploaded their genetic information to at least one of the leading ancestry databases.[13] Those who upload their genetic information to a DNA database are not only revealing personal, intimate information about themselves but also about their relatives who did not consent to the submission.[14]

DTC genetic testing companies operate under a fragmented regulatory scheme.[15] Even without regulation, law enforcement officials must still abide by the protections of the Fourth Amendment.[16] However, the third-party doctrine provides that individuals are not entitled to expect privacy for information that they voluntarily disclose to third parties.[17]

This Note examines the potential impact of the third-party doctrine on DTC genetic testing. The applicability of the third-party doctrine to DTC genetic testing has yet to be addressed by the Court. This topic is further complicated by the fact that individuals can be identified through familial linkage.[18] Part II of this Note discusses the history of DNA profiling and the recent use of genetic testing in criminal prosecution by law enforcement officials. Part III discusses the historical background of the Fourth Amendment and the emergence of the notion of a reasonable expectation of privacy and the third-party doctrine. Part IV provides the current state of the third-party doctrine as modified by Carpenter and how it might be applied to private DTC genetic testing. Part V explores the possibility of intervention by the Judiciary and the placement of statutory limitations on the third-party doctrine in the context of private DTC genetic testing.

II. Background of DNA Profiling and Genetic Testing

A. DNA Profiling History

The first genetic fingerprint was discovered in 1984 by Professor Sir Alec Jeffreys.[19] While researching familial hereditary diseases, Jeffreys discovered that “repetitive patterns of DNA . . . were present in all human beings but . . . varied in length for each individual.”[20] Jeffreys identified these patterns of DNA, known as Variable Number of Tandem Repeats (VNTRs), using a technique called Restriction Fragment Length Polymorphism (RFLP).[21] Jeffreys coined the term “genetic fingerprint” once he determined that these variations in length could be used to identify specific individuals.[22]

DNA testing and genetic fingerprinting were first introduced into the law enforcement world when Jeffreys helped police identify Colin Pitchfork, a Leicestershire baker, who was responsible for the rape and murder of two teenage girls.[23] Jeffreys used RFLP-based DNA technology to help confirm that Pitchfork’s DNA was a perfect match for the DNA left at both crime scenes.[24] Pitchfork was the first person to be identified and convicted of a criminal offense through the use of DNA evidence.[25] Since then, DNA evidence has become an increasingly effective “tool for solving both violent crimes and property crimes, such as homicide, sexual assault, and burglaries.”[26] DNA evidence has even crept into the commercial realm, in the form of DTC genetic testing.[27]

B. The Rise of Direct-to-Consumer (DTC) Genetic Testing

The rising demand for genetic testing kits is dominated by North America.[28] Consumers purchase DTC genetic testing kits “to make predictions about health, provide information about common traits, and offer clues about a person’s ancestry.”[29] In the United States alone, the genetic testing market was valued at $41.2 billion as of 2018.[30] However, due to increasing privacy concerns and market saturation, well-known sites like Ancestry and 23andMe experienced a lull in sales in 2019.[31] Despite the dip in 2019 sales, the demand for DTC kits is expected to increase by 24% between 2020 and 2025 due to an increase in paternity testing, hereditary diseases, and interested consumers and physicians.[32]

Those who value privacy and choose not to partake in DTC genetic testing might be out of luck. As Erin Murphy, a professor at New York University School of Law, explains, “If 3 million people of European descent offer their genetic information to a database, [there is] essentially a universal genetic database for the American population of European descent.”[33] In addition, even if customers of DTC genetic testing kits opt out of sharing their information with any third parties, there is a very low chance that the customer will know about any breach of personal information.[34]

C. The Use of DTC Genetic Testing by Law Enforcement

Traditionally, DNA profiling was implemented by matching the DNA of suspects to the DNA collected at crime scenes through CODIS.[35] However, police and FBI officials are now using non-CODIS systems, such as GEDMatch, to track down suspects.[36] In 2019, GEDMatch was sold to Verogen, “a company that aids law enforcement agencies with forensic DNA work.”[37] Verogen has not explicitly stated whether law enforcement pays for its forensic services. However, non-CODIS systems have proven successful, such as in the case of the “Golden State Killer.”[38]

The infamous Golden State Killer was apprehended using a public ancestry database in April 2018.[39] After decades of investigating to no avail, law enforcement identified Joseph DeAngelo as the suspected Golden State Killer.[40] DeAngelo was suspected of committing at least twelve murders and around fifty rapes.[41] His actions terrorized California throughout the late 1970s and 1980s, though his true identity was not discovered for almost 40 years.[42] Investigators used DNA evidence from the crime scenes and uploaded the information to a genealogical website.[43] From there, police were able to narrow down the list of suspects using family trees, which ultimately led to DeAngelo.[44] Authorities confirmed the match by using a DNA swab of DeAngelo’s car door handle.[45] DeAngelo pled guilty to twenty-six charges, and, in lieu of the death penalty, he now faces life in prison without parole.[46]

As of May 2019, more than sixty cold cases have been solved using genetic genealogy.[47] In 2017, this process became even more expedient through the passing of the Rapid DNA Act.[48] The Rapid DNA Act enables law enforcement to use Rapid DNA Analysis to fully develop a genetic profile from a saliva sample in around ninety minutes.[49]

D. Lack of Regulation

Although some DTC companies promise to resist turning DNA information over to law enforcement officials,[50] this promise falls flat in the absence of clear statutory protections.[51] The regulatory gap surrounding DTC genetic testing demonstrates that “there is no legal guarantee that this information will remain private.”[52] In addition, “DTC companies are not . . . subject to the health privacy regulations issued pursuant to the Health Insurance Portability and Accountability Act (HIPAA).”[53] Consumers may believe that any warrantless use of their genetic information by law enforcement is protected by the Fourth Amendment. However, there is an exception to the Fourth Amendment’s prohibition of unreasonable searches and seizures, known as the third-party doctrine.[54] The third-party doctrine states that there is no reasonable expectation of privacy in the information voluntarily given to third parties, such as DTC companies.[55] This doctrine will be further discussed in Section III.A.3.

III. The Fourth Amendment and Third-Party Doctrine

A. The Fourth Amendment, Reasonable Expectation of Privacy, and Third-Party Doctrine

1. Fourth Amendment

The Fourth Amendment of the U.S. Constitution establishes the fundamental right of the people[56] to be free “against unreasonable searches and seizures.”[57] The Framers of the Constitution implemented the Fourth Amendment in response to the British Government’s use of general warrants.[58] General warrants allowed authorities to conduct searches without probable cause.[59] This unfettered discretion was often used “to go after political enemies.”[60] Warrantless searches are a per se violation of the Fourth Amendment reasonableness standard, subject to a few exceptions.[61] If there is an applicable exception to the warrant requirement, the search must still be reasonable in methodology and scope.[62] The goal of the Fourth Amendment is to strike a balance between individual privacy rights and legitimate government interests, such as public safety.[63] To determine whether a search is reasonable, the Court will balance the “totality of the circumstances.”[64] The totality of the circumstances approach “compels a review of each and every fact available to the officer, whether inculpatory, exculpatory, or neutral.”[65]

2. Reasonable Expectation of Privacy

Traditionally, the Fourth Amendment was based on property rights, not privacy rights.[66] However, in the 1960s, the Supreme Court in Katz v. United States held that the Fourth Amendment “protects people, not places.”[67] If a person knowingly exposes something to the public, that exposure does not fall within the protection of the Fourth Amendment.[68] However, what a person “seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected.”[69] Justice Harlan established a twofold test.[70] In order for the Fourth Amendment to protect a person, he or she must have a subjective expectation of privacy and that expectation must be recognized as “reasonable” by society.[71] Thus, the notion of a reasonable expectation of privacy was born.[72] Following Katz, “anything a person expose[d] to the public” was unprotected.[73] This lack of protection triggered the emergence of the third-party doctrine.[74]

3. Third-Party Doctrine

The third-party doctrine emerged over forty years ago in United States v. Miller.[75] Under the third-party doctrine, “a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties.”[76] In Smith v. Maryland, the police placed a warrantless “pen register” at the offices of the local telephone company.[77] The Court ruled that “[a]ll telephone users realize that they must ‘convey’ phone numbers to the telephone company.”[78] Therefore, it is unreasonable for telephone subscribers to harbor any general expectation of privacy in the numbers that they dial.[79]

More recently, in 2012, the Court examined the impact that new technology has on the Fourth Amendment.[80] In United States v. Jones, government agents placed a warrantless GPS tracking device on Jones’s car.[81] Under the Fourth Amendment, a vehicle qualifies as an “effect.”[82] Thus, the placement of the GPS on Jones’s car qualified as a “search.”[83] Historically, Fourth Amendment jurisprudence was rooted in property rights.[84] However, in Katz, the Court deviated from the property rights approach and concluded that “the Fourth Amendment protects people, [and] not places.”[85] The Court in Jones held that the placement of the vehicle GPS constituted a search under the Fourth Amendment[86] by relying on both the property-based approach and the reasonable expectation of privacy notion articulated in Katz.[87]

IV. Analyzing the Third-Party Doctrine Under Carpenter

A. Third-Party Doctrine as Modified by Carpenter

In the 2018 case of Carpenter v. United States, the Supreme Court held that “an individual maintains a legitimate expectation of privacy in the record of his physical movements as captured through” cell-site location information (CSLI).[88] In Carpenter, federal magistrate judges issued orders directing Carpenter’s cell phone carriers to release his CSLI.[89] The CSLI records disclosed 12,898 locations over the span of 127 days.[90] This record cataloged his movements an average of 101 times per day.[91] The Supreme Court in Carpenter concluded that this warrantless acquisition of CSLI violated the Fourth Amendment.[92]

Writing for the Court, Chief Justice Roberts emphasized that this case was not just about a person’s physical location at a moment in time but about a detailed chronicle of a person’s location compiled “every moment of every day” for years.[93] He also stated that telephone companies keep records of their users’ locations information for up to five years.[94] Carrying a phone is indispensable in modern society, and cell phone logs are created without almost any affirmative action on behalf of the owner.[95] The only affirmative act is powering the phone on.[96] Thus, “there is no way to avoid leaving behind a trail of location data” other than disconnecting the phone from its network.[97]

In Carpenter, the Supreme Court drastically modified its original stance, as seen in Miller, that a person who voluntarily conveys information to a third party has no reasonable expectation of privacy.[98] CSLI is a “qualitatively different category” of information than that contemplated in early third-party doctrine jurisprudence.[99] Chief Justice Roberts was also very careful to note that the Carpenter decision was narrow in scope and did not “call into question conventional surveillance techniques and tools, such as security cameras.”[100] The opinion of the Court also “does not consider other collection techniques involving foreign affairs or national security.”[101]

Therefore, Carpenter leaves open a wide range of possibilities for how the Court will address Fourth Amendment concerns in the context of private DTC genetic testing kits, such as Ancestry and 23andMe. The Court may choose to extend the third-party doctrine to DTC genetic testing, thus making genetic information available for law enforcement investigations. The Court may choose to abolish the third-party doctrine solely in the DTC genetic testing context, or it may do away with the third-party doctrine altogether in every context. The Carpenter decision also leaves open room for the Legislature to regulate DTC companies.

Is genetic testing a “qualitatively different category”[102] like the CSLI information described by Chief Justice Roberts? In his dissenting opinion, Justice Gorsuch specifically questions whether the government can demand “your DNA from 23andMe without a warrant or probable cause.”[103] He notes that the petitioner in Carpenter only invoked the reasonable expectation of privacy test from Katz and failed to make an argument rooted in property law.[104] Justice Gorsuch’s dissent signals that property law may be a more protective avenue to securing the privacy of data such as DTC genetic testing.[105]

B. Modified Third-Party Doctrine as Applied to DTC Genetic Testing

Due to the lack of statutory regulation and legislative action surrounding DTC genetic testing, and the limited amount of caselaw on the matter, it is likely that the Judiciary will have to determine whether genetic information given to DTC companies is entitled to protection under the Fourth Amendment.

1. Whose Privacy Interests Are at Stake?

There are three categories of people whose privacy interests are potentially at risk in a database search: the specific “Informant” whose DNA is in the system and partially matches the DNA gathered at the crime scene; the “Targets” who are relatives of the Informant; and the “Collective” which is the entire family unit of the Informant.[106] These three categories are subject to law enforcement investigation because genetic information is not discrete information possessed by a single individual, it is immutably shared.[107] This analysis will not only focus on the Informant but also on those who share genetic information with the Informant. Although the Informant is the individual who voluntarily gave their information over to the DTC company,[108] the genetic information of others is implicated through familial linkage.[109] This disclosure of information potentially triggers the third-party doctrine for the Informant and their family, effectively limiting Fourth Amendment protection.

2. Informant’s “Assumption of the Risk”

Under Smith and Miller, law enforcement will likely argue that the third-party doctrine is applicable because the Informant voluntarily “assumed the risk” by sending their saliva sample to the third-party DTC company. However, the scope of the risk voluntarily assumed by the Informant is a thornier issue. In the words of Justice Marshall, “Privacy is not a discrete commodity, possessed absolutely or not at all.”[110] On one hand, the Informant has waived any expectation of privacy because their genetic information is now available to the DTC company and laboratories responsible for analyzing the sample.[111] On the other hand, when an Informant purchases a DTC genetic testing kit, the DTC provider advertises a high level of confidentiality.[112] For example, the privacy page on the 23andMe website states that it “will not sell, lease, or rent your individual-level information to a third party for research purposes without your explicit consent.”[113] The key phrase here is “individual-level” information. According to the site, the company only shares “aggregate information.”[114] While the sharing of “anonymous” aggregate information may sound secure, “genetic data is intrinsically identifying.”[115]

A 2018 research study revealed that “it is possible to match 60 percent of Americans of European descent to a third cousin or closer relation through a familial search of DNA databases.”[116] By 2019, the DNA of over 26 million people had been added to one of the four leading ancestry databases.[117] Therefore, it can be inferred that “familial searching technology and investigative techniques will eventually reach a point where investigators can identify the anonymous DNA of almost any person, even if that person’s DNA is not in any public, private, government, or commercial database.”[118]

When purchasing a DTC genetic testing kit, the Informant consents to the terms and conditions on the site.[119] However, terms and conditions regarding law enforcement are buried in pages of fine print listed in the company’s terms of service.[120] According to a recent study, two law professors found that 99% of the terms and conditions of 500 popular websites in the United States were “unreadable” and “far exceed[ed] the level most American adults read at.”[121] Despite their “unreadability,” these terms and privacy policies explicitly state that the DTC provider will submit genetic and personal information to law enforcement “if required to do so by law.”[122] Therefore, given the lack of transparency and the complexity and volume of text that the Informant “consents to” in the terms of service, there is arguably no voluntary assumption of the risk that the user’s information will be handed over to law enforcement.

In Carpenter, the Court held that there was no voluntary assumption of the risk for law enforcement retrieval of a customer’s CSLI.[123] The Court noted that cell phones are indispensable in modern society and the only affirmative action taken by the user is turning the phone on.[124] In the context of DTC genetic testing, genetic testing is not an “indispensable” part of society. If someone needs genetic testing for a medical purpose, it can be conducted by a healthcare provider.[125] In addition, there is an affirmative action on behalf of the DTC user because that individual specifically orders the DTC genetic testing kit, pays a minimum of ninety-nine dollars,[126] and then willingly sends back the DNA sample for testing. Thus, it is likely that the Informant has voluntarily assumed the risk that their DNA may fall into the hands of law enforcement.

3. Reach of DTC Databases

Although voluntary assumption of the risk alone may be enough to uphold the third-party doctrine, the Carpenter Court considered several other key components in its decision that are worth examining. But the bare fact of “diminished privacy interests” does not eliminate the Fourth Amendment from consideration.[127] Although Informants have a diminished expectation of privacy when they hand over their DNA, it is not completely diminished. The Informant is trusting a private party that they have paid to perform a service and produce results.

Another main factor that played into the Court’s decision in Carpenter was the extensive depth and comprehensiveness of the CSLI tracking.[128] The acquisition of the CSLI detailed the defendant’s every movement for 127 days and remained in the company’s records for up to five years.[129] Chief Justice Roberts further noted that the CSLI records “are not your typical witnesses,” and they have nearly infallible memories.[130] Therefore, the Court reasoned that this high level of detail and comprehensive nature of the defendant’s movements was “deeply revealing.”[131] Both factors contributed to the Court’s holding that the CSLI retrieval was a “search” deserving of Fourth Amendment protection.[132]

Similar to the CSLI records in Carpenter, DTC providers collect, retain, and sell the genetic information that they compile.[133] The storage of this information is potentially infinite because it is not only kept by the provider but also kept and used by any entity it is sold to.[134] This is similar to Carpenter because, like the CSLI records, DTC genetic databases are not a typical witness whose memory can fade over time.[135] The human genome is the “most intimate data we can provide about ourselves.”[136] DTC genetic databases are not only comprehensive in scope when applied to an individual but they also “implicate the genetic material of a comprehensive net of individuals beyond those consumers whose profiles are explicitly within the database.”[137] It is estimated that a genetic database only needs “2% of the target population to provide a third-cousin match to nearly any person.”[138]

According to a recent survey, 91% of 1,587 respondents answered that it is acceptable to use forensic genealogy to solve violent crimes.[139] Some companies have even shown support and willingness to use their databases to aid law enforcement in the identification of those who commit violent crimes.[140] At first glance, this rationale may sound positive. There is a strong and compelling public interest for the protection against those who commit serious, violent crimes.[141] However, this is a slippery slope that may lead to law enforcement accessing this information for much less serious, petty offenses.[142] Currently, the use of genetic testing is at the sole discretion of law enforcement.[143] Without regulatory restrictions, there is nothing stopping law enforcement from using genetic databases in less serious criminal cases. Therefore, it is possible that, due to the lack of regulation, law enforcement may be able to “find suspects in any crime where a DNA sample was left behind.”[144] With tens of millions of DNA samples already collected in DTC databases,[145] those who are not under any suspicion may find themselves the subject of a criminal investigation through familial linkage. For example, defendants like Joseph DeAngelo and William Earl Talbott II were not on law enforcement’s radar until the DNA of their relatives linked the two men to the DNA profiles stored in the CODIS system.[146] The depth and comprehensive reach of DTC genetic testing weigh against the applicability of the third-party doctrine.

4. Genetic Information Is Owned by Informant, Not DTC Provider

Informants will likely contend that they have absolute ownership in the genetic information given to the DTC provider,[147] therefore, the provider has no proprietary interest in the genetic information that is obtained. Because the information solely belongs to the Informant, it is not voluntarily given to the third-party DTC provider. The Fourth Amendment provides that an individual has the right “to be secure in their persons.”[148] When consumers provide their DNA to the DTC company, the company has a contract to license the customer’s data to biotech giants.[149] This consent to license does not protect the genetic information that belongs to the relatives of the Informant.[150] Previous caselaw supports the notion that the license granted to the DTC provider does not qualify as a transfer of ownership of the data.[151]

Some scholars argue that DNA is comparable to tenancy by the entirety because “identifiable genetic information is involuntarily and immutably shared with close genetic relatives.”[152] It is not possible to break genetic connections between people, and there is also nothing to separate someone from their genetic information once that information is compromised.[153] Genetic information is also shared with family members.[154] For example, a traditional fingerprint that is in the CODIS system only pertains to the specific individual to whom the fingerprint belongs, thus giving it “limited identification value.”[155] In comparison, genetic information belongs to all relatives who share it, and it is difficult to determine where the line is drawn between genetic variations.[156] Therefore, DNA can be viewed as an undivided interest in a whole asset. Due to the invasive depth, comprehensive and retroactive nature, and complexity of ownership of genetic information, the third-party doctrine should be inapplicable to DTC genetic testing.

V. Judiciary and Legislative Intervention

A. The Judiciary

The role of the Judiciary is to protect the privacy interests of the people.[157] Before his death in 2016,[158] Justice Scalia joined the liberal dissent in Maryland v. King and cast doubt that “the proud men who wrote the charter of our liberties would have been so eager to open their mouths for royal inspection.”[159] Justice Scalia compared the taking of DNA samples to a “genetic panopticon.”[160] He argued that this decision created invisible watchmen on the American people,[161] which raises the question: who is watching the watchmen?

The Judiciary should protect those who cannot protect themselves. Privacy agreements issued by DTC companies are virtually unreadable and beyond the comprehension of the vast majority of consumers.[162] If the Court rules that the third-party doctrine does not extend to genetic information obtained via DTC genetic testing, then law enforcement cannot obtain DNA profiles for Informants who submitted their saliva samples or the DNA profiles of their relatives without proper cause or documentation.[163] Consumers and their family members can rest easy knowing that their DNA is not at the mercy of the police or the FBI without the issuance of a warrant. In contrast, if the Court rules that the third-party doctrine does extend to DTC genetic testing, it must specify whether the doctrine applies to the relatives of DTC consumers, the direct consumers, or both. This decision could severely hinder the ability of law enforcement to generate new leads on cold cases.[164]

Another viable solution is for the Supreme Court to eliminate the third-party doctrine in all contexts, not just those limited to DTC genetic testing. In Carpenter, Justice Gorsuch voiced concern that the third-party doctrine may be ill-suited for modern society.[165] Due to technological advancements, a great deal of our information is accessible to third parties.[166] Credit card records, home security systems, and cloud documents contain private information that is at the mercy of third parties.[167] The scope and depth of this information were not contemplated by the Court when the third-party doctrine originated.[168] Allowing law enforcement officials to have access to any information in the hands of third parties is equivalent to general warrants,[169] which contradicts the intent of the Framers.[170] The third-party doctrine also infringes on First Amendment rights.[171] Not only are thoughts and political views susceptible to law enforcement on text messages and emails but knowledge consumed by individuals is also at the mercy of the third-party doctrine.[172]

However, the Judiciary is limited in its ability to protect consumers and their families until a party brings a constitutional claim in federal court.[173] The Supreme Court only hears approximately eighty cases out of 10,000 petitions each year,[174] and it can take years for the appeals process to reach the Supreme Court.[175] Therefore, it makes the most sense for the Legislature to craft regulations for DTC genetic testing and its use by law enforcement.

B. The Legislature

Currently, the regulation of familial matching occurs at the state and local level.[176] As Erin Murphy suggests, Americans should call their local legislators and voice their concerns surrounding the use of DTC genetic testing in criminal investigations.[177] It makes the most sense to put pressure on state and local governments because Americans have more contact with them than they do the federal government.[178] However, lawmakers across the nation have strong and conflicting views about the use of DTC genetic testing in criminal investigations.[179] Ann Marie Shubert, an independent district attorney in California, stated that “DNA is the greatest tool ever given to law enforcement to find the truth, whatever that is,” while others are pushing to restrict police from searching genetic databases.[180] For example, in 2020, State Representative Craig Hall of Utah proposed legislation to stop the “fishing expeditions” of DNA databases.[181]

Another potential solution is to limit how investigations and searches are conducted by law enforcement.[182] Legislators have many options when it comes to limiting searches of consumer DNA databases. Legislators could limit searches to a certain set of violent and extreme crimes, such as homicide and rape. There is also the option to restrict searches to situations that pose a high level of risk to public safety, as in the case of serial killers.[183] Legislators could require that searches only be conducted on Informants who submit their samples to DTC companies. This would reduce the impacts on relatives and limit the use of partial matches by law enforcement.[184] However, this solution is susceptible to abuse, because police could simply use partial matches and genetic mapping to home in on a suspect and then use other information to justify their suspicions after the fact. Lastly, legislators could create an advisory committee that assesses searches on a case-by-case basis to determine if the benefits of conducting the search outweigh the privacy interests of the individual. However, without bright-line rules guiding the committee, its decisions would also be susceptible to abuse and discrimination.

Federal regulation of consumer DNA database searches is appealing because it allows for uniformity across the states. Because DTC companies are third parties that are internet-based, they are “accessible to anyone anywhere in the country.”[185] Therefore, the push for uniform privacy protection across the nation is ideal. Once a federal standard is established, state and local governments can then create additional protections for their citizens if the states wish to do so.[186] These restrictions can apply in the context of limiting the scope of DNA database searches or requiring additional notice requirements of DTC providers to consumers. Heightened notice requirements may not protect the individual who voluntarily submits his or her information to DTC companies, but additional warning that genetic information is a shared interest[187] may cause consumers to think twice before signing over consent.[188]

VI. Conclusion

With the increasing lack of privacy in modern society, the Judiciary should step in and abolish the third-party doctrine in the context of DTC genetic databases by law enforcement officials. Consumers are quick to press “accept” without reading the fine print and appreciating the broad consequences of submitting their genetic information to DTC companies. Many consumers also lack the understanding that their submission can lead to the prosecution and conviction of their genetic relatives. Not only was the third-party doctrine not contemplated by the Framers, it is now obsolete due to technological advances that put almost all human activities at the mercy of third parties.

While the Judiciary has the potential to play a powerful role in the regulation of DTC genetic testing and DNA databases, the most effective way to combat this privacy problem is through state and local legislation. The Legislature does not have to wait to be petitioned through a judicial appeal process to address the issue. It can carefully sculpt how law enforcement uses genetic information and DNA databases in its investigative searches and subsequent criminal proceedings. The Legislature can carve out exceptions for violent crimes and those who pose a continuing and imminent threat to society while providing safeguards against unreasonable searches and seizures as intended by the Framers of the Constitution. When private information can no longer be protected by the individual, the government must step in and shield the people from intrusive and unconstitutional invasions of privacy.

Caroline Spiers

  1. Bryan Clark, A Public DNA Database Led to a Murder Conviction, but Innocent People May Pay the Price, Next Web (July 3, 2019, 8:09 PM), https://thenextweb.com/news/a-public-dna-database-led-to-a-murder-conviction-but-innocent-people-may-pay-the-price [https://perma.cc/2UHH-FGKZ].

  2. See id.

  3. Id.

  4. Id.

  5. Id.

  6. Id. CODIS is a system that uses technology and forensic science to link violent crimes. The system “enables federal, state, and local forensic laboratories to exchange and compare DNA profiles electronically.” Combined DNA Index System (CODIS), FBI, https://www.fbi.gov/services/laboratory/biometric-analysis/codis [https://perma.cc/R8TM-DG3C] (last visited Mar. 28, 2022). This system facilitates the linkage of crimes to other crimes and known offenders. Id.

  7. See Caleb Hutton, Life in Prison for 1987 Killer of Young Canadian Couple, HeraldNet (July 25, 2019, 5:22 AM), https://www.heraldnet.com/news/life-in-prison-for-1987-killer-of-young-canadian-couple/ [https://perma.cc/SV9D-Q9TZ].

  8. Clark, supra note 1.

  9. Id.

  10. Id.

  11. See Hutton, supra note 7.

  12. See Clark, supra note 1.

  13. See Matt Binder, More than 26 Million People Have Added Their DNA to Four Leading Ancestry Databases: Report, Mashable (Feb. 12, 2019), https://mashable.com/article/at-home-ancestry-test-boom/ [https://perma.cc/M6KY-TNXG].

  14. See Jocelyn Kaiser, We Will Find You: DNA Search Used to Nab Golden State Killer Can Home in on About 60% of White Americans, Science (Oct. 11, 2018), https://www.science.org/content/article/we-will-find-you-dna-search-used-nab-golden-state-killer-can-home-about-60-white [https://perma.cc/BQU7-EPT3].

  15. Kathy Hudson et al., ASHG Statement on Direct-to-Consumer Genetic Testing in the United States, 81 Am. J. Hum. Genetics 635, 635 (2007). While the FDA has the power “to regulate claims for products it regulates, the agency currently does not regulate most genetic tests and therefore does not regulate their claims.” Id. at 636.

  16. Trupiano v. United States, 334 U.S. 699, 705 (1948) (“[L]aw enforcement agents must secure and use search warrants wherever reasonably practicable.”).

  17. Richard M. Thompson II, Cong. Rsch. Serv., R43586, The Fourth Amendment Third-Party Doctrine 7 (2014).

  18. Familial DNA Searches, FindLaw, https://www.findlaw.com/criminal/criminal-rights/familial-dna-searches.html [https://perma.cc/3ZEM-J9HM] (Feb. 6, 2019).

  19. See The History of Genetic Fingerprinting, U. Leicester, https://le.ac.uk/dna-fingerprinting/history [https://perma.cc/6EK2-3RPU] (last visited Dec. 18, 2021).

  20. DNA Fingerprinting: The Discovery of DNA Fingerprinting, DNA Forensics [hereinafter DNA Fingerprinting], http://www.dnaforensics.com/DNAFingerprinting.aspx [https://perma.cc/SX7Z-6XAZ] (last visited Dec. 10, 2021).

  21. See id. The RFLP analysis technique examines the resulting fragments of DNA that are broken down by restriction enzymes. Once the fragments are separated by length, the resulting “pattern of fragment sizes will differ for each individual tested.” Theresa Phillips, RFLP and the DNA Analysis Applications, ThoughtCo, https://www.thoughtco.com/rflp-definition-and-dna-analysis-applications-375574 [https://perma.cc/DD5E-M8TP] (July 12, 2019).

  22. See DNA Fingerprinting, supra note 20. This discovery demonstrated that “a genetic fingerprint is specific to each individual and the pattern does not belong to any other person on earth except for identical twins.” Id.

  23. Id.

  24. See id. Not only did the RFLP-based DNA technology aid in the conviction of Colin Pitchfork, it also exonerated an innocent suspect, Richard Buckland. Id.

  25. See id.

  26. Forensic Sciences, Bureau Just. Stat., https://bjs.ojp.gov/topics/forensic-sciences[https://perma.cc/Z73S-VSQ4] (last visited Feb. 6, 2022).

  27. See Direct-to-Consumer Tests, FDA, https://www.fda.gov/medical-devices/in-vitro-diagnostics/direct-consumer-tests [https://perma.cc/9TTJ-P2AT] (Dec. 20, 2019).

  28. See Global DTC DNA Test Kits Industry Outlook, 2025 - Demand for Ancestry Testing Expected to Increase, GlobeNewswire, Aug. 14, 2020 [hereinafter Global DTC DNA Test Kits Industry Outlook], https://www.globenewswire.com/news-release/2020/08/14/2078465/0/en/Global-DTC-DNA-Test-Kits-Industry-Outlook-2025-Demand-for-Ancestry-Testing-Expected-to-Increase.html [https://perma.cc/8AK8-TBQY].

  29. See What Is Direct-to-Consumer Genetic Testing?, Medline Plus (Sept. 21, 2020), https://medlineplus.gov/genetics/understanding/dtcgenetictesting/directtoconsumer/ [https://perma.cc/DN2C-L6K5]. The commercial DTC kits examine a small number of the 20,000 genes in the body and predict the likelihood that an individual will develop conditions such as cancer, heart disease, and Alzheimer’s disease. Many of these genetic kits also identify “clusters of gene variations that are often inherited by a group of people with a common origin.” This allows customers the ability to track their ancestry. See Direct-to-Consumer Genetic Testing Kits, Harv. Health Publ’g (Sept. 1, 2010), https://www.health.harvard.edu/newsletter_article/direct-to-consumer-genetic-testing-kits [https://perma.cc/8JJ8-RLYS].

  30. See Rohit Bhisey, Genetic Testing Services Market: Surge in Adoption of Genetic Testing Services to Boost the Market, BioSpace (Sept. 1, 2020), https://www.biospace.com/article/genetic-testing-services-market-surge-in-adoption-of-genetic-testing-services-to-boost-the-market/ [https://perma.cc/7R5S-E2MB].

  31. See Has the Consumer DNA Test Boom Gone Bust?, Advisory Bd. (Feb. 20, 2020), https://www.advisory.com/daily-briefing/2020/02/20/dna-tests [https://perma.cc/8QSK-PTK6]. Ancestry sales as of November 2019 were down 38% from 2018. Similarly, 23andMe sales were down 54%. Id.

  32. See Global DTC DNA Test Kits Industry Outlook, supra note 28.

  33. See Privacy and DNA Tests, NPR (Nov. 9, 2019, 8:12 AM), https://www.npr.org/2019/11/09/777888000/privacy-and-dna-tests [https://perma.cc/KNB9-G6EN].

  34. See Maggie Fox, What You’re Giving Away with Those Home DNA Tests, NBC News, https://www.nbcnews.com/health/health-news/what-you-re-giving-away-those-home-dna-tests-n824776 [https://perma.cc/A7XN-4MQF] (Nov. 18, 2018, 5:16 AM).

  35. See Frequently Asked Questions on CODIS and NDIS, FBI, https://www.fbi.gov/services/laboratory/biometric-analysis/codis/codis-and-ndis-fact-sheet [https://perma.cc/7WZ8-CNZC] (last visited Dec. 12, 2021).

  36. See e.g., Sarah Zhang, Most People of European Ancestry Can Be Identified from a Relative’s DNA, Atlantic (Oct. 11, 2018), https://www.theatlantic.com/science/archive/2018/10/golden-state-killer-genealogy/572545/ [https://perma.cc/8BGF-DTNF].

  37. Adam Vaughan, DNA Site GEDMatch Sold to Firm Helping US Police Solve Crime, New Scientist (Dec. 10, 2019), https://www.newscientist.com/article/2226791-dna-site-gedmatch-sold-to-firm-helping-us-police-solve-crime/ [https://perma.cc/W8LR-QMLU].

  38. See Kaiser, supra note 14.

  39. Id.

  40. See Laurel Wamsley, After Arrest of Suspected Golden State Killer, Details of His Life Emerge, NPR (Apr. 26, 2018, 3:51 PM), https://www.npr.org/sections/thetwo-way/2018/04/26/606060349/after-arrest-of-suspected-golden-state-killer-details-of-his-life-emerge [https://perma.cc/SU27-DT56].

  41. See id.

  42. Id.

  43. See Cassie Dickman, Joseph James DeAngelo Pleads Guilty to 13 Murders Tagged to California’s 'Golden State Killer,’ USA Today, https://www.usatoday.com/story/news/nation/2020/06/29/alleged-golden-state-killer-joseph-deangelo-set-plead-guilty-monday-sacramento/3279438001/ [https://perma.cc/RK6P-K8SU] (June 29, 2020, 8:45 PM).

  44. See id.

  45. Id.

  46. Id.

  47. Gene Johnson, 52-Year-Old Seattle Murder Case Is the Oldest Ever to Be Solved Using Genealogy, Seattle Times, https://www.seattletimes.com/seattle-news/law-justice/dna-family-tree-help-solve-52-year-old-seattle-slaying/ [https://perma.cc/D73N-TMP4] (May 8, 2019, 6:14 PM). Steven Armentrout, the founder and CEO of Parabon, a DNA engineering company, predicts that this is just the beginning as Parabon continues to improve its search algorithms. See Kate Snow & Jon Schuppe, ‘This Is Just the Beginning’: Using DNA and Genealogy to Crack Years-Old Cold Cases, NBC News (July 18, 2018, 3:30 AM), https://www.nbcnews.com/news/us-news/just-beginning-using-dna-genealogy-crack-years-old-cold-cases-n892126 [https://perma.cc/EE2Z-G743].

  48. See Kelly Grooms, Rapid DNA Act of 2017: What Is It?, ISHI News (June 19, 2017), https://www.ishinews.com/rapid-dna-act-of-2017-what-is-it/ [https://perma.cc/NNG3-PWL2]. The Act was passed with unanimous consent. See id.

  49. Id.

  50. See, e.g., 23andMe Guide for Law Enforcement, 23andMe, https://www.23andme.com/law-enforcement-guide/ [https://perma.cc/RY3M-R7D5] (last visited Nov. 6, 2020). The site vows “to use all practical legal and administrative resources to resist requests from law enforcement.” Id. The site does not further elaborate on what the “legal and administrative resources” entail. Id.

  51. See George J. Annas & Sherman Elias, 23andMe and the FDA, 370 New Eng. J. Med. 985, 985–87 (2014).

  52. Justin Brookman, Direct-to-Consumer Genetic Testing: The Law Must Protect Consumers’ Genetic Privacy, Consumer Reps. (July 23, 2020), https://advocacy.consumerreports.org/research/direct-to-consumer-genetic-testing-the-law-must-protect-consumers-genetic-privacy/ [https://perma.cc/5Q6N-RN65].

  53. Hudson et al., supra note 15, at 636. Consumers are left “vulnerable to having their information used or disclosed in a manner that would be impermissible in the health care system.” Id.

  54. See Thompson, supra note 17, at 7.

  55. See id.

  56. Tracey Maclin, The Central Meaning of the Fourth Amendment, 35 Wm. & Mary L. Rev. 197, 230 (1993).

  57. U.S. Const. amend. IV. The Fourth Amendment states:

    The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

    Id.

  58. See Barry Friedman & Orin Kerr, Common Interpretation: The Fourth Amendment, Nat’l Const. Ctr., https://constitutioncenter.org/interactive-constitution/interpretation/amendment-iv/interps/121 [https://perma.cc/VK94-6MKT] (last visited Dec. 18, 2021).

  59. Id.

  60. Id.

  61. See Katz v. United States, 389 U.S. 347, 357 (1967).

  62. See id. at 358–59.

  63. See Fred Cate & Beth Cate, The Supreme Court and Information Privacy, 2 Int’l Data Priv. L. 255, 258 (2012).

  64. Samson v. California, 547 U.S. 843, 848 (2006) (quoting United States v. Knights, 534 U.S. 112, 118 (2001)). The totality of the circumstances approach requires consideration and balancing of “the whole picture.” United States v. Cortez, 449 U.S. 411, 417–18 (1981).

  65. Ryan P. Sullivan, Revitalizing Fourth Amendment Protections: A True Totality of the Circumstances Test in § 1983 Probable Cause Determinations, 105 Iowa L. Rev. 687, 706 (2020).

  66. Warden v. Hayden, 387 U.S. 294, 303 (1967); see also Katz, 389 U.S. at 352–53 (“It is true that the absence of such penetration was at one time thought to foreclose further Fourth Amendment inquiry . . . for that Amendment was thought to limit only searches and seizures of tangible property.”).

  67. Katz, 389 U.S. at 351–52.

  68. See id.

  69. Id.

  70. Id. at 361 (Harlan, J., concurring).

  71. Id. Justice Harlan further elaborated by stating that a man has no expectation of privacy in “objects, activities, or statements that he exposes to the ‘plain view’ of outsiders” because they are not intended to be kept to himself. Id.; see also Mancusi v. DeForte, 392 U.S. 364, 369 (1968) (holding that government seizure of records located in a shared office violated the official’s expectation of privacy).

  72. See Katz, 389 U.S. at 361 (Harlan, J., concurring).

  73. See Thompson, supra note 17, at 6.

  74. See discussion infra Section III.A.3.

  75. See United States v. Miller, 425 U.S. 435, 442 (1976).

  76. Smith v. Maryland, 442 U.S. 735, 743–44 (1979).

  77. See id. at 737.

  78. Id. at 742.

  79. Id. at 743.

  80. United States v. Jones, 565 U.S. 400, 427, 430 (2012) (Alito, J., concurring).

  81. See id. at 402–03. The police obtained a warrant to install the GPS device on Jones’s car in the District of Columbia within ten days of issuance, but the government installed the device in Maryland eleven days after the issuance of the warrant. See id.

  82. Id. at 404.

  83. Id.

  84. See Warden v. Hayden, 387 U.S. 294, 303–04 (1967).

  85. See Katz v. United States, 389 U.S. 347, 351 (1967).

  86. See Jones, 565 U.S. at 404.

  87. See id. at 407–08.

  88. Carpenter v. United States, 138 S. Ct. 2206, 2211, 2217 (2018).

  89. Id. at 2212.

  90. Id.

  91. Id.

  92. See id. at 2223.

  93. See id. at 2218.

  94. Id.

  95. Id. at 2220.

  96. Id.

  97. Id.

  98. Id. at 2216–17; see also United States v. Miller, 425 U.S. 435, 442 (1976).

  99. Carpenter, 138 S. Ct. at 2216–17.

  100. Id. at 2220.

  101. Id.

  102. Id. at 2216.

  103. Id. at 2262 (Gorsuch, J., dissenting).

  104. Id. at 2272.

  105. See id.

  106. See Sonia M. Suter, All in the Family: Privacy and DNA Familial Searching, 23 Harv. J.L. & Tech. 309, 328 (2010).

  107. See id.

  108. See id. at 315, 328.

  109. Familial DNA Searches, supra note 18.

  110. Smith v. Maryland, 442 U.S. 735, 749 (1979) (Marshall, J., dissenting).

  111. See Privacy Highlights, 23andMe, https://www.23andme.com/about/privacy/ [https://perma.cc/PQ79-SNMM] (Feb. 3, 2022).

  112. See, e.g., Your Privacy Comes First, 23andMe, https://www.23andme.com/privacy/ [https://perma.cc/S6FD-T7HL] (last visited Dec. 6, 2021). But see FamilyTreeDNA Law Enforcement Guide, FamilyTreeDNA, https://www.familytreedna.com/legal/law-enforcement-guide [https://perma.cc/2EFX-UD3E] (last visited Dec. 6, 2021) (stating that law enforcement officials and third parties working with law enforcement are granted permission to use the service “after the required documentation is submitted” to identify deceased individuals and “perpetrator[s] of homicide, sexual assault, or abduction”).

  113. Privacy Highlights, supra note 111.

  114. See id.

  115. Julian Segert, Understanding Ownership and Privacy of Genetic Data, Harv. U. (Nov. 28, 2018), http://sitn.hms.harvard.edu/flash/2018/understanding-ownership-privacy-genetic-data/ [https://perma.cc/FPC2-JHXE].

  116. See Judge Herbert B. Dixon Jr. (Ret.), If You Think Your DNA Is Anonymous, Think Again!, ABA (May 13, 2020), https://www.americanbar.org/groups/judicial/publications/judges_journal/2020/spring/if-you-think-your-dna-anonymous-think-again/ [https://perma.cc/3BV4-HPYB].

  117. See Binder, supra note 13.

  118. See Dixon, supra note 116.

  119. See e.g., Ancestry Terms and Conditions, Ancestry (Aug. 3, 2021), https://www.ancestry.com/c/legal/termsandconditions [https://perma.cc/Q8BZ-3CDT].

  120. See Privacy Highlights, supra note 111. The terms of service provide that “23andMe will preserve and disclose any and all information to law enforcement agencies or others if required to do so by law or in the good faith belief that such preservation or disclosure is reasonably necessary . . . .” Id.

  121. Dustin Patar, Most Online ‘Terms of Service’ Are Incomprehensible to Adults, Study Finds, Vice (Feb. 12, 2019, 1:51 PM), https://www.vice.com/en/article/xwbg7j/online-contract-terms-of-service-are-incomprehensible-to-adults-study-finds [https://perma.cc/QH4V-JY2L]. On average, online consumer contracts require more than fourteen years of education to comprehend. Id.

  122. Claire Abrahamson, Guilt by Genetic Association: The Fourth Amendment and the Search of Private Genetic Databases by Law Enforcement, 87 Fordham L. Rev. 2539, 2552 (2019).

  123. Carpenter v. United States, 138 S. Ct. 2206, 2220 (2018).

  124. Id.

  125. See Genetic Testing, Ctrs. for Disease Control & Prevention, https://www.cdc.gov/genomics/gtesting/genetic_testing.htm [https://perma.cc/NK4Y-GZPA] (Mar. 23, 2020).

  126. See How Much Does an AncestryDNA Test Cost?, Ancestry, https://www.ancestry.com/dna/lp/ancestry-dna-cost [https://perma.cc/K62P-T43D] (last visited Nov. 6, 2021); see also Compare DNA Tests, 23andMe, https://www.23andme.com/compare-dna-tests/ [https://perma.cc/TFT8-9BSS] (last visited Nov. 6, 2021).

  127. Carpenter, 138 S. Ct. at 2219 (citing Riley v. California, 573 U.S. 373, 392 (2014)).

  128. See supra Section IV.A.

  129. See Carpenter, 138 S. Ct. at 2218.

  130. See id. at 2219.

  131. Id. at 2223.

  132. See id.

  133. See Behind At-Home DNA Testing Companies Sharing Genetic Data with Third Parties, CBS News (Aug. 2, 2018, 4:29 PM), https://www.cbsnews.com/news/dna-privacy-at-home-tests-23andme-ancestrydna-sell-data-to-third-parties/ [https://perma.cc/73V9-BSMJ].

  134. See id.

  135. See Carpenter, 138 S. Ct. at 2219.

  136. Laura Spinney, Your DNA Is a Valuable Asset, So Why Give It to Ancestry Websites for Free?, Guardian (Feb. 16, 2020, 7:28 PM), https://www.theguardian.com/commentisfree/2020/feb/16/dna-hugely-valuable-health-tech-privacy [https://perma.cc/X9ET-KY72].

  137. See Abrahamson, supra note 122, at 2580.

  138. Yaniv Erlich et al., Identity Inference of Genomic Data Using Long-Range Familial Searches, 362 Science 690, 690 (2018).

  139. Sarah Zhang, A DNA Company Wants You to Help Catch Criminals, Atlantic (Mar. 29, 2019), https://www.theatlantic.com/science/archive/2019/03/a-dna-company-wants-your-dna-to-catch-criminals/586120/ [https://perma.cc/V63V-QHXY].

  140. See, e.g., FamilyTreeDNA Law Enforcement Guide, supra note 112.

  141. See Privacy and DNA Tests, supra note 33.

  142. See Sarah Zhang, How a Tiny Website Became the Police’s Go-To Genealogy Database, Atlantic (June 1, 2018), https://www.theatlantic.com/science/archive/2018/06/gedmatch-police-genealogy-database/561695/ [https://perma.cc/C2DA-L3C6].

  143. See id.

  144. See Abrahamson, supra note 122, at 2581.

  145. See Binder, supra note 13.

  146. See supra Part I; supra Section II.C.

  147. This absolute ownership means that the consumer maintains complete control of the use of his or her genetic information. See Absolute Ownership Law and Legal Definition, USLegal, https://definitions.uslegal.com/a/absolute-ownership/ [https://perma.cc/J29W-6JKH] (last visited Apr. 2, 2022).

  148. U.S. Const. amend. IV.

  149. E.g., Segert, supra note 115.

  150. See id.

  151. See Ass’n for Molecular Pathology v. Myriad Genetics, Inc., 569 U.S. 576, 596 (2013) (ruling that DNA cannot be patented).

  152. Natalie Ram, DNA by the Entirety, 115 Colum. L. Rev. 873, 935, 938 (2015). Tenancy by the entirety is defined as “a type of shared ownership of property . . . available only to married couples” in which each spouse is deemed to “own an undivided interest in the property.” Tenancy by the Entirety, Cornell L. Sch., https://www.law.cornell.edu/wex/tenancy_by_the_entirety [https://perma.cc/E54Y-5AZB] (last visited Feb. 9, 2022).

  153. See Ram, supra note 152, at 903.

  154. See id. at 899.

  155. See id. at 899–900.

  156. See id. at 901.

  157. “[T]he burden of guarding privacy in a free society should not be on its citizens.” United States v. White, 401 U.S. 745, 793 (1971) (Harlan, J., dissenting).

  158. See Amy Howe, Decade in Review: Justice Antonin Scalia’s Death and the Republican Delay in Filling the Seat, SCOTUSblog (Dec. 27, 2019, 10:00 AM), https://www.scotusblog.com/2019/12/decade-in-review-justice-antonin-scalias-death-and-the-republican-delay-to-fill-the-seat/ [https://perma.cc/6QNY-2AE6].

  159. Kevin Underhill, Justice Scalia and the Genetic Panopticon, Forbes (June 6, 2013, 12:00 AM), https://www.forbes.com/sites/kevinunderhill/2013/06/06/justice-scalia-and-the-genetic-panopticon/ [https://perma.cc/4LCX-H6RW].

  160. Id. A “panopticon” is a circular prison building with a guide tower at its center. The idea is that prison guards could see all the inmates at one time, but the inmates could not see the guards. This forced inmates “to act as if they were being watched, because they couldn’t be sure if they were or not.” Id.

  161. See id.

  162. See supra Section IV.B.2.

  163. See Teneille R. Brown, Why We Fear Genetic Informants: Using Genetic Genealogy to Catch Serial Killers, 21 Colum. Sci. & Tech. L. Rev. 1, 13 (2019).

  164. See, e.g., supra Section II.C (discussing the identification and capture of the Golden State Killer using a free DNA database); supra Part I (detailing how investigators identified William Earl Talbott II through DNA samples uploaded online by his second cousins).

  165. See Carpenter v. United States, 138 S. Ct. 2206, 2261–63 (2018) (Gorsuch, J., dissenting).

  166. See Daniel Solove, 10 Reasons Why the Fourth Amendment Third Party Doctrine Should Be Overruled in Carpenter v. US, TeachPrivacy (Nov. 28, 2017), https://teachprivacy.com/carpenter-v-us-10-reasons-fourth-amendment-third-party-doctrine-overruled/ [https://perma.cc/VL5C-KJHM].

  167. See id.

  168. See generally Smith v. Maryland, 442 U.S. 735 (1979) (holding that the defendant had no expectation of privacy from the police because he voluntarily provided information to his phone company simply by using his phone).

  169. See id. at 743–44.

  170. See supra Section III.A.1.

  171. See Solove, supra note 166. The First Amendment provides that “Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.” U.S. Const. amend. I.

  172. See Solove, supra note 166. For instance, the government can pull online searches or review a consumer’s purchase history of certain books and political materials on websites like Amazon. See id.

  173. Phillip M. Kannan, Advisory Opinions by Federal Courts, 32 U. Rich. L. Rev. 769, 771 (1998) (discussing that advisory opinions are not “properly judicial”).

  174. See How Does the U.S. Supreme Court Decide Whether to Hear a Case?, FindLaw, https://www.findlaw.com/litigation/legal-system/how-does-the-u-s-supreme-court-decide-whether-to-hear-a-case [https://perma.cc/K7TR-NZQJ] (June 20, 2016). On average, the Supreme Court hears less than 1% of petitions each year. See id.

  175. See How Long Do Federal Appeals Take?, Fed. Crim. L. Ctr., https://federalcriminallawcenter.com/frequently-asked-questions/how-long-do-federal-appeals-take/ [https://perma.cc/4SSG-5JL7] (last visited Jan. 15, 2022).

  176. As of 2011, Colorado, Texas, California, and Nebraska allowed for familial searches and partial matching. In addition, nineteen states allowed for the use of partial matching with or without express consent. See Natalie Ram, Fortuity and Forensic Familial Identification, 63 Stan. L. Rev. 751, 753, 768, 771–72 (2011).

  177. See Privacy and DNA Tests, supra note 33.

  178. See State & Local Government, Obama White House, https://obamawhitehouse.archives.gov/1600/state-and-local-government [https://perma.cc/NHM7-QMZB] (last visited Dec. 2, 2021).

  179. See Lindsey Van Ness, DNA Databases Are Boon to Police but Menace to Privacy, Critics Say, Pew Trs. (Feb. 20, 2020), https://www.pewtrusts.org/en/research-and-analysis/blogs/stateline/2020/02/20/dna-databases-are-boon-to-police-but-menace-to-privacy-critics-say [https://perma.cc/RUY4-VVD8].

  180. Id.

  181. Emma Coleman, One State May Become the First to Ban Law Enforcement Use of Genealogy Databases, Route Fifty (Jan. 21, 2020), https://www.route-fifty.com/public-safety/2020/01/utah-dna-databases/162544/ [https://perma.cc/N644-E5HF]; see also H.B. 231, Gen. Sess. (Utah 2020).

  182. Senator Sydnor of Maryland introduced a bill in 2020 to limit how searches of DNA databases may be conducted. See Van Ness, supra note 179; S.B. 848, Gen. Assemb., Reg. Sess. (Md. 2020). These proposed limitations came after the House rejected Bill 30 in 2019. See Van Ness, supra note 179; H.B. 30, Gen. Assemb., Reg. Sess. (Md. 2019). House Bill 30 sought to prohibit all searches of consumer DNA databases for criminal investigations. H.B. 30, Gen. Assemb., Reg. Sess. (Md. 2019).

  183. For example, the Golden State Killer.

  184. By only allowing for the search of consumers who submitted their genetic information, law enforcement would not be able to use partial matches to create family trees and find individuals who are not already in the genealogical system.

  185. Jesse Kitnick, Killer’s Code: Familial DNA Searches Through Third-Party Databases Under Carpenter, 41 Cardozo L. Rev. 855, 896 (2019).

  186. If a state law provides more protection for its citizens than federal law, the state law will prevail. See, e.g., Jennifer Daw Holloway, What Takes Precedence: HIPAA or State Law?, 34 Am. Psych. Ass’n 28, 28 (2003), https://www.apa.org/monitor/jan03/hipaa [https://perma.cc/G43U-U2JR].

  187. See supra Section IV.B.1.

  188. Fear that their voluntary submission of genetic material could negatively impact their relatives may act as a deterrent on consumers.