The policy generally limits law enforcement to considering genealogy sites when a candidate sample belongs to a possible culprit, or when a likely homicide victim is unidentified. Prosecutors can greenlight the use of these sites for violent crimes beyond murder and sexual assault, but only when the circumstances create a "substantial and ongoing threat" to the public. Agencies can't use the sites unless a sample has first been uploaded to the FBI's DNA profile database and hasn't produced a match. Also, the investigators in the relevant jurisdiction need to have followed "reasonable investigative leads," and case info need to be entered into national databases for missing people and violent criminals.
There's more even after meeting these rules. FBI lab officials have to evaluate the suitability of a sample and suggest "reasonable" alternatives to genealogy sites when possible. The investigators must then agree with prosecutors that genealogy is a suitable option. If they get the go-ahead, they have to explicitly identify themselves as law enforcement to these sites, use only sites that make clear the police have access, keep data as private as possible and obtain consent from third parties before collecting any reference samples. Any analysis on a covertly-obtained sample will require a search warrant, and samples have to be limited to the identification purposes necessary for the case.
If there's a lead, the case holders have to turn back to conventional investigation methods.
Any genealogy profiles and account info will be treated as confidential, and there are tight controls on what happens if a suspect faces charges. If they're charged after a genealogy profile has been entered into an open DNA database, the investigators will have to remove that profile. Samples, profiles and accounts have to be destroyed once there's a verdict, while Department elements have to routinely document instances where genealogy sites were used, including the sites in question and the ultimate outcome.
The temporary policy takes effect November 1st, while a final policy is due in 2020. It's safe to say there's a clear goal at this stage -- the DOJ wants law enforcement to avoid using genealogy sites as much as possible, and leave an extensive record of what happened. It might not completely alleviate privacy concerns, but it could prevent obvious abuses of sensitive genetic data.