Drawing a blank: Contract terms in direct-to-consumer genetic testing for family tracing after adoption or out-of-home care

Abstract

Purpose

Increasingly, people separated from biological family through adoption or out-of-home care (OOHC) are using direct-to-consumer (DTC) DNA testing and genetic genealogy websites to find family. This is the first study to examine the clickwrap contracts applying to this population.

Methods

We identified 17 companies providing DTC DNA or genetic genealogy services for family tracing to users in Australia. We used NVivo software to analyse their terms and conditions.

Results

Despite the growing use of DNA services by people affected by adoption or OOHC, the platforms’ contracts rarely referred to this population. Risks that contracts canvassed, such as unexpected findings, were not tailored to these users. Links to support services were insufficient. Privacy protections varied.

Conclusion

DTC DNA companies and genetic genealogy platforms should directly address their use by people seeking family after adoption or OOHC. Greater attention should be paid to the potential outcomes, including negative outcomes, of testing for this purpose and the role of third-party services, such as genetic genealogists and volunteer ‘search angels’, in supporting users. People using DTC DNA testing and genetic genealogy platforms after an experience of adoption or OOHC should weigh up the platforms’ features against their privacy needs and decisions to disclose information in search of their biological relatives.

Plain language summary

People who were adopted or in out-of-home care, or family members who lost contact with them, often use DNA testing to try to find each other. They can use a DNA test purchased online or post their DNA data and other information on ‘genetic genealogy’ websites. When they do this, certain terms and conditions apply to them. These terms and conditions are decided by the DNA companies. They set out what rights the company or website has and what rights its users have. We wanted to find out whether the terms and conditions were appropriate for people searching for family after having experienced adoption or out-of-home care. We collected information about the terms and conditions of 17 companies selling DNA tests or running genetic genealogy websites. We considered what issues might arise for the people using these services to look for family after adoption or out-of-home care.

We found that companies selling DNA tests, or running genetic genealogy platforms, almost never mentioned people who had experienced adoption or out-of-home care. Their terms and conditions did not include information that would be very relevant to these people, such as details of support services and warnings about how distressing the consequences of searching and finding (or not finding) family might be. Nor did they mention the role of third-party genetic genealogy professionals and ‘search angels’. The ways that companies protect people’s privacy varied.

We suggest that companies providing DNA testing and genetic genealogy websites should provide clearer information about things that are important to people who are using the services to find family after adoption or out-of-home care. They should say more about what the specific risks might be for these people and should also address the role of third-party searchers. Users should think about how they might both protect and share their personal information to suit their own needs.

Keywords

adoption contract DNA test family genetic genealogy out-of-home care search angels

Introduction

In Australia, many people live with the experience of having been adopted or having relinquished (voluntarily or by duplicity, coercion or force) a child for adoption. It is estimated that up to 250,000 adoptions took place in Australia from 1940 to 2012 (Department of Social Services, Australian Government, 2023) and that around one in 15 Australians were affected (Higgins et al., 2016: 3). The era of forced adoptions from 1945 until the early 1970s saw a peak of almost 10,000 adoptions in a single year (1971–72), after which time the rate fell dramatically (Australian Institute of Health and Welfare, 2023). Still more children experienced out-of-home care (OOHC) – alternative accommodation such as institutional (e.g., orphanages and children’s homes) and foster care for children unable to live in their family home (Swain, 2014). This affected upwards of half a million Australians in the 20^th century (Commonwealth of Australia, 2004: xv).¹

Although experiences varied, many people who were adopted or who lived in OOHC settings suffered significant abuse and neglect and have been left with lasting trauma, psychiatric harm, grief and questions about their identity (Commonwealth of Australia, 2004; Legislative Assembly Legal and Social Issues Committee, 2021; Wilson and Golding, 2016). Commonly, parents were deprived of contact with children, and children with parents, siblings and other family members. The federal government’s Forgotten Australians report eloquently states:

[This] has a major impact on an individual’s sense of self and identity. There are no siblings to share birthdays or anniversaries. There are no photographs, no medical histories, no school reports or personal mementos. Many care leavers have been described as… feeling that they belong nowhere, isolated and being unable to establish attachments which the majority of people take for granted. (Commonwealth of Australia, 2004: 253; see also Legislative Assembly Legal and Social Issues Committee, 2021: 141)

Questions of identity are lifelong for many people affected by adoption or OOHC, resulting in lengthy searches for information to reconnect with family and understand what happened to them. Other groups of searchers are similarly motivated: people who were donor-conceived (Harper et al., 2016) and those raised by one biological parent seeking the unknown other. A deep curiosity to understand one’s identity through kinship (Feast, 2020; Lee et al., 2021) as well as to collect information relevant to health history (May, 2019) often drives this search. A 2012 Australian study found that 86% of birth mothers had tried to find information about their child who had been adopted (Kenny et al., 2012: 54) and 88% of adopted persons had tried to find information about their birth family (Kenny et al., 2012: 234). Despite the establishment of contact registers from the mid-1970s and legislative change from the early 1980s to improve adopted persons’ access to information (Kenny et al., 2012: 7) there are often significant challenges in finding information about biological family members separated through adoption or OOHC.

Typically, people affected have pursued information via public records, government departments, community organisations, adoption agencies and investigators. These methods can be frustrating, protracted, costly and often unsuccessful (Kenny et al., 2012: 107, 109; Lee et al., 2021: 145). Records may be difficult to obtain and may be redacted or contain mistaken or deliberately misleading information (Jones and O’Neill, 2014; Kenny et al., 2012: 109; Swain and Musgrove, 2012; Wilson and Golding, 2016). Birth certificates for adopted children commonly omitted the name of the biological father (Commonwealth of Australia Community Affairs References Committee, 2012: 249). Contact and information vetoes were sometimes put in place (Commonwealth of Australia Community Affairs References Committee, 2012: 257–8; Kenny et al., 2012: 108). The diversity of laws, resources and information disclosure practices across different Australian jurisdictions has created additional challenges. Together these issues can be experienced, by those impacted by adoption or OOHC, as once again losing control of their own information and being subject to decision-making by external authorities.

To overcome these challenges, people seeking family in this context increasingly use direct-to-consumer (DTC) DNA testing and public DNA (‘genetic genealogy’, also known as genetic relative-finder) websites to find biological relatives. DTC DNA testing differs from other forms of genetic testing, which occur in a clinical or research context and are mediated by a health professional or researcher. DTC DNA testing involves an individual submitting their saliva or cheek swab via post to a company that analyses the DNA for a fee and returns one or more reports. There is no involvement of a healthcare or other professional (although there may be at a later stage). DTC DNA companies can provide ancestry, health and other trait information, and their platforms then enable customers to connect with others who share some of the same DNA. Three of the largest companies are AncestryDNA, MyHeritage and 23andMe, with some 44 million people’s DNA profiles in their databases alone (as of August 2023) (International Society of Genetic Genealogy, 2023). GEDmatch and other genetic genealogy websites allow users to connect with biological relatives by uploading a DNA report obtained through DTC DNA testing from another site but do not offer testing services themselves. Both avenues can overcome some difficulties of archival research for family tracing and identify otherwise inaccessible family connections. Experts in unknown parentage searches offer critical assistance in the often complex task of making use of the test results, with new methods developing rapidly over the past decade (Kennett, 2019; Moore, 2016).

Reunion and support organisations in Australia now actively recommend the use of DTC DNA services and genetic genealogy platforms for people seeking family lost through adoption and OOHC (Benevolent Society Post Adoption Services, 2020; Jigsaw Queensland, 2015). In 2021, a parliamentary inquiry recommended that the Victorian State Government ‘endorse the use of DNA testing and develop practices guidelines to support its use as a search tool’ (Legislative Assembly Legal and Social Issues Committee, 2021: 310). Searching for family via DTC DNA testing is now mainstream and in many cases the first option pursued by people in this community, given the services’ comparative speed in generating reliable ‘hits’ and the ability of DNA testing to overcome gaps in written records. VANISH (the Victorian Adoption Network for Information and Self Help) reported in a 2019 newsletter that DNA testing has ‘revolutionised genealogical searching’ (VANISH VOICE, 2019: 5) while Jigsaw Queensland described the ability of DNA testing to ‘knock down genealogical brick walls’ (Jigsaw Queensland, 2015). Private service providers (professional genetic genealogists and voluntary ‘search angels’) have also entered this sphere to guide others’ use of DTC DNA services and genetic genealogy sites or undertake searches for them (Schwartz, 2019).

Use of these strategies by people in Australia with experience of adoption or OOHC, and the organisations supporting them, is not straightforward. Some of the reasons for this are common to all users of DTC DNA services. These include making decisions based on skewed information about the ease and benefits versus the drawbacks and limitations of testing (Singleton et al., 2012) and experiencing the uncertainty and sometimes unwelcome nature of test results and their sequelae. Our focus in this article is on the difficulty of engaging with and comprehending the contractual terms of DTC DNA services in the context of the power differential that exists between platforms and users – most significantly, those in the adoption or OOHC community. We will outline briefly how these contracts affect all users before considering in more detail the particular issues facing those with an adoption or OOHC experience.

People who purchase DTC DNA tests may not realise that they are entering into legally binding contracts, often labelled ‘terms of service’, ‘terms and conditions’, or ‘privacy policies’. These are presented as ‘clickwrap’ agreements, where a user ticks a box to indicate their acceptance of terms, or ‘browsewrap’ agreements, where use of the website or service is subject to the contractual terms that are specified in a linked document (LawBase, 2018; New South Wales Supreme Court [NSWSC], 2017; Swinson, 2019).² It is a truism that people rarely access or read such contract terms but are nonetheless bound by them (Obar and Oeldorf-Hirsch, 2020; Robinson and Zhu, 2020). Although some services offer opt-in or opt-out choices to users (e.g., about further research use, sample storage) and purchasers are able to select amongst different products and providers (Dickens, 2007: 403), bargaining power is always unequal. Scholars have critiqued the illusion of ‘notice and choice’ whereby ‘companies decide the kind of boxes people get to check, buttons they press… and other settings they get to fiddle with… [instilling] in users a false sense of control’ (Hartzog and Richards, 2020: 1735). The terms of service – for web-based products and platforms generally and DTC DNA services particularly – are typically complex, long, legalistic and unclear (Robinson and Zhu, 2020). Phillips, in an important 2017 study, noted that one of the leading DTC DNA companies deployed a ‘Terms of Service’ of over 9,000 words and a ‘Privacy Statement’ of almost 16,000 words in length (Phillips, 2017: 278). A failure to read and understand the terms may lead to unanticipated risks and limit users’ ability to select tighter privacy settings when options are made available. It may also generate misunderstanding about the services’ further uses of people’s genetic and personal data, such as for commercialisation or to assist in police investigations.

Why does this matter more for people affected by adoption or OOHC? They are at a notable disadvantage compared to casual or recreational users of DTC DNA services, the latter having alternative sources of family information (such as talking to close relatives) and losing little by a decision not to test. When oral history and written records are inaccessible or unhelpful, people affected by adoption or OOHC seeking biological family may be left with DTC DNA testing as their only option. To test, there is no alternative but to use one of the available commercial services. To use such a service, one must accept the standard form contract. These factors make it vital to determine the precise characteristics of the standard form contracts of DTC DNA companies and genetic genealogy platforms available to Australian users, in order both to guide their use for family searching and to outline potential reforms.

Previous research

Two spheres of existing research have relevance to this article: studies on DTC DNA contracts applicable to users in general and studies on adoptees’ use of genetic testing. Several studies have examined the standard form contracts of DTC DNA companies, concluding that these contracts did not enable users to make informed decisions. This is because the contracts were often ‘long, vague, and written at a college reading level’ (Moran, 2020) and tended to omit information about the ownership and disclosure of personal data and samples. For example, in Christofides and O’Doherty’s review of 28 DTC DNA contracts, 69% offered no clarity on the use of genetic samples or results post-testing (Christofides and O’Doherty, 2016: 117). Furthermore, privacy information presented in the contracts often only related to use of the website (Christofides and O’Doherty, 2016: 107). Additionally, several studies discuss a lack of clarity in terms and conditions regarding ownership of genetic data (for example, Huang and Bashir, 2015).

Research on the use of DTC DNA testing by people who were adopted has focused on adoptees’ motivations for undergoing DTC DNA testing. Among these motivations is the desire for health-related information (Childers, 2017) and filling gaps in medical history (Strong et al., 2017). Adoption status has been found to be a significant predictor of interest in health-oriented genetic testing (Edgar et al., 2022). No research has previously focused on the application of platforms’ contract terms to people from the adoption and OOHC community, when engaging in genetic genealogy.

This article thus addresses the research gap at the intersection of adoptees’ motivations for testing and the contractual terms offered to people using the services. We report here the results of a legal analysis embedded in a larger research project that aimed to understand the prevalence and impacts of using DTC DNA services and public DNA databases for tracing family members separated through adoption and OOHC in Victoria, Australia.

The overarching project included a scoping review (Conrick et al., 2025) and focus groups with key stakeholders leading to an online survey of people who had sought (or were considering seeking) family through DNA testing and people who were found by biological relatives through this method. This legal analysis, which formed a complementary workstream within the larger project, aimed to identify DTC DNA testing companies and public DNA platforms accessible to the community of interest and to closely analyse their contractual terms through the lens of this community’s needs. We focused on whether companies recognised and tailored services to users who were searching for family after adoption or OOHC, as well as privacy issues that could have an outsized impact on this population. In an effort to avoid bias, we did not limit the analysis only to the platforms most commonly used by people with experience of adoption or OOHC, but rather identified a broad range of companies providing relevant services in Australia.

Partly, our purpose was practical: we aimed to contribute to the larger project and to inform guidance for Australian support organisations about their practices and resources for users. Further, we hoped to provide information for people in Australia with experience of adoption or OOHC that could be used when planning or using DNA results to seek family. Finally, we sought to hold up a mirror to companies’ practices in this field, noting the potential vulnerability of the people involved, and to contribute to the broader literature on adoption, DTC DNA testing and the law.

Aim

To analyse the contractual terms offered to users of DTC DNA services and genetic genealogy web platforms in Australia in the context of family tracing following adoption or OOHC and to provide a critique from the user’s perspective.

Methods

The websites collected in this study were gathered by conducting an internet-based Google search in April 2023 using a combination of search terms (see Appendix 1). These search terms were developed through team brainstorming and an analysis of search methods from recent relevant research (Hazel and Slobogin, 2018; Phillips, 2017). The first 15 pages of search results from each query were manually reviewed to determine if each website listed was a DTC website. This initial search identified 30 websites. Each website was then further inspected based on specific inclusion criteria. We only included websites that catered to people in Australia and offered or mentioned services related to ancestry, genealogy, family reunions or tracing. Additionally, the website had to be in English and to provide DTC DNA services without the involvement of a healthcare provider. Based on these criteria, 13 websites were excluded from the study (see Appendix 2), resulting in a final selection of 17 websites that met all requirements. We acknowledge that this data set includes some platforms that searchers prefer as well as some that they would less commonly use, for instance due to concerns (identified anecdotally) about the quality and usefulness of reports.

After each website was identified and manually inspected, documents from each site related to the use and sharing of genetic information were collected. This resulted in a total of 41 documents being collected across the 17 websites. These documents included legal terms, privacy policies, general terms and conditions, terms of service, terms of use and data confidentiality agreements. They were uploaded to NVivo (NVivo Qualitative Data Analysis Software, 2022) in the form of html pages or PDFs. Using NVivo and applying a systematic content analysis approach (Salehijam, 2018), the express contractual terms within these documents were empirically reviewed and classified according to a coding scheme developed through team brainstorming and a preliminary examination of the terms and conditions. Coding categories were refined in light of findings from our stakeholder engagement with people who searched, people who were found and organisations providing services (VANISH, ARMS, Open Place). This coding scheme, presented in Appendix 3, covered specific reference to adoption or OOHC, privacy issues (in terms of the user’s account, tracking, active sharing of information, contact options), the consequences of testing and other matters such as research, forensic and commercial uses of data. We focused on categories that were most meaningful for people in the community of interest. Contractual terms were interpreted objectively (Robertson, 2019: 231–232).

While data were captured from websites in mid-2023, terms and conditions can change frequently. For instance, Ancestry’s Australian site updated its privacy policy 13 times between January 2015 and January 2023 (Ancestry, 2023b). Moreover, the published terms and conditions are often undated, making it difficult to track changes over time for some companies.

Results

We identified 17 services that met the inclusion criteria (see Table 1). These comprised 12 companies offering DTC DNA testing with a web platform and five third-party companies offering web-based information services (including reports on ancestry) to people uploading genomic data obtained elsewhere.

Table 1.

Included services.

DTC DNA Platform (N = 12)	Genetic genealogy platform only (N = 5)
23andMe 24genetics AncestryDNA EasyDNA Family Tree DNA Genebase HomeDNA Living DNA Mapmygenome MyHeritage Nebula Genomics tellmeGen	Findmypast GEDmatch Genomelink Legacy Tree Genealogists Sequencing

These services interconnected in convoluted ways, with some platforms accepting data uploads only from tests purchased from specific companies.

We identified 41 documents across the 17 companies, typically referred to as ‘terms and conditions’, ‘privacy statement’, ‘terms of service’, ‘terms of use’ or similar. Appendix 4 contains a complete list of the documents analysed in this article.

Ten of the 17 companies were headquartered in the United States (primarily California – 5), two in the United Kingdom and Spain, and one in each of Canada, India and Israel. As per the inclusion criteria for this study, all offered services to people located in Australia, with some having registered offices in Australia (see Appendix 5).

We summarise below notable features of the contractual terms across the 17 identified services according to the coding scheme described above.

Explicit reference to adoption and OOHC

Only two services – GEDmatch and Legacy Tree – explicitly refer to adoption, and none refer to OOHC or variations thereof. GEDmatch is the only service to refer, albeit in passing, to the use of the platform for ‘adoptee searches’ (GEDmatch, 2021). In contrast, Legacy Tree refers to the possibility that testing will reveal previously unknown adoption, stating:

While we offer recommendations and analysis regarding DNA testing, we accept no responsibility for testing outcomes. Those tested understand that DNA testing ‘can reveal unexpected information about the tester and his or her immediate family, ancestors, and/or descendants. For example, both DNA test results and traditional genealogical records can reveal misattributed parentage, adoption, health information, previously unknown family members, and errors in well-researched family trees, among other unexpected outcomes’ (‘Genetic Genealogy Standards’, 10 January 2015). Accordingly, by ordering a DNA project, you release Legacy Tree Genealogists from all demands, claims, or liens related to the submission, testing, storage, and use of your DNA, including, but not limited to, reporting errors or omissions, defamation, invasion of privacy, right of publicity, emotional distress, or economic loss. We also accept no responsibility for outcomes to third parties who may be contacted through information we provided to a client. (Legacy Tree, 2023: 5.3)

Importantly, this clause does not refer to people who come to the Legacy Tree service with prior knowledge of their adoption or of a gap in their family history – which is the community of interest for this study. The absence of any substantial reference to adoptees or others seeking biological family, in the context of deliberately aiming to overcome lost connections, is a remarkable gap in all of the included platforms’ materials.

No liability for sequelae of DNA testing

Like any person purchasing a DTC DNA test, people with an experience of adoption or OOHC can have their assumed family relationships upended through DNA testing. But different impacts can also affect people in this community. First, their goal to find and connect with blood relatives through DTC DNA testing may not be achieved, leading to significant disappointment. Second, those who do succeed in this goal can experience distressing after effects, such as difficulty establishing a relationship with the ‘found’ person/s, outright rejection or finding that the person they sought has already died (Conrick et al., 2025).

Platforms sometimes warn users about the former type of upheaval (so-called ‘not parent expected’ or ‘NPE’ discoveries (Schuman et al., 2024)) but not the latter. Specific discoveries that are mentioned in platforms’ contract terms include misattributed parentage (Legacy Tree, 2023), a biological relationship between parents (GEDmatch, 2021) and other relationships that are not supported by DNA (MyHeritage, 2023). For people who have been disconnected from their biological family through OOHC or adoption these matters are unlikely to be new discoveries. The risks lie instead in failure to locate family or not being able to establish desired relationships.

Platforms also disclaim responsibility for subsequent impacts of testing. For instance, Ancestry states:

When using our Services you may discover unexpected facts about yourself or your family… You acknowledge that such discoveries may have a strong emotional impact on you and others with whom you share these discoveries. You expressly agree to assume all risks associated with your use of the Services, and that Ancestry shall not be liable for any social, emotional, or legal consequences of such discoveries (Ancestry.com.au, 2022: 1.1).

On another page, Ancestry points out: ‘You may discover unexpected facts about yourself or your family when using our services. Once discoveries are made, we can’t undo them’ (Ancestry.com.au, 2023). Platforms do not, however, refer to the consequences described above that are more relevant to adoptees and care leavers who are deliberately seeking immediate family. Further, while there is some mention of the potential to receive distressing information, there is no reference to using support services if this occurs. Rather, GEDmatch indicates that if users find the possible negative outcomes unacceptable, they should simply not engage with the service and should remove previously provided data (GEDmatch, 2021).

Balancing privacy with sharing information

Irrespective of the fact that individuals with an experience of adoption or OOHC may purposefully share DNA and genealogical information on platforms in order to find family, research shows that they remain interested in controlling access to this information and concerned about the privacy implications of using DTC DNA testing (May, 2018). Hence the ability to exercise control over one’s information is an important element of our analysis, although we acknowledge that it is not a unique concern of the adoption and OOHC community.

Most but not all platforms allow users to restrict their visibility and limit the possibility that others (generally or specifically) can contact them. For instance, Ancestry users can set contact preferences and block specific users (Ancestry, 2023a). 23andMe has an optional ‘DNA Relatives’ feature that enables people to set their preferred privacy options (23andMe, 2023a), stating: ‘you control at what level you are connected with both known and unknown close and distant relatives and what information is shared with them’ (23andMe, 2023b). GEDmatch adopts a different approach which favours information sharing, stating that the user’s email address and name or alias will be displayed without restriction (GEDmatch, 2021). At the least privacy protecting end of the scale, one platform collects and records users’ communications with other users via the platform and does not say what is done with this data (MyHeritage, 2023).

Using an alias

Two of the 17 services (GEDmatch and Living DNA) refer to the use of an optional alias for account registration and data upload (GEDmatch, 2021; Living DNA, 2018). Ancestry suggests that users choose a username different from their real name (Ancestry.com.au, 2023) and Sequencing provides information on creating an anonymous account using ProtonMail (Sequencing.com, 2023). Whilst it may be possible for users to provide an alias on other services, this is not explicitly stated in the terms and conditions.

Collection, use and disclosure of data

All users might reasonably expect certain information, such as their name, date of birth, address and other contact information, to be collected in order to receive their DNA results. However, since finding family on these platforms is predicated on disclosure, platforms often seek extra information from users. This might include images, health information, social media profiles (e.g., Facebook, Twitter, Instagram, Pinterest and YouTube) and posts on forums managed by the company. Further, platforms actively encourage users to provide information about third parties, such as relatives’ names, birthdates, relationships, places of birth and death, health history, contact information (if living) and photos. Only GEDmatch states that users must ‘privatize living individuals’ by changing their name to ‘LIVING’ (GEDmatch, 2021). Services collect web activity (23andMe, 2022a; 23andMe, 2022b; Ancestry.com.au, 2023; Findmypast, 2023; Genebase, 2023; Genomelink, 2023), including search history, site navigation, interaction with emails from the service and user location (FamilyTreeDNA, 2022a; MyHeritage, 2023; Nebula Genomics, 2023), and use cookies to enable targeted advertising, including sharing this information with third-party advertisers (23andMe, 2022a; 23andMe, 2022b; Genomelink, 2023; Sequencing.com, n.d.). Although this collection is common to all users, arguably it additionally disadvantages those who need to rely entirely on DTC DNA services to locate family, since they are forced to bear the privacy risks that others may be able to avoid.

Role of third parties

It is not uncommon for third parties to manage the purchase of a DNA test and the family tracing tasks on behalf of a person who has experienced adoption or OOHC, whether this be under a formal or informal arrangement. Individuals and groups known as ‘DNA angels’ or ‘search angels’ will assist on a non-profit or voluntary basis. Professional genetic genealogists also provide support for a fee (MacEntee, 2024; Schwartz, 2019). In the contract terms we reviewed, there were no explicit references to ‘search angels’, genetic genealogists or similar roles. Five of the services we examined explicitly prohibit the upload of a sample without the relevant individual’s permission, except if the individual is aged under 18 and the person uploading the sample is a legal guardian (23andMe, 2022c; Ancestry.com.au, 2022; FamilyTreeDNA, 2022b; GEDmatch, 2021; HomeDNA, 2017).

Other issues

A range of other concerns about the contract terms offered by DTC DNA companies and genetic genealogy platforms are also not specific to people with an adoption or OOHC experience. Nonetheless, as mentioned earlier, these users are less able to avoid the risks by choosing not to proceed with DNA testing because of the critical role that DTC DNA testing plays in their search for biological family. These important concerns have been canvassed elsewhere (Christofides and O’Doherty, 2016; Hazel and Slobogin, 2018; Januszewicz and Chosich, 2018) and are mentioned here for completeness: the ‘owner-like’ rights exercised by platforms over users’ samples and data, including global monetisation with no return of benefit (23andMe, 2022c); the further research use of DNA and other personal data following de-identification/anonymisation, sometimes without user consent (24Genetics, n.d; Nebula Genomics, 2023); and law enforcement agencies’ access to data or samples either by agreement (FamilyTreeDNA, 2022b; GEDmatch, 2021) or if required by law (Guerrini et al., 2021).

Discussion

This analysis of contractual terms that apply to users of genetic genealogy platforms and DTC DNA companies in Australia, from the perspective of those who have been affected by adoption or OOHC, provides valuable insights that can guide future developments in this arena. The policy implications are summarised in Table 2. Overall, this analysis demonstrates that users from these communities face not only the typical imbalance of power when dealing with digital platforms, but are also at specific disadvantage compared to other users, due to their need to rely on DTC DNA testing to obtain highly impactful familial information.

Table 2.

Policy implications.

DTC DNA companies should: • explicitly consider how they engage with users with experience of adoption or OOHC; • advise users about the potential for negative outcomes and provide information about support services; • include terms and conditions addressing the roles of third parties (professional and lay searchers), particularly regarding user privacy; • limit privacy impacts to those strictly necessary for service delivery; • provide users with more transparent choices about data sharing; • work with users to develop clearer terminology. Users concerned about privacy and data sharing may choose to: • use DTC DNA services that provide them with a high degree of choice and control over their online visibility and ability to be contacted; • use a browser that blocks third-party tracking cookies by default; • avoid services that provide for default or optional data sharing with law enforcement agencies. Regulators should: • prohibit DTC DNA companies from making unilateral changes of policy/terms and conditions that apply to previously collected data and DNA samples; • examine the fairness and transparency of DTC DNA companies’ further uses and monetisation of people’s genetic and other personal data.

An important finding is that, despite the now mainstream use of these services by people with experience of adoption or OOHC for the purpose of family tracing, none of the user agreements mentioned OOHC (or variables thereof) at all, and only two (of 17) mentioned adoption – but one of these was in the context of newly discovering that an adoption had occurred. Several platforms noted the risk of unexpected findings, but principally those that concerned overturning previous assumptions about family relationships rather than purposefully finding lost family connections and the sequelae of those discoveries.

Instead of offering pathways to manage potential distress (such as contact information for support services), platforms advised users that concerns about (generalised) unexpected discoveries should negate use altogether and disclaimed all liability for subsequent harm. It would be preferable to differentiate the specific risks faced, in using DTC DNA testing, by those with experience of adoption or OOHC (including relinquishing family members). A failure to identify family using this method is a distinct source of potential distress for this cohort in comparison with other users. It should be directly addressed with (at a minimum) specific guidance by the platforms when they have actual or constructive knowledge that their users include those purposely seeking information about, and connection with, lost family. Companies should take particular care in the provision of reports and relative-finder services to people with experience of adoption or OOHC, who are at specific risk of distress from not getting longed-for information via this process. They should also explicitly acknowledge the frequent use of third parties (professional genetic genealogists and ‘search angels’) in the search process and ensure that clear contractual terms address this activity, including to protect the privacy and interests of those doing the DNA test. Platform information and design should acknowledge and set guardrails for this type of activity alongside their broader positioning of ‘buyer beware’.

People using DTC services and genetic genealogy platforms to search for family members can select from a range of companies offering products in Australia. Choices are often dictated, appropriately, by the perceived quality and value of the reports to users. Yet it is important to bear in mind that these companies vary in the extent and ways in which they enable users to protect their personal privacy whilst also sharing information necessary for family contact. Users for whom privacy is a particular concern can choose the platforms that enable them to set and revise their privacy settings over time with a high degree of control (such as blocking contact by specific users). They can avoid platforms that provide default or optional sharing with law enforcement agencies (GEDmatch and FamilyTreeDNA), opting instead for platforms that share data with law enforcement agencies only if compelled. Given the prevalence of web tracking by the services we analysed here, another general privacy-preserving step users may consider is a browser that blocks third-party tracking cookies by default, such as Mozilla Firefox, Brave or DuckDuckGo. Companies should limit privacy impacts to the minimum necessary for service delivery and should provide users with more flexible and transparent choices about data sharing with both the company and other users. This includes information about the privacy of messaging within genetic genealogy platforms.

The dominance of DTC DNA testing for family tracing is such that a parliamentary inquiry in the state of Victoria in 2021 recommended the Australian government should endorse its use for family tracing in the context of adoption and establish appropriate support services. Such moves to formalise the use of DTC genetic testing as an important step for those with experience of adoption or OOHC to find family demand transparent terms under which such testing is obtained and data subsequently used. Hence, much clearer terminology (developed in conjunction with users) and a ‘no surprises’ approach, together with a prohibition on unilateral changes of policy that would apply to previously collected samples and data, are needed (Federal Trade Commission, 2023).

Finally, not only should users be aware that companies generally monetise their data with no return of profits, but regulators should also examine more closely the fairness and transparency of such use. Greater responsibility should be placed upon these services to be explicit, both with users and the wider community, about how, and where, people’s genetic, personal and family information is being used and shared beyond the key purpose of providing a DNA result and relative-finder services.

Conclusion

It is common for Australians to have experienced adoption or OOHC – including as an adopted person or ‘care’ leaver, birth parent, sibling or other relative – and many people in this situation place high value on finding family and (re)establishing contact. However, this process is often significantly impeded by difficulties in accessing written records and by gaps and inaccuracies in these records. Many individuals seeking family, and the organisations supporting them, have turned to DTC DNA testing and genetic genealogy platforms to overcome the barriers that otherwise exist. This analysis has shown that DTC DNA and genetic genealogy services pay virtually no attention to the existence of, and risks faced by, this user group. They fail to recognise or provide information relevant to the primary goal of people who were adopted or have OOHC experience, that is, to find specific family members, and the attendant risks of negative sequelae. The article builds upon previous work that has highlighted the general challenges consumers face in locating and understanding the terms and conditions applying to their use of these services and in mitigating associated privacy risks. Whilst the power imbalance between DTC DNA services and users exists uniformly, the impacts of this imbalance are particularly stark for people seeking family separated through adoption and OOHC. They may have few alternatives to using these commercial services, and for them the stakes of ‘not using’ may be exceptionally high, meaning that true freedom of choice is illusory. Whilst users can make certain choices, selecting companies, privacy settings and browsers that help to protect their privacy interests, it is the DTC DNA and genetic genealogy companies themselves that we call upon to significantly improve the user experience for, and protections of, people with experience of adoption or OOHC and their relatives, who seek each other.

Footnotes

ORCID iDs

Megan Prictor

Jeanette (Jenny) Conrick

Funding

The author(s) disclosed receipt of the following financial support for the research, authorship, and/or publication of this article: Funding was provided by Melbourne Social Equity Institute, The University of Melbourne.

Conflicting interests

The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.

Notes

Author biographies

Megan Prictor is Senior Lecturer in Health, Law and Emerging Technologies and Director of the Juris Doctor (JD) at Melbourne Law School, The University of Melbourne, Australia.

Olivia Kowalishin is a JD candidate and research assistant at Melbourne Law School, The University of Melbourne, Australia.

Jeanette (Jenny) Conrick is a lecturer in the Social Work Department at the University of Melbourne, Australia, and works clinically across the life cycle with those who have an adoption or out-of-home care experience.

Appendix 1: Google search,April 2023

Appendix 2: Excluded DTC GT services with reason for exclusion (n = 13)

Service	Reason for exclusion
Blueprint Genetics	No ancestry focus; requires medical professional
CircleDNA	Health/wellness focus
Color Health	Health/wellness focus; requires medical professional
Dante Labs	Health/wellness focus
DNAfit	Health/wellness focus
Gene by Gene	Gene by Gene is the laboratory service that owns FamilyTree DNA
GeneSight	Health/wellness focus; requires medical professional
Genomind	Health focus; requires medical professional
iGENEA	Focus on ancient genealogy (‘It reveals the percentages in which we originate from different regions of the world’)
myDNA	No ancestry focus; testing used to tailor medication
My True Ancestry	Focused on ancient genealogy (‘Discover your ancient relatives’)
Veritas	Health focus
Vitagene	Health/fitness focus; ancestry component is ancestral regions mapping

Appendix 3: Summary of NVivo Coding

Category	Subcategory	Files	References
Adoption or OOHC		2	2
Privacy: Account on platform	Alias or pseudonym	3	4
Privacy: Account on platform	Web activity	15	33
Privacy: Collection-Use-Disclosure	Default DNA data collection-use-disclosure according to T&Cs	14	25
	De-identified DNA data collection, use or disclosure	7	7
	Family information – collection ONLY	6	10
	General data (not DNA) collection use or disclosure	19	47
	Specific consent for DNA data collection, use, or disclosure	10	20
Privacy: Contact and consequences	Contact possibilities, limitations, or restrictions	15	20
	Unexpected findings	7	10
	Unknown relatives	4	16
Other uses of samples or data	Forensic or police	16	37
	Monetisation or commercialisation by company or platform	12	13
	Research by opt-in or specific consent	14	34
	Research by default unless you opt-out	3	4
Ownership	Data ownership	7	15
Ownership	Sample ownership	1	2

Appendix 4: Documents analysed

Appendix 5: Company locations*

Country	Count (N)	Platform	Location of headquarters
United States	10	23andMe	California
		EasyDNA	California
		GEDmatch	California
		Genomelink	California
		Sequencing	California
		Nebula Genomics	New York State
		HomeDNA	Ohio
		Family Tree DNA	Texas
		AncestryDNA	Utah
		Legacy Tree Genealogists	Utah
United Kingdom	2	Findmypast	London
United Kingdom	2	Living DNA	Somerset
Spain	2	24genetics	Madrid
Spain	2	tellmeGen	Valencia
Canada	1	Genebase	British Columbia
India	1	Mapmygenome	Hyderabad
Israel	1	MyHeritage	Or Yehuda

*The companies we examined were often multinational corporations. Some had registered offices in Australia.

References

23andMe (2022a) Cookie Policy. Available at: www.23andme.com/about/cookies/

23andMe (2022b) Privacy Statement. Available at: https://www.23andme.com/en-int/legal/privacy/full-version/ (accessed 23 October 2023).

23andMe (2022c) Terms of Service. Available at: www.23andme.com/en-int/legal/terms-of-service/full-version/#main

23andMe (2023a) DNA Relatives Privacy & Display Settings. Available at: customercare.23andme.com/hc/en-us/articles/212170838-DNA-Relatives-Privacy-Display-Settings

23andMe (2023b) Privacy and Data Protection. Available at: www.23andme.com/en-int/privacy/

24Genetics (no date) Protection of Genetic Data. Available at: 24genetics.com/protection-of-genetic-data/

Ancestry (2023a) Ancestry and AncestryDNA® Privacy Philosophy. Available at: www.ancestry.com.au/c/privacyphilosophy

Ancestry (2023b) Privacy Statement Archive. Available at: www.ancestry.com.au/c/legal/privacy-archive

Ancestry.com.au (2022) Terms and Conditions. Available at: www.ancestry.com.au/c/legal/termsandconditions-2022-8-15-au

10.

Ancestry.com.au (2023) Website Privacy Statement. Available at: www.ancestry.com.au/c/legal/privacystatement-2023-1-26-au

11.

Australian Institute of Health and Welfare (2023) Adoptions in Australia over Time. CWS91, Web Report, 28 April. Available at: www.aihw.gov.au/reports/adoptions/adoptions-in-australia-over-time/contents/summary

12.

Benevolent Society Post Adoption Services (2020) Finding a relative through DNA (Post Adoption Information Sheet No 47). Available at: www.benevolent.org.au/services-and-programs/post-adoption-services/information-and-resources

13.

Childers

(2017) Adoptees’ Experiences with Direct-to-Consumer Genetic Testing: Emotions, satisfaction, and motivating factors. Doctoral thesis, University of South Carolina, USA.

14.

Christofides

O’Doherty

(2016) Company disclosure and consumer perceptions of the privacy implications of direct-to-consumer genetic testing. New Genetics and Society 35(2): 101–123.

15.

Clapton

(2018) Language is never neutral: A critical analysis of the language surrounding adoption in the UK. Adoption & Fostering 42(2): 122–134.

16.

Commonwealth of Australia (2004) Forgotten Australians: A report on Australians who experienced institutional or out-of-home care as children. Available at: www.aph.gov.au/parliamentary_business/committees/senate/community_affairs/completed_inquiries/2004-07/inst_care/report/index

17.

Commonwealth of Australia Community Affairs References Committee (2012) Commonwealth Contribution to Former Forced Adoption Policies and Practices. Available at: www.aph.gov.au/parliamentary_business/committees/senate/community_affairs/completed_inquiries/2010-13/commcontribformerforcedadoption/report/index

18.

Conrick

Prictor

Zarine

Hampson

(2025) The use and impacts of direct-to-consumer genetic testing for adults with an adoption or out-of-home care experience: A scoping review. Adoption & Fostering 49(2): 227–244.

19.

Department of Social Services, Australian Government (2023) Forced Adoption Practices. Available at: www.dss.gov.au/our-responsibilities/families-and-children/programs-services/forced-adoption-practices

20.

Dickens

(2007) Finding common ground in the world of electronic contracts: The consistency of legal reasoning in clickwrap cases. Marquette Intellectual Property Law Review 11(2): 379–412.

21.

Edgar

Bao

Maga

et al. (2022) Adopted individuals’ interest in elective genomic testing. Journal of Medical Genetics 59(2): 197–203.

22.

FamilyTreeDNA (2022a) Privacy Statement. Available at: www.familytreedna.com/legal/privacy-statement/01112023

23.

FamilyTreeDNA (2022b) Terms of Service. Available at: www.familytreedna.com/legal/terms-of-service/04112024

24.

Feast

(2020) Curiosity and Opportunities: The impact of accessing adoption information on adopted adults and the decision to search for birth relatives. Doctoral thesis, University of East Anglia, UK.

25.

Commission

Federal Trade

(2023) FTC says genetic testing company 1Health failed to protect privacy and security of DNA data and unfairly changed its privacy policy. Available at: www.ftc.gov/news-events/news/press-releases/2023/06/ftc-says-genetic-testing-company-1health-failed-protect-privacy-security-dna-data-unfairly-changed

26.

Findmypast (2023) Privacy Policy. Available at: www.findmypast.co.uk/help/sections/4411074088593-privacy-policy

27.

GEDmatch (2021) Terms of Service & Privacy Policy. Available at: www.gedmatch.com/terms-of-service-privacy-policy/

28.

Genebase (2023) Privacy Policy. Available at: www.genebase.com/privacy-policy/

29.

Genomelink (2023) Privacy Policy. Available at: genomelink.io/legal/privacy-policy

30.

Guerrini

Wickenheiser

Bettinger

et al. (2021) Four misconceptions about investigative genetic genealogy. Journal of Law and the Biosciences 8(1): article no. lsab001.

31.

Harper

Kennett

Reisel

(2016) The end of donor anonymity: How genetic testing is likely to drive anonymous gamete donation out of business. Human Reproduction (Oxford, England) 31(6): 1135–1140.

32.

Hartzog

Richards

(2020) Privacy’s constitutional moment and the limits of data protection. Boston College Law Review 61(5): article no. 1687.

33.

Hazel

Slobogin

(2018) Who knows what, and when: A survey of the privacy policies proffered by U. S. direct-to-consumer genetic testing companies. Cornell Journal of Law and Public Policy 28(1): 35–66.

34.

Higgins

Kenny

Morley

(2016) Forced Adoption National Practice Principles: Guidelines and principles for specialist services for Australians affected by forced adoption and forced family separation practices of the past. Australian Institute of Family Studies. Available at: aifs.gov.au/research/research-reports/forced-adoption-national-practice-principles

35.

HomeDNA (2017) Terms of Use. Available at: homedna.com/terms

36.

Huang

H-Y

Bashir

(2015) Direct-to-consumer genetic testing: Contextual privacy predicament. Proceedings of the Association for Information Science and Technology 52(1): 1–10.

37.

International Society of Genetic Genealogy (2023) Autosomal DNA testing comparison chart – ISOGG Wiki. Available at: isogg.org/wiki/Autosomal_DNA_testing_comparison_chart

38.

Januszewicz

Chosich

(2018) Police use of partial DNA matching in criminal investigations — Identifying a suspect through their genetic relatives. Australian Health Law Bulletin: 146–150.

39.

Queensland

Jigsaw

(2015) Adoption and DNA. Available at: www.jigsawqueensland.com/dna

40.

Jones

O’Neill

(2014) Identity, records and archival evidence: exploring the needs of Forgotten Australians and Former Child Migrants. Archives and Records 35(2): 110–125.

41.

Kennett

(2019) Using genetic genealogy databases in missing persons cases and to develop suspect leads in violent crimes. Forensic Science International 301: 107–117.

42.

Kenny

Higgins

Soloff

et al. (2012) Past Adoption Experiences: National research study on the service response to past adoption practices: Final report. Melbourne: Australian Institute of Family Studies. Available at: aifs.gov.au/research/research-reports/past-adoption-experiences

43.

LawBase (2018) Why You Should Read Online Terms and Conditions. Available at: www.lawbase.com.au/read-online-terms-conditions/

44.

Lee

Vogel

LeRoy

et al. (2021) Adult adoptees and their use of direct-to-consumer genetic testing: Searching for family, searching for health. Journal of Genetic Counseling 30(1): 144–157.

45.

Legacy Tree (2023) Terms of Service Agreement. Available at: www.legacytree.com/terms-service

46.

Legal

Legislative Assembly

Committee

Social Issues

(2021) Inquiry into Responses to Historical Forced Adoption in Victoria. Parliament of Victoria. Available at: www.parliament.vic.gov.au/get-involved/inquiries/inquiry-into-responses-to-historical-forced-adoptions-in-victoria/reports

47.

Living

DNA

(2018) Privacy Policy. Available at: livingdna.com/au/legal/Privacy-Policy

48.

MacEntee

(2024) DNA Angels. Available at: www.myheritage.com/wiki/DNA_Angels

49.

May

(2018) Sociogenetic risks – Ancestry DNA testing, third-party identity, and protection of privacy. New England Journal of Medicine 379(5): 410–412.

50.

May

(2019) The value of genetic testing for family health history of adopted persons. Nature Reviews Genetics 20(2): 65–66.

51.

Moore

(2016) The history of genetic genealogy and unknown parentage research: An insider’s view. Journal of Genetic Genealogy 8(1): 35–37.

52.

Moran

(2020) Privacy perspectives on direct-to-consumer genetic testing in the era of big data: Role of blockchain technology in genomics. Tulane Journal of Technology and Intellectual Property 22: 185–204.

53.

MyHeritage (2023) Privacy Policy. Available at: www.myheritage.com/privacy-policy

54.

Genomics

Nebula

(2023) Privacy Policy 2023. Available at: nebula.org/blog/privacy-policy/

55.

New South Wales Supreme Court (NSWSC) (2017) Gonzalez v Agoda Company Pte Ltd.

56.

NVivo Qualitative Data Analysis Software (2022) QSR International. Available at: qsrinternational.com/nvivo/nvivo-products/

57.

Obar

Oeldorf-Hirsch

(2020) The biggest lie on the internet: Ignoring the privacy policies and terms of service policies of social networking services. Information, Communication & Society 23(1): 128–147.

58.

Phillips

(2017) Reading the fine print when buying your genetic self online: Direct-to-consumer genetic testing terms and conditions. New Genetics and Society 36(3): 273–295.

59.

Robertson

(2019) Purposive contractual interpretation. Legal Studies 39(2): 230–246.

60.

Robinson

Zhu

(2020) Beyond ‘I agree’: Users’ understanding of web site terms of service. Social Media + Society 6(1).

61.

Salehijam

(2018) The value of systematic content analysis in legal research. Tilburg Law Review 23(1–2): 34–42.

62.

Schuman

Beit

Robinson

et al. (2024) ‘The truth should not be hidden’: Experiences and recommendations of individuals making NPE discoveries through genetic genealogy databases. Genetics in Medicine 26(10): article no. 101210.

63.

Schwartz

(2019) DNA search angels: The Facebook ‘detectives’ who help reunite families. The Guardian, 29 April. Available at: www.theguardian.com/lifeandstyle/2019/apr/29/dna-search-angels-adoption-facebook-detectives-reunite-families

64.

Sequencing.com (2023) Anonymous Account Setup. Available at: sequencing.com/blog/post/anonymous-account-setup

65.

Sequencing.com (no date) Privacy Policy. Available at: sequencing.com/policies/privacy-policy

66.

Singleton

Erby

Foisie

et al. (2012) Informed choice in direct-to-consumer genetic testing (DTCGT) websites: A content analysis of benefits, risks, and limitations. Journal of Genetic Counseling 21(3): 433–439.

67.

Strong

May

McCauley

et al. (2017) Adult adoptees’ attitudes regarding the potential use of genetic information to fill the gap in their family health history. Adoption & Fostering 41(2): 159–169.

68.

Swain

(2014) History of Institutions Providing Out-of-Home Care to Children. Sydney: Royal Commission into Institutional Responses to Child Sexual Abuse. Available at: safeguardingchildren.acu.edu.au/research-and-resources/history-of-institutions-providing-out-of-home-residential-care-for-children

69.

Swain

Musgrove

(2012) We are the stories we tell about ourselves: Child welfare records and the construction of identity among Australians who, as children, experienced out-of-home ‘care’. Archives & Manuscripts 40(1): 4–14.

70.

Swinson

(2019) Contract formation. LexisNexis Practical Guidance.

71.

Vanish Voice (2019) DNA testing to search for relatives.

72.

Wilson

Golding

(2016) Latent scrutiny: Personal archives as perpetual mementos of the official gaze. Archival Science 16(1): 93–109.