The following Q&A is an excerpt from Law.com's What's Next briefing, a weekly newsletter on the future of law. Over the coming weeks, we're checking in with legal futurists, technologists and other experts for perspectives on the thorny issues that arise where new tech meets old laws. Click here to learn more about Law.com briefings. 

Millions of individuals have sent saliva samples to commercial genetics testing companies looking for information on their health profile and ancestry. Those consumers likely weren't imagining a day when police could use that information to help identify suspects based on DNA evidence.

But that day has arrived and, like so many issues spurred by technological advances, the law is playing catch up.

Marcia Hofmann, founder of Zeitgeist Law in San Francisco and special counsel to the Electronic Frontier Foundation, has been paying attention to the emerging legal questions. We checked in with her to explore the issues and a possible framework for regulating access to genetic information.

We've been hearing recently about police looking to genetic and ancestry sites like 23andMe or Ancestry.com to solve cases. In what ways is this a legal gray area? 

Marcia Hofmann

Hofmann: More and more people choose to share DNA samples and profiles in hopes of learning about their backgrounds and perhaps discovering new family. I think it came as a surprise to many that investigators are using this information to solve crimes.

That raises an interesting question: Should there be limits on whether, how, and when the police can use genetic information that people share with ancestry sites?

At this point, any limits on the federal level would come from Fourth Amendment, which generally requires investigators to get a warrant to perform a search that intrudes on a reasonable expectation of privacy. Historically, the Supreme Court has said people don't have a reasonable expectation of privacy in things they voluntarily share with third parties, which would suggest the Fourth Amendment doesn't offer much protection here.

And yet the Fourth Amendment landscape has shifted radically over the last few years in a string of cases where the Supreme Court has re-visited old rules in light of new technologies. For example, just last year in Carpenter v. United States, the majority said that at least some information is so unique and intimate that disclosing it to others doesn't snuff out expectations of privacy.

So when it comes to genetic information shared with ancestry sites, maybe there's potential for Fourth Amendment theories that wouldn't have seemed all that viable before. Are genetic information and familial connections so inherently sensitive that a warrant should be a default Fourth Amendment requirement, even if a person shares their DNA profile with others through an ancestry site? When police access a person's genetic information shared with a company, could that be considered a form trespass on personhood or property that requires a warrant? The Supreme Court's recent opinions suggest some interesting directions to take these theories.

It's hard to argue against using every tool available to solve violent crimes. And yet, there's clearly tension here with individual expectations of privacy. Do you think legislation will be required to set an appropriate balance—and what might that look like?

Hofmann: I think legislation is definitely a possibility — plus it could be crafted to include special protections above and beyond what the Fourth Amendment might offer.

Legislation could require law enforcement to get a warrant before collecting DNA information from ancestry sites for criminal investigations, and if the legislature saw fit, it could include requirements beyond a showing a probable cause (as the Wiretap Act does). For example, the law might require searches of genetic information to be done in a way that minimizes the privacy impact on people whose information isn't relevant to an investigation.

Legislation could also limit how ancestry and genetic testing companies can share genetic information with third parties other than law enforcement. And it could require opt-in consent from users before information can be shared for purposes other than what it was originally collected for.

We're nearing a day, according to researchers, when basically everyone's DNA can be matched regardless of whether they've ever used one of these commercial services. Is this likely to be a complicating factor in the Fourth Amendment analysis? 

Hofmann: It is a complicating factor, but the Fourth Amendment test evolves over time. It has the flexibility to adjust to advances in technology and shifts in societal norms.

I imagine that if Fourth Amendment protection were to cover genetic material provided voluntarily by a distant relative, the theory would be based on an expectation of privacy in family relationships or maybe personhood. It might be a particularly important factor that the suspect never consented to the relative's decision to offer up the genetic material, since the suspect wouldn't have done anything to diminish their own expectation of privacy.

I could also see a Fourth Amendment theory based on the idea that genetic information is so inherently sensitive that a warrant is required to search it by default. That's the rule we have now for cell phones after Riley v. California.

Outside of the criminal law arena, are there worrisome implications related to the growth of what's essentially a global DNA registry controlled by commercial entities?

Hofmann: Absolutely. It's critically important to make sure commercial entities don't use predictive genetic information to deny individuals—or entire families— insurance, employment, health care, the freedom to make their own life choices, etc. We already have some laws, such as the Genetic Information Nondiscrimination Act and state statutes, that limit genetic discrimination to varying extents. But those laws need to be agile and keep up as genetic technology develops and new use cases arise.

And what happens if genetic testing and ancestry companies partner up with businesses in other industries, or get acquired, or go bankrupt? Could all that genetic information be put to different uses that consumers didn't agree to? The idea of finding new uses for consumer genetic information isn't purely hypothetical—for instance, 23andMe already has collaborations with pharmaceutical companies to help develop new drugs. Regulators will need to keep a close eye on the re-purposing of genetic information to make sure people and their blood relatives don't suffer unavoidable harms.

➤ We hope you enjoyed this excerpt from What's Next. View the briefing archive.