FGG in Research: IRB & Ethics Guide

Forensic genetic genealogy (FGG) — also called investigative genetic genealogy (IGG) — combines consumer-style autosomal DNA matching with traditional genealogical research to generate investigative leads on an unidentified person’s identity: an unknown suspect, an unidentified decedent, or a missing person. It is mechanically different from the short tandem repeat (STR) profiling that underlies CODIS and traditional forensic DNA matching. Where CODIS compares a crime-scene profile against a database of directly-collected offender/arrestee profiles for an exact or near-exact match, FGG uploads a single-nucleotide-polymorphism (SNP) genotype to a consumer genealogy database and searches for distant genetic relatives — third cousins or more remote — then builds out a family tree from those matches to triangulate down to the target individual. The technique became widely known after its use in the 2018 identification of a suspect in the decades-old Golden State Killer case via the GEDmatch database, and has since been used in several thousand cases spanning both suspect identification and unidentified-remains cases.

This guide is written for institutional research-compliance offices, IRB administrators, and academic researchers who encounter FGG in one of three distinct contexts: a university forensic-science program running FGG casework in partnership with law enforcement or a medical examiner’s office; a researcher studying FGG itself (its accuracy, error rates, legal treatment, or social impact) as a subject of academic inquiry; or an institution asked to house, fund, or provide ethics review for either activity. Each raises a different, and genuinely under-settled, question about whether and how 45 CFR 46 (the Common Rule) applies.

The threshold question: is it research at all?

Before asking whether an activity needs IRB review, the Common Rule’s own definition of human subjects research requires answering a prior question: is the activity “research” in the regulatory sense — “a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge” (45 CFR 46.102(l))? See CASRAI’s Human Subjects Research: Definition Under 45 CFR 46.102 for the full test.

This is where FGG casework and FGG research diverge sharply:

FGG performed as forensic casework — a university-affiliated lab or program running genealogical analysis on a specific unsolved case at the request of law enforcement or a medical examiner, to generate an investigative lead in that one matter — is not, on its own, “designed to develop or contribute to generalizable knowledge.” It is a forensic service, analogous to a crime lab running a routine DNA comparison. Absent a separate research component, casework of this kind typically falls outside the Common Rule’s definition of research entirely, and an IRB determination may not be the relevant compliance gate at all — though institutional policy, data-use agreements with the genealogy platform, and any grant or contract terms funding the lab’s operation still apply.
FGG studied as a research subject — evaluating the technique’s accuracy or false-lead rate, surveying genetic genealogists or forensic examiners about their practices, interviewing identified individuals’ family members about the experience, or analyzing case outcomes across a set of investigations to draw generalizable conclusions — is squarely “research” under 45 CFR 46.102(l), and triggers the ordinary human-subjects analysis below.

Institutions that skip this threshold determination and default straight to “IRB review needed” or “no IRB review needed” without characterizing the activity first are the most common source of downstream compliance problems in this area — get the casework-vs-research distinction documented before proceeding either direction.

If it is research: who is the “subject,” and does the data qualify as human subjects data?

Assuming the activity clears the threshold above as genuine research, the next question is whether it involves a living individual and identifiable private information about that individual, per the Common Rule’s definition. FGG’s structure makes this genuinely harder to answer than it looks, for a reason specific to how the technique works: the person whose identity is ultimately being inferred — the unknown suspect, decedent, or missing person — is almost never the person who supplied DNA to the database. That data comes from distant relatives (often third cousins or further removed) who uploaded their own genetic profile to a consumer platform for unrelated genealogical or, on some platforms, opted-in law-enforcement-matching purposes. The scholarly literature on this describes it as a structural feature, not an edge case: bioethics and legal analyses of the technique — see, for instance, the Journal of Law and Biosciences article “Four Misconceptions About Investigative Genetic Genealogy” — describe FGG’s reach as extending well past the people who actually consented to any database’s terms of use, because of how densely interconnected large genetic-genealogy databases have become. A foundational 2018 study in Science modeling U.S. database growth (Erlich et al., “Identity inference of genomic data using long-range familial searches”) found that once a genetic-genealogy database captures a small percentage of a target population, a majority of that population becomes identifiable via a distant-cousin match — regardless of whether they themselves ever used the service.

That structure creates two candidate “subjects” for Common Rule purposes, and institutions should not assume the answer is obvious:

The database contributors whose identifiable genetic and genealogical data is directly obtained and analyzed — arguably the more straightforward fit for “obtaining identifiable private information about a living individual” under 45 CFR 46.102(e).
The target individual (suspect, decedent, missing person) about whom the research or casework is ultimately generating conclusions, who supplied no data and gave no consent to anyone, and who may not even know the activity occurred.

Neither OHRP nor a Common Rule amendment has issued FGG-specific guidance resolving this ambiguity as of this writing — treat any confident-sounding claim that the question is “settled” with skepticism, and build in extra IRB consultation time rather than assuming a fast determination.

Does the “publicly available data” exemption apply?

A common instinct is to treat consumer genealogy databases as falling under the Common Rule’s exemption for secondary research using data that is “publicly available” (45 CFR 46.104(d)(4)), the same logic that lets researchers analyze open government datasets without IRB review. This is a weaker fit than it first appears. Platforms like GEDmatch and FamilyTreeDNA require account registration, apply user-controlled privacy and matching settings, and — since GEDmatch’s 2019 policy change — require users to affirmatively opt in before their profile is even searchable for law-enforcement matching purposes. That is a materially different access model from a genuinely open public dataset, and most institutional research-compliance offices treat these platforms as a gray zone rather than a clean fit for the publicly-available-data exemption. A related regulatory complication: merging or cross-referencing multiple datasets in a way that re-identifies individuals who were otherwise de-identified or aggregated is itself a recognized trigger for IRB review, even where the underlying source data looked exempt in isolation — and FGG is, by definition, exactly that kind of cross-referencing exercise. See CASRAI’s guide on exempt human subjects research for the general exemption categories and why “publicly available” is narrower than it sounds in practice.

The DOJ Interim Policy — a separate track from IRB review

In September 2019 the U.S. Department of Justice issued an Interim Policy on Forensic Genetic Genealogical DNA Analysis and Searching, which governs FGG conducted with federal funding or DOJ component involvement. It restricts eligible case types (generally violent crime and unidentified-remains cases where other investigative avenues have been exhausted), sets requirements around use of non-suspect relatives’ data, and requires law enforcement to use only databases that have provided explicit notice to users that law enforcement matching may occur. It is worth stating plainly: the DOJ policy is not a Common Rule substitute and does not itself trigger or waive IRB review — it governs the law-enforcement use of the technique, operating on a separate legal track from the human-subjects-research framework that governs academic research about the technique. An institution can be fully compliant with the DOJ policy on the casework side and still owe a completely separate IRB analysis on the research side, and vice versa; don’t let compliance with one substitute for a real determination on the other.

Ethical considerations that outlast the regulatory determination

Several concerns raised by FGG are genuinely ethical rather than strictly regulatory — they remain live issues for an institution’s research-ethics posture even in scenarios where 45 CFR 46 formally does not apply (e.g., non-research casework, or research that clears an exemption).

The consent gap for third parties. A database contributor’s consent to law-enforcement matching covers only their own decision to participate — it cannot, and does not purport to, extend to the many relatives whose genetic relatedness to that contributor makes them findable as a byproduct. This is the central critique raised across the bioethics and privacy-law literature on FGG, and it exists independent of whatever the formal IRB determination turns out to be.
Reference-population bias. Consumer genetic-genealogy databases skew heavily toward users of European ancestry, which means FGG’s practical effectiveness — and therefore its investigative reach — is uneven across populations. This is a recognized equity concern raised in the forensic-science and criminal-justice literature: the technique works best, and is deployed most, where the underlying reference data is deepest, and that data is not evenly distributed across populations.
Downstream consequences for identified individuals and families. Unlike a routine CODIS hit, an FGG lead is typically the start, not the end, of an investigation — genealogists build out a tentative family tree, investigators corroborate with conventional evidence, and the process can surface unrelated sensitive family information (undisclosed parentage, for instance) along the way, with real consequences for people who are not the actual subject of the case at all.
Platform terms-of-service compliance. Most consumer genealogy platforms place explicit restrictions on research, commercial, or law-enforcement use of their data separate from any regulatory question — an institution’s compliance office should confirm a proposed use is actually permitted under the platform’s current terms before treating a Common Rule exemption (if one applies) as the only gate that matters.

A modified-Delphi policy study published via PMC, “Investigative genetic genealogy practices warranting policy attention”, surveys practitioner and expert views on exactly this set of open questions — useful background for an institution drafting its own internal FGG policy rather than relying solely on the DOJ’s narrower law-enforcement-facing framework.

A practical framework for institutions

Characterize the activity first. Is this forensic casework in support of a specific investigation, or research designed to produce generalizable knowledge? Document the answer and the reasoning — don’t let this get inferred retroactively.
If it’s casework, confirm the applicable compliance gates outside the Common Rule: institutional policy on forensic-service activities, any data-use or reliance agreement with the genealogy platform, grant/contract terms if federally funded, and alignment with the DOJ Interim Policy where federal funds or DOJ involvement is present.
If it’s research, bring it to the IRB early and explicitly flag the novel-technique nature of the submission — see CASRAI’s IRB/REC Approval Process guide for how review-type determinations get made. Do not assume a “not human subjects research” self-determination is safe to make without IRB sign-off given the unsettled subject-identification question above.
Don’t rely on the publicly-available-data exemption without documented analysis of the specific platform’s access model and the cross-referencing/re-identification risk inherent to genealogical triangulation.
Separate the DOJ Interim Policy question from the IRB question — they are governed by different authorities, and satisfying one does not satisfy the other.
Treat the ethical considerations above as live regardless of the regulatory outcome — a research-ethics or research-integrity committee review can be warranted even where a formal IRB determination is “not human subjects research” or “exempt.”

Frequently asked questions

Does using GEDmatch or FamilyTreeDNA for academic research automatically require IRB review?

Not automatically, but it should not be assumed exempt either. Whether IRB review is required depends on the threshold research-vs-casework question, whether the activity involves identifiable private information about a living individual, and whether the specific platform’s access model genuinely fits the Common Rule’s publicly-available-data exemption — a determination institutions should document rather than assume.

Is FGG casework performed by a university forensic-science lab “human subjects research”?

Generally not, if it is limited to case-specific investigative work for law enforcement or a medical examiner and is not designed to produce generalizable knowledge. It still triggers other institutional obligations (platform terms of service, data-use agreements, and — where federally funded — the DOJ Interim Policy), just not necessarily the Common Rule’s research-definition trigger.

Who counts as the “subject” in an FGG study — the database contributor or the identified individual?

Both are plausible candidates, and the question is not definitively settled by current OHRP guidance. Institutions should treat this as a genuinely open compliance question requiring IRB consultation rather than a self-evident answer either way.

Does the DOJ’s 2019 Interim Policy substitute for IRB review?

No. The DOJ Interim Policy governs the law-enforcement use of FGG conducted with federal funding or DOJ involvement; it operates on a separate legal track from the Common Rule and does not itself determine whether academic research about or using FGG needs IRB review.

Forensic Genetic Genealogy in Academic Research: IRB and Ethical Considerations