This is a common misconception, as long as we are talking US companies and US agencies, they don't need to do much of that, thanks to the third-party doctrine [0] they do not even need a legal warrant.

Now add in the fact how popular ancestry tests have become, and how even that data is openly monetized, it's not that far of a reach to assume US intelligence agencies have been building their own aggregated DB.

[0] https://en.wikipedia.org/wiki/Third-party_doctrine