Will he? I believe this novel use of a private DNA database is so novel that there may not be any governing case law on whether it's a violation of privacy.

The scanned individuals opted in for relative matching. The fact those people were relatives of John Doe is publicly-documented knowledge in birth records and not susceptible to a privacy challenge.

We know states are prohibited from storing biometrics (DNA, fingerprints) of law abiding people for law enforcement purposes. Then it follows they are prohibited to outsource the same to third parties.

That's a reasonable train of thought. IANAL, so I don't know if it actually holds water in court.

That's not how it works.