When numerous Illinois residents discovered their names and likenesses were being used without their knowledge or consent by ancestry.com for commercial purposes, they banded together to send a strong message about their legal right to privacy. The over 100 citizens brought a class action suit against the behemoth international company, Ancestry.com, worth about $4.7 billion.

The class-action suit was filed in the U.S. District Court for the Southern District of Illinois against Ancestry.com DNA, LLC. The suit alleges the company violated the Illinois Genetic Information Privacy Act (GIPA). GIPA, legislated in 2020, provides laws that mandate a party may not share genetic testing information to any other person or entity other than the individuals authorized specifically by users.

In 2020, the wildly popular genealogy and DNA-testing firm ancestary.com sold 74 percent of the company to Blackstone Group, which is also named as a plaintiff in the lawsuit. The plaintiffs brought their case when they discovered Ancestory.com sold their genetic information without their permission to Blackstone Group during the company’s transaction.

The lawsuit states “Compliance with GIPA is straightforward and may be accomplished through a single, signed sheet of paper or its electronic equivalent. GIPA’s requirements bestow a right to privacy in one’s genetic information and a right to prevent the disclosure of such information without their consent.”

Minor “A.K” filed the class action suit via his adult legal guardian Kelsi Kingsley in late October 2021. Attorneys also filed a similar lawsuit in July 2021 against Ancestry.com for plaintiff Carolyn Bridges and then Danny Collins, and sought to create a class-action suit, which was approved. The plaintiffs added verbiage in the suit stating it is for “all Illinois residents whose genetic information was disclosed and/or released by Ancestry.com to Blackstone, according to Ancestry.com’s records.”

Currently, over 100 members are participating in the lawsuit, seeking over $5 million. Specifically, the plaintiffs seek an injunction forcing Ancestry.com to comply with GIPA laws, acknowledge they violated GIPA laws, and pay $15,00 for each violation of GIPA, statutory damages of $2,500 for each negligent violation of GIPA or damages (whichever is greater) plus all of the plaintiffs’ fees for attorneys, court fees, etc.

In court documents, the plaintiffs state, “This case concerns the illegal disclosure of thousands if not millions of individuals’ genetic information to Blackstone, Inc., a multi-billion-dollar private equity firm that acquired defendant Ancestry.com, a genetic testing company, in late 2020.”

The rise of technology has brought with it a Wild West stampede of legal wrangles as numerous laws regarding citizens’ rights to privacy are historically challenged in courts. From electronic surveillance, genetics info, cyber theft, personal information, medical records, spyware, workplace monitoring, cookies and more, a citizen’s right to privacy is battling online access to once-secret personal data. Simultaneously, many privacy laws differ from state to state, creating a confusing map of mandates depending upon where citizens reside.

Laws concerning the right of privacy and the right of publicity fall under invasion of privacy laws, while the Fourth Amendment primarily offers the right to privacy in regard to searches by the government.

Beyond the genetic GIPA laws, under the invasion of privacy laws, categories of privacy rights include intrusion into seclusion, appropriation of likeness or identity, public disclosure of private facts, and portrayal in a false light. Appropriation of a name or likeness is illegal if a defendant uses a plaintiffs’ name, likeness, or image without the person’s permission for commercial purposes. The exception to this rule, however, is if a defendant uses a person’s likeness for “newsworthy” purposes. The law recognizes every person’s right to be free from any exploitation in such cases, though states have their own specific mandates on the issue.

When a company uses a person’s likeness without their knowledge or consent, the person can sue for ‘Misappropriation of Likeness.’ A citizen can sue any business that uses their image or likeness without their permission and also if they use images to promote products or services.

Similarly, in 2020 Ancestry.com was in another legal battle in California, when two residents charged the company with “knowingly misappropriating the photographs, likenesses, names, and identities of Plaintiffs and the class; knowingly using those photographs, likenesses, names, and identities for the commercial purpose of selling access to them in Ancestry products and services; and knowingly using those photographs, likenesses, names, and identities to advertise, sell, and solicit purchases of Ancestry services and products; without obtaining prior consent from Plaintiffs and the class.”

The lawsuit points to specific California laws that supported their case, including “California right to publicity as codified in Cal. Civ. Code § 3344; the California Unfair Competition Law, Cal. Bus. & Prof. Code 17200 et seq.; California’s common law right protecting against Intrusion upon Seclusion; and California Unjust Enrichment law.”

The plaintiffs argued Ancestry.com “did not and does not seek consent from, give notice to, or provide compensation to Plaintiffs and the class before placing their personal information in its Ancestry Yearbook Database, selling that information as part of its subscription products, and using that information to sell, advertise, and solicit the purchase of its subscription products.”

In this case, the plaintiffs alleged unlawful unfair business practices; violation of their right to publicity; intrusion upon seclusion; unjust enrichment, and charged the company for using their photos, likenesses and names for promotions to attract new users to purchase subscriptions to their services.

However, the defendants lost this case in a dismissal, when the judge said the plaintiffs lacked standing and that defendant’s company was” immune from liability under Section 230 of the Communications Decency Act.” At the time, the U.S. Magistrate Judge Laurel Beeler stated in her decision, "There must be a concrete injury in addition to a statutory violation" for injury in fact. Here, there is no injury except for the statutory violation."

In the new class-action suit, when minor plaintiff A.K purchased and used a DNA test kit from Ancestry.com, he and his guardian received genetic information from the test, which they expected. However, as the plaintiffs noted in court documents, they never agreed for this DNA information to be shared with a third party.

“Due to the highly sensitive nature of genetic test results as well as Ancestry.com’s representations regarding maintaining the strict privacy of its customers’ genetic information, plaintiff and his guardian reasonably believed that the only persons who would be provided the results of plaintiff’s genetic testing would be himself and his family and that the information submitted on his behalf to Ancestry.com would be kept confidential, private and secure - and that it would never be received by third parties like Blackstone without his or his mother’s written consent,” the lawsuit states. “Under GIPA, the results of a DNA or genetic test are confidential and the subject of such testing has a right to prevent others from receiving their genetic test results without written consent.”

Ancestry.com claims the company did disclose on their website stating users’ genetic information would be shared with Blackstone, but that they did not include any way for people to stop this genetic sharing.