Before DNA, There Was the Family Tree
Long before saliva kits and genetic databases, genealogy depended on documents: birth and death certificates, marriage registers, census records, immigration papers, gravestones, obituaries, photographs and family memories.
Building a conventional family tree is an exercise in historical reconstruction. Each name must be connected to another through evidence, yet records may contain errors, spelling variations or assumptions repeated across generations. Having maintained a large family-tree database myself, I know the work is rarely finished. New documents emerge, relatives remember forgotten details and one correction may alter several branches.
DNA did not make traditional genealogy obsolete. It provided another kind of evidence. A documentary family tree asks: What do the records say? A genetic match asks: What biological relationship does the DNA support?
The strongest genealogy uses both. Records provide names, dates, places and personal histories. DNA can support a relationship, identify an unknown branch or reveal that the documented tree and the biological tree are not identical.
But DNA alone cannot reconstruct a family history. A genetic match does not tell us who someone was, how that person lived or what connected one generation to the next. Documents give the family tree its stories. DNA helps test some of its branches.
I wrote about the Human Genome Project for this column in August 2000, when the genome sequence had just been announced in draft — well before a saliva kit was something you could order online.
Not All DNA Tells the Same Story
Before considering the privacy problem, it helps to understand what genetic genealogy measures. Different tests follow different genetic trails, and they do not tell the same story. MedlinePlus Genetics provides a useful overview of the three principal forms of genetic ancestry testing.
Most consumer ancestry tests do not sequence your entire genome. Instead, they examine hundreds of thousands of selected genetic markers called single-nucleotide polymorphisms, or SNPs — usually pronounced “snips”. Patterns across these markers can be compared with reference populations to estimate ancestry and with other customers to identify shared DNA segments and possible relatives.
A SNP is a genetic marker, not a diagnosis. Even when a variant is associated with disease, it may alter risk only slightly and must be interpreted alongside other genes, family history, lifestyle and clinical evidence.
Traces many recent branches.
Best for cousin matching; individual ancestral contributions become diluted over generations.
Traces the direct paternal line.
Excellent for paternal haplogroups and surname studies, but follows only one ancestral path.
Traces the direct maternal line.
Both sexes inherit it; normally only daughters transmit it.
Can support or exclude selected relationship paths.
Useful, but less intuitive than autosomal matching.
Figure 1. Different genetic tests illuminate different parts of the family tree. Y-DNA and mtDNA are powerful precisely because they follow narrow lines; they should not be mistaken for a person’s total ancestry.
Autosomal DNA — the family tree in all directions
Most mainstream cousin-matching services rely largely on autosomal DNA. You inherit approximately half from each parent, but recombination reshuffles chromosomes in every generation. Siblings — unless they are identical twins — therefore inherit different genetic mixtures.
Autosomal DNA can identify relatives across many branches, but the signal from individual ancestors becomes less predictable with distance. Someone can be a genuine genealogical ancestor yet, sufficiently far back, leave no identifiable autosomal DNA in you today. Your documented family tree and detectable genetic family tree are not identical.
Y-DNA — your father’s father’s father
The Y chromosome is normally passed from father to son with relatively little change. Mutations accumulated over generations define haplogroups that can illuminate direct paternal migrations and sometimes test whether surname families share a paternal ancestor.
But Y-DNA follows only one narrow path through an enormous family tree. It is one thread of your ancestry, not your ancestry in its entirety.
mtDNA — your mother’s mother’s mother
Mitochondrial DNA is inherited almost entirely from the mother. Both sons and daughters receive it, but normally only daughters transmit it. It therefore traces a persistent direct maternal line and can be assigned to haplogroups that illuminate ancient population movements.
Again, the caveat matters: a mitochondrial haplogroup describes one direct maternal lineage. It does not define your ethnicity or describe most of your ancestors.
Haplogroup Is Not Ethnicity
A consumer may discover that a paternal line belongs to one Y-DNA haplogroup or that a maternal lineage belongs to a particular mtDNA haplogroup. It is tempting to turn that into a statement of identity: “Therefore, I am descended from X people.”
The reality is more complicated. Haplogroups describe particular branches of the human genetic tree. Populations moved, mixed and intermarried over thousands of years.
Likewise, commercial ancestry percentages are estimates based on reference populations, statistical models and company algorithms. Populations are not represented equally, and different companies use different comparison databases. As those databases and algorithms change, the percentages may change. Your DNA has not changed. The interpretation has.
When the Family Tree Fights Back
DNA can confirm a family history built painstakingly over generations. It can also challenge one in an afternoon.
People have discovered previously unknown siblings. Adoptees have found biological parents. Donor-conceived people have identified donors. Men have discovered children they never knew existed. Children have discovered that the man they always believed was their biological father was not.
The genealogical term sometimes used is “misattributed parentage”. For the people involved, there may be nothing abstract about it.
Yet an unexpected DNA result does not necessarily make the traditional family tree false. A family tree records more than biological inheritance. It may also preserve legal parenthood, adoption, marriage, cultural belonging and — most importantly — the people who actually formed and raised a family.
Someone who has spent years constructing a documentary tree may therefore decide to retain it while exploring the genetic evidence as a separate layer. The recorded father may remain the father who raised the child, even if DNA identifies another biological parent. Both relationships can be historically and personally meaningful.
The challenge is not simply deciding which tree is “correct”. It is deciding what kind of truth each tree is recording — and whether disclosing the genetic finding might harm living people who never asked for it to be uncovered.
Suppose my DNA establishes something unexpected about my parentage. That information concerns me. But it also concerns my mother, my presumed father, my biological father, their other children and perhaps several extended families.
Who has the right to know? And who has the right not to know?
Once discovered, some information cannot be undiscovered.
You Never Took a DNA Test. Does That Matter?
Perhaps the most striking consequence of genetic genealogy is that refusing to take a DNA test does not necessarily make you genetically invisible.
Imagine that you have never submitted your DNA anywhere. But your sister has. Two cousins have. Several second and third cousins have. Each has placed pieces of your extended family’s genetic jigsaw puzzle into databases.
A landmark 2018 Science study analysed consumer genomic data from 1.28 million individuals and projected that about 60% of long-range searches for people of European descent would produce a third-cousin-or-closer match — potentially enough, when combined with genealogical and demographic information, to narrow an unknown genome toward an identity.
An unknown DNA profile may lead to distant relatives, overlapping family trees and a likely candidate even when that person never submitted a sample. Genealogical inference generates an investigative lead; identity requires confirmation with conventional DNA. Likelihood varies with database size, ancestry representation and available records.
The Golden State Killer Changed the Conversation
Investigative genetic genealogy combines dense genetic information from a crime-scene sample with permitted genealogy databases and traditional records to generate leads. It differs from a conventional exact-match forensic DNA search. Law-enforcement databases, consumer genealogy services, research biobanks and clinical repositories should not be treated as interchangeable: they have different purposes, access rules and legal frameworks.
The technique became famous in 2018 when investigators identified Joseph James DeAngelo, the Golden State Killer. Crime-scene DNA had failed to produce a conventional database match. Genetic genealogy identified relatives; investigators built family trees and narrowed the possibilities before confirming DeAngelo through conventional DNA evidence.
The Federal Judicial Center describes the case as a turning point in the use of non-law-enforcement genetic databases. The FBI likewise notes that forensic genetic genealogy can identify perpetrators of violent crimes through relatives rather than through a direct database match.
The US Department of Justice has issued policy governing forensic genetic genealogical DNA analysis, reflecting the need to balance investigative usefulness with privacy and civil-liberty concerns.
Few people will object to catching a serial murderer. The harder question comes next. If this technology is acceptable for murder and sexual assault, where should the boundary sit for less serious offences, missing-person cases, unidentified remains or other government uses?
Technology often gives us the ability to do something before society has decided when we should do it.
Then Medicine Entered the Room
The same DNA that can identify biological relatives may also reveal information about health. Genetic testing can identify variants associated with inherited disorders and predispositions, including some hereditary cancer syndromes and familial hypercholesterolaemia. Pharmacogenomics can sometimes inform drug metabolism or response, while polygenic risk scores combine many variants to estimate susceptibility to common diseases.
But genetic risk is not genetic destiny. For many common diseases, what happens depends on a complex interaction between multiple genes, age, environment, lifestyle and chance.
The US Food and Drug Administration stresses that direct-to-consumer health-risk reports do not determine a person’s overall risk. Different companies may test different variants; a negative result does not remove risk, and a positive result does not make disease inevitable.
Consumer testing and clinical genetic diagnosis are not interchangeable. A medically important consumer result may require confirmation in an appropriate clinical laboratory and interpretation alongside personal and family history.
No one should make a major treatment or screening decision solely because an ancestry or consumer-genetics website displayed a result.
The Genome Is Not a Crystal Ball
There is another danger: genetic determinism. Our genome matters enormously, but it is not the whole biological story. Genes interact with environment and behaviour; gene regulation changes; somatic mutations accumulate during life; and epigenetic mechanisms influence which genes are active.
The more subtle privacy issue is time. The most important information contained in the DNA sample you provide today may not be information anyone knows how to interpret today.
Twenty years from now, larger datasets and more powerful artificial intelligence may extract associations or predictions from stored genomic data that were not reasonably foreseeable when you clicked “I agree”.
Consent therefore has a time dimension. We may be consenting not only to what someone can learn from our DNA now, but to what may become inferable from it later.
Who Owns Your Genome?
Perhaps ownership is the wrong question. After a saliva sample is sent away, several distinct things may exist: the physical sample, digitised genetic data, a company’s interpretation of that data, relative-matching information, research datasets and discoveries derived from aggregated information.
They do not necessarily have the same legal status.
A better set of questions is: Who can store my DNA? Who can analyse it? Who can compare it with other genomes? Who can use it for research? Who can transfer the database? Under what circumstances can government obtain access? And what does “delete my data” actually mean after information has been incorporated into research?
What If the Company Changes Hands?
In March 2025, the US Federal Trade Commission raised concerns about the potential sale or transfer of sensitive consumer information during 23andMe’s Chapter 11 bankruptcy, emphasising that consumers should be able to rely on promises companies make about handling sensitive data.
In July 2025, according to a filing with the US Securities and Exchange Commission, TTAM Research Institute completed the acquisition of 23andMe’s Personal Genome Service and Research Services businesses. The episode transformed a theoretical question into a practical one: what happens to highly sensitive genetic data when the company holding it enters bankruptcy or changes ownership?
Companies can change ownership. DNA does not.
When someone sends a sample away at age 30, the relevant question may not only be whether the company is trustworthy today. It may be who controls the database decades later.
DNA Is a Password You Cannot Change
Every large collection of valuable personal information creates a cybersecurity problem. Genetic data is unusual because it is both persistent and relational.
If somebody steals my password, I can change it. If my credit-card number is compromised, the bank can issue another. If my genomic data is exposed, I cannot order a replacement genome.
And unlike most identifiers, DNA also links me biologically to other people. That does not mean every genetic database is unsafe. It means the consequences of storing genetic data deserve unusually serious thought.
Can Your DNA Be Used Against You?
The answer depends heavily on jurisdiction. In the United States, the Genetic Information Nondiscrimination Act generally restricts the use of genetic information in health insurance and employment. But GINA does not provide comparable protection for life, disability or long-term-care insurance.
Other countries use different legal frameworks. The genome does not recognise national borders. Privacy law does.
And What About Malaysia?
Malaysia’s Personal Data Protection Act 2010 (Act 709) regulates personal data processed in commercial transactions. The Commissioner’s guidance lists health information as sensitive personal data and says that processing sensitive personal data generally requires express consent unless a statutory exception applies.
The framework has since been strengthened. The Personal Data Protection (Amendment) Act 2024, brought into force in stages during 2025 under an official commencement notification, added biometric data to the sensitive-data category, imposed direct security duties on data processors, introduced breach-notification duties and data-protection officers in prescribed circumstances, created a right to data portability and revised cross-border transfer provisions.
These reforms matter, but they do not expressly classify every form of genetic or genomic information as a separate category of sensitive data. Health-related genetic results may fall within health information; the treatment of ancestry-only data may depend on whether it identifies a living person and on how it is processed. Individual consent also does not fully answer what may be inferred about relatives who never tested.
As genomic medicine, biobanking and commercial testing expand in Malaysia and across Asia, the unresolved questions will include familial information, long-term storage, research consent, cross-border databases, re-identification and future re-analysis.
Consent Across Generations
Parents make medical decisions for their children every day. But uploading a child’s genome or genetic profile to a commercial service for recreational ancestry has a special feature: the information can remain relevant for the child’s entire life.
Although directed mainly at medical testing, joint guidance from the American Academy of Pediatrics and the American College of Medical Genetics and Genomics says that genetic-testing decisions should be driven by the child’s best interests and strongly discourages direct-to-consumer home testing of children. A parent can consent today; the child may become an adult years later and wish that decision had never been made.
Consent also outlives the person tested. A deceased person’s genome remains informative about living children, grandchildren and other relatives. Ancient-DNA research has transformed our understanding of migration while raising its own questions about human remains and descendant communities.
Genetic privacy can therefore reach backwards to our ancestors and forwards to descendants who have not yet been born.
Eight Questions Before You Spit Into the Tube
None of this means that consumer DNA testing is inherently bad. Genetic genealogy can reconnect families, resolve historical mysteries and deepen our understanding of human migration. But fascination should not replace informed consent.
Ancestry SNPs, health variants, Y-DNA, mtDNA, exome sequencing or whole-genome sequencing are not the same thing.
Is it destroyed after testing or stored for future analysis?
What do the privacy policy and terms actually permit?
Is research optional, and can consent later be withdrawn?
What happens to information already incorporated into completed or ongoing research?
Policies and legal rules vary between services and jurisdictions.
The 23andMe episode makes this question much less theoretical.
The most disruptive result may be about your family rather than your health.
The Family Tree Has Changed
For centuries, genealogy asked who our ancestors were. DNA expanded the questions: Who am I biologically related to? What did I inherit from them? And what might those inherited variants mean for me — and for my children?
These are extraordinary advances. DNA has reunited families, identified human remains, helped solve crimes, illuminated ancient migrations and opened new approaches to preventing and treating disease.
The technology is not the villain. Nor should fear of privacy prevent the responsible use of genomic medicine or genetic genealogy.
The deeper problem is that our traditional idea of consent assumes that information belongs principally to the person being tested. DNA does not behave that way.
My cholesterol result primarily tells you something about me. My X-ray primarily describes me. But my genome identifies relationships. Parts of it came from people before me, are shared with people alive today and may be transmitted to people after me.
That makes genetic information simultaneously personal and familial.
Perhaps that is the bargain we have not fully understood. When we spit into the tube, we think we are answering a question about ourselves: Where did I come from? But our DNA may answer many more questions than the one we asked — about our parents, our children, our health, our relatives, our past and, increasingly, our future.