Advertisement than 2 million people have voluntarily given their DNA to a pair of massive genetic companies to find out about their hereditary past – a potential treasure trove for modern criminal investigators, whose work now often revolves around DNA.

But the roadblocks to getting information from a private company, and getting it right, is still a serious long-shot. The companies 23andMe and say they are concerned about their clients’ privacy – and are willing to legally defend it. It’s only led to identification of a potential suspect once, and that time it pointed at the wrong person.

Six individuals’ genetic information has been sought in requests from law enforcement, the two companies told Forensic Magazine.

But 23andMe successfully fought the requests for five of the people. provided the information of a single person related to an ongoing investigation of a 1996 Idaho murder – but that turned up a dead-end.

So far, the long-shot odds, and the companies’ reluctance, have deterred investigators from using the private DNA database as a valid criminalistics tool.

“We’ve successfully fought all (law enforcement) requests and we’ve had to provide no information to law enforcement,” said Kate Black, the privacy officer for 23andMe, told Forensic Magazine in a statement. “That’s something we’re really proud of. I personally am dedicated to ensuring that we never have to give that kind of information.” said they would comply with valid search warrants, if one satisfied federal law. They would also consider emergency requests, if the risk of death or serious injury could be proven, they write in their latest “transparency report.” But in all of 2015, the site received just 14 requests from law enforcement – all of which sought information on credit card misuse and identity theft, and no DNA. (The company did provide financial information in response to valid warrants in 13 of the 14 cases).

But even if the DNA was secured with a valid search warrant, it would potentially only be a lead – and not admissible in court. Both services employ a “spit kit” which allows someone to send a saliva sample to the company for testing. But it can’t be proven who ordered the kit – or spit in the tube, Black said.

“We don’t authenticate who they are, and you can’t follow the chain of custody for saliva or spit from any customer in particular to our database,” she said. “Under those circumstances, the evidence doesn’t hold up in court.”

The 23andMe database has more than 1 million customers, and all that information is de-identified and stored in aggregate, with the most personal information and data walled off in separate servers, Black added., which has about 1.5 million customers, also has security measures.

The single case provides a template of how even a valid search warrant, and hours of follow-up, may lead nowhere.

An 18-year-old woman named Angie Dodge was raped and murdered in Idaho Falls, Idaho, in 1996. A man named Christopher Tapp was sentenced to life in prison in 1998 for the crime. But he has appealed, and part of his case has been that someone else’s DNA was on Dodge’s body.

Local investigators sent the genetic information to in 2014. It turned up a close, but not exact, match: a Mississippi man who had donated his DNA to a non-profit organization doing hereditary research.

Although the man was too old to be a suspect, his son matched the age profile of the alleged accomplice, and also had traveled in the Idaho Falls area. Police showed up on the younger man’s doorstep in New Orleans in December, 2014, and interrogated him for hours before convincing him to supply a DNA sample.

The two samples did not match, and police are still searching for the apparently at-large killer, according to a lengthy account in Wired.

But Ancestry also said that the DNA sample, since it had been voluntarily given, was already “made public.” They were just providing the identity to that known sample, they said.

“In our history, we have received just one request relating to DNA information – a 2014 search warrant ordering us to provide the identity of a person based on a DNA sample that had previously been made public for which the police had a match,” the company states in its own transparency report. “We disclosed information in response to that valid warrant.”