This image released by 23andMe shows the company's home-based saliva collection kit. (Image: 23andMe via AP)

Three DNA testing companies have slashed prices for the holidays for their home testing kits that can tell consumers about their ancestry, and provide a wealth of data underpinning the genetic sequencing at the very core of their biology.

But a U.S. Senator warns the privacy concerns are not made clear to consumers—and called on the Federal Trade Commission to investigate companies like AncestryDNA, 23andMe and MyHeritage, as Black Friday and Cyber Monday sales continue to market to millions of Americans not yet in any DNA databases.

The implications for the forensic community are clear—as some investigations have already been led to persons of interest through searches of massive amounts of data available to genealogists. 

The DNA data could be sold to third parties—and consumers may not realize their most private information could end up with other companies, argued Sen. Chuck Schumer (D-NY), in a Sunday press conference.

“It shouldn’t be that they can sell it and the consumer doesn’t know,” said the senator. “There is no point to learning about your family tree if your privacy gets chopped down at the same time.”

The sales push is currently underway for kits that normally cost $99: MyHeritage has cut the cost of its saliva kits in half, to $49, while AncestryDNA has lowered it to $59 and 23andMe has lowered it to $69.

Schumer told reporters that the data isn’t covered by traditional privacy laws like the Health Insurance Portability and Accountability Act (HIPAA).

“Here’s what many consumers don’t realize: that their sensitive information can end up in the hands of unknown third-party companies,” the senator explained. “There are no prohibitions and many companies say that they can still sell your information to other companies.”

The three companies have variously addressed the privacy concerns.

“We do not sell individual customer information nor do we include any customer data in our research program without an individual’s voluntary and informed consent,” said Kate Black, 23andMe’s privacy officer, in a statement to Forensic Magazine. “23andMe customers are in control of their data—customers can choose to consent, or not to, at any time.”

Ancestry could not be reached for comment in time for Forensic Magazine’s deadline. However, the companies have addressed the privacy concerns in the past.

Ancestry’s privacy statement was last updated in July; in it they concede they may disclose personal information to third parties in “very limited circumstances,” including “as may be required by law, regulatory authorities, or legal process,” or to protect the rights and property of AncestryDNA, among other disclaimers.

The MyHeritage privacy statement was updated Sunday, the day of Schumer’s press conference. Its terms contain some similar wording to the Ancestry provisions—e.g., “very limited circumstances”—but also include the possibility of completely deleting the data, according to the terms.

MyHeritage told Forensic Magazine in a statement that it has "never sold or licensed DNA data to any third party."

The instances of forensic application of the ancestry and heritage databases have been relatively limited. Five total requests were made to Ancestry and 23andMe as of March 2016, the Associated Press has reported. But the few examples have had dramatic effects on investigations.

One of the most notable breakthroughs in a notorious cold case was announced at the beginning of this year. The genetic sample of a California woman abandoned by a convicted child abuser and murderer led to a hit through 23andMe—which connected that murderer back to the Bear Brook Murders, the still-unidentified bodies of four females found in barrels in the New Hampshire woods. Forensic Magazine spoke with the detectives and scientists in that breakthrough—and determined that it took a year of massive testing and cross-country conversations to make the ancestral link between the abandoned girl and her long-lost family back in New England.

Another huge breakthrough was the capture of the so-called "Phoenix Canal Killer," Bryan Patrick Miller. He was arrested and charged in January 2015 for the two killings in the early 1990s, based on the analysis of public databases by forensic genealogist Colleen Fitzpatrick.

But a false lead was produced through genetic databases in 2014, involving Ancestry. Michael Usry Jr., a filmmaker from New Orleans, was linked to an Idaho Falls homicide scene from 1996 when his father’s DNA—which had been donated to a nonprofit on behalf of the Mormon Church—was found to be similar to the suspected killer of 18-year-old Angie Dodge. Usry was interrogated, and his DNA was tested—but the genetic samples didn’t match, according to police. Experts have emphasized to Forensic Magazine that the database used in the Usry connection were not direct-to-consumer databases, but instead were purchased by Ancestry years earlier.

The DNA testing industry has grown at an accelerating pace in the last two years. 23andMe announced they had genotyped their millionth customer in June 2015—but that number has doubled by September of this year, according to the company. Some 85 percent of the customers opt to include their DNA in scientific research databases, the company has said.