First, there is now no downward limit on what crimes the police might investigate through genetic genealogy. If the police felt free to use it in an assault case, why not shoplifting, trespassing or littering?

Second, there’s the issue of meaningful consent. You may decide that the police should use your DNA profile without qualification and may even post your information online with that purpose in mind. But your DNA is also shared in part with your relatives. When you consent to genetic sleuthing, you are also exposing your siblings, parents, cousins, relatives you’ve never met and even future generations of your family. Legitimate consent to the government’s use of an entire family tree should involve more than just a single person clicking “yes” to a website’s terms and conditions.

Third, there’s the question of why the limits on Americans’ genetic privacy are being fashioned by private entities. The Centerville police used GEDmatch because the site owners allowed an exception to their own rules, which had permitted law enforcement access only for murder and sexual assault investigations. After user complaints, GEDmatch expanded the list of crimes that the police may investigate on its site to include assault. It also changed default options for users so that the police may not gain access to their profiles unless users affirmatively opt-in. But if your relative elects to do so, there’s no way for you to opt out of that particular decision. And what’s to stop GEDmatch from changing its policies again?

Finally, the police usually confirm leads by collecting discarded DNA samples from a suspect. How comfortable should we be that a school resource officer hung around a high school cafeteria waiting to collect a teenager’s “abandoned” DNA ?

All of these issues point to one problem: Police use of genetic genealogy is virtually unregulated. Law enforcement agencies and cooperating genetic genealogy websites are operating in a world of few limits. There are not only few rules about which crimes to investigate, but also unclear remedies in the case of mistakes, the discovery of embarrassing or intrusive information, or misuse of the information.

If these concerns sounds similar to other technology and privacy problems we’re facing, they should. Our genetic and digital identities raise similar questions of autonomy, civil liberties, and intrusion by public and private entities.

Without legal limits, genetic genealogy will become a more popular tool for the police. Rather than wait for the courts to deal with difficult and novel issues about genetic surveillance and privacy, state legislatures and attorneys general should step in and articulate guidelines on how far their law enforcement agencies should go. Congress and the Federal Trade Commission should take further steps to protect the privacy and security of consumer genetic data.