Yes, which is why I specifically said "it would take a major court loss for them to ever be forced to do so." Both companies are absolutely beefing up their legal teams to fight these coming court battles. (And I suspect a big part of why this isn't already in the courts is probably that law enforcement agencies know that they will lose anyway.)
Actually, the reason why the issue hasn't been in the courts (to my knowledge) is that the law enforcement groups (including the FBI) were operating
outside the normal legal channels for gathering evidence. In some cases, investigators just uploaded DNA to sites which allow anyone to upload DNA, but do not do DNA testing themselves. In other cases, individual investigators went directly to people they knew personally within the companies and got their help -- in at least one case, in clear violation of the company's own Terms of Service.
Here's a link to a good article which describes some of the things that were done:
https://www.theatlantic.com/science...-dna-database-criminal-investigations/599005/
What we don't know is what the investigators did once they got a lead in those cases. Normally, once they got pointed in the right direction, investigators would make sure they used proper legal methods to
actually gather evidence...as opposed to developing leads.
But that legal process requires a great deal of specificity. You can't just subpoena a company and say, "Let me see all your records." You have to clearly specify what you are looking for -- fishing expeditions are not allowed. If an agency asked to compare DNA evidence from a crime scene against a company's entire database, that would almost certainly NOT pass legal muster.
If law enforcement failed to follow proper legal procedures, their evidence would be ruled inadmissible, and the bad guy would walk.
You are right that 23andme and Ancestry do not allow law enforcement to upload DNA or search their records. They are doing nothing fancy there; they are simply complying with the 4th Amendment protections against unreasonable search and seizure -- just like any bank, doctor's office, or any other business would.
The vast majority of DNA-solved cases are always going to come from
law enforcement databases -- NOT from private companies. Many states have requirements that convicted criminals of various types submit DNA samples, and those samples form a vast database owned and operated by law enforcement. There is no need to go to private companies in most cases. They simply search their state's database, or the FBI database, and identify the subject.
Given all that, I think the chances of my DNA on file with an ancestry company is
extremely unlikely to be used in any criminal investigation.