Everyone's got DNA, but unlike a Social Security or bank account number, genetic information rides the line between being both a wholly unique representation of the person to whom it belongs and a pretty good insight into who they might be spending Thanksgiving with this year.

The paradox represents a gray area for the still burgeoning arena of data usage and consent, especially as the possibilities inherent to DNA as an identifying agent grow more limitless.

“There really might not be such a thing as de-identified DNA,” said Alex Cavazos, an associate at Loeb & Loeb.

Cavazos has noticed more police departments starting to make use of DNA phenotyping, which is the process of using genetic data to reconstruct facial features. Genealogical triangulation can also be used to help determine possible family matches.

Genealogy research site FamilyTreeDNA, for example, allows users to opt into allowing their genetic information to become part of a larger database used for the explicit purpose of identifying family matches. In the fall of 2018, the FBI—unbeknownst to FamilyTreeDNA—uploaded genetic information from a cold case and was able to find a family connection to a previously unidentified body.

When FamilyTreeDNA became aware that the FBI had used its system, it was asked to assist on another case. Now, the company requires law enforcement to both register and provide documentation related to the nature of the case, which must constitute either a sexual assault or homicide. Users can also adjust their preferences to opt out of being matched with any DNA information uploaded by law enforcement without it impeding their ability to use the service.

In a statement to ALM, FamilyTreeDNA founder and CEO Bennett Greenspan said that 99 percent of the service's customers have chosen to remain opted-in to law enforcement matching.

“We are in the very, early stages of a paradigm shift. It is happening in real time and FamilyTreeDNA is responding,” Greenspan said.

David Peloquin, an associate at Ropes & Gray, thinks that the opt-in or opt-out approach is consistent with the privacy trends that have spilled out of headliners such as the European Union's General Data Protection Regulation and the incoming California Consumer Protection Act.

“I think this is building on the idea of transparency,” Peloquin said.

Jessica Lee, a partner and co-chair of the Privacy, Security and Data Innovations practice at Loeb & Loeb, thinks there is still a lapse in how genetic data is regulated.

Prior to ancestry sites, genetic data would have typically been collected in connection to a clinical trial or scientific research. Someone involved with the project could sit down with the subject and explain how their data is being collected and the way in which it will be used.

Companies dealing in all walks of data can typically endeavor to make that clear to user in their terms of service (FamilyTreeDNA's is here). But DNA's broad range as a both a personal and familial identifier adds another wrinkle.

“You're not just consenting for yourself. You're also consenting on behalf of your family members. … So it's how do you kind of communicate the real implications of your choices? And that's a struggle companies have, whether it's genetic data or anything else,” said Lee.