Portillo v. Nebula Genomics, Inc. et al

UNITED STATES DISTRICT COURT
DISTRICT OF MASSACHUSETTS
_______________________________________
)
ANTOINETTE PORTILLO, 	)
)
Plaintiff, 	)
) 	Civil Action No.
v. 	) 	25-12288-BEM
)
NEBULA GENOMICS, INC., 	)
)
Defendant. 	)
_______________________________________)
MEMORANDUM AND ORDER ON
DEFENDANT’S MOTION TO DISMISS
MURPHY, J.
Plaintiff Antoinette Portillo (“Portillo”) brought this class action under the Illinois Genetic
Information Privacy Act (“GIPA”) after Defendant Nebula Genomics, Inc. (“Nebula”) disclosed
customers’ genetic information to third parties. Before the Court is Nebula’s motion to dismiss.
For the reasons set forth below, the Court will deny Nebula’s motion.
I. 	Background
A. 	Statutory Background
GIPA was enacted in 1998 to more rigorously protect genetic testing information. See 410
Ill. Comp. Stat. 513/5 (“Despite existing laws, regulations, and professional standards which
require or promote voluntary and confidential use of genetic testing information, many members
of the public are deterred from seeking genetic testing because of fear that test results will be
disclosed without consent in a manner not permitted by law.”). Section 15(a) of GIPA mandates
that “[g]enetic testing and information derived from genetic testing is confidential and privileged
and may be released only to the individual tested and to persons specifically authorized, in writing
Case 1:25-cv-12288-BEM Document 114 Filed 03/10/26 Page 1 of 8

2
in accordance with Section 30, by that individual to receive the information.” 	Id. 513/15(a).
Section 30 provides that “[n]o person may disclose or be compelled to disclose the identity of any
person upon whom a genetic test is performed or the results of a genetic test in a manner that
permits identification of the subject of the test.” 	Id. 513/30. 	GIPA provides a private right of
action to “[a]ny person aggrieved by a violation of this Act.” Id. 513/40(a).
B. 	Factual Background
Nebula is a commercial genetics company that offers DNA testing and DNA analysis of
Nebula DNA tests and DNA tests from other genetic testing companies. Dkt. 1 (“Complaint” or
“Compl.”) ¶¶ 27–28. Nebula’s website characterizes its service as “Privacy First DNA Testing”
and states that while “Other DNA Tests” will “[s]ell customer genomic data,” Nebula customers
can “[a]ccess technology that enables you to have full ownership and control over your genomic
data.” 	Id. ¶ 30. 	Nebula’s website anticipates that “the primary reason why people haven’t had
their DNA sequenced is due to concerns about privacy and control of genetic data” and states that:
We believe the solution for private DNA testing lies in technology rather than
policies, which is exactly the approach of Nebula Genomics. 	What sets Nebula
apart is that we’re committed to developing technology to protect the privacy of
your genetic data and enable you to share it controllably and securely.
Id. ¶ 31. Despite these commitments, according to the Complaint, Nebula shares its customers’
information with Meta, Microsoft, and Google via analytics and advertising tools enabled on
Nebula’s website, specifically Facebook pixel, Microsoft Conversion Tracking, Microsoft Clarity,
Google Analytics, and Google Tag Manager. Id. ¶ 32. 1
In or around March 2021, Portillo created an account through Nebula’s website and
subsequently purchased and took a Nebula genetics test. Id. ¶ 97. Portillo requested and viewed
1 Specific factual allegations regarding the information shared and the mechanism by which information is
shared to third parties are discussed in more depth below. See infra Section III.B.
Case 1:25-cv-12288-BEM Document 114 Filed 03/10/26 Page 2 of 8

3
a Nebula report analyzing the results of her genetic test. Id. ¶ 98. 	While Portillo had a Nebula
membership, she “regularly accessed the Nebula app to review various information provided by
Nebula based on the results of her genetic test.” Id. ¶ 100. Portillo alleges that “when . . . Portillo
obtained and reviewed Nebula’s analysis of her genetic information, Nebula shared her genetic
information with Meta, Microsoft and Google. Such information included not only the fact that
she had taken a genetic test, but also specific information regarding her genetic attributes.”
Id. ¶ 102.
Nebula never informed Portillo that her genetic information would be disclosed to a third
party when she obtained and viewed the Nebula report analyzing her genetic test, nor did she
consent to Nebula disclosing it. Id. ¶¶ 104–05. Portillo cancelled her Nebula membership after
purchasing renewals in July 2021 and in July 2022. Id. ¶ 99. Nebula’s Terms of Use contains a
Massachusetts choice of law provision. Dkt. 100-1 at 9.2
C. 	Procedural Background
Portillo filed a class-action complaint in the Northern District of Illinois on October 10,
2024, alleging a violation of GIPA against Nebula and unjust enrichment against Meta, Facebook,
and Google. Compl. ¶¶ 33–36. Meta, Facebook, and Google moved to dismiss, Dkts. 45, 48, 51,
and Nebula moved to transfer or dismiss, Dkt. 54. 	On July 24, 2025, Judge Cummings of the
Northern District of Illinois dismissed Meta, Facebook, and Google from the case and granted
Nebula’s motion to transfer to this District. Dkt. 73.
On November 17, 2025, Nebula moved to dismiss the single remaining claim pursuant to
Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). Dkt. 97. The Court held a hearing on the
motion on February 10, 2026, and the Court took the matter under advisement.
2 The Court takes judicial notice of the Terms of Use. See Dk. 100 (Nebula’s Request for Judicial Notice).
Case 1:25-cv-12288-BEM Document 114 Filed 03/10/26 Page 3 of 8

4
II. 	Legal Standard
“When considering a motion to dismiss under subsection 12(b)(1) . . . , the Court should
apply a standard of review similar to that accorded a dismissal for failure to state a claim under
subsection 12(b)(6).” Bauersachs v. Massing, 2019 WL 1961077, at *2 (D. Mass. 2019) (internal
quotation marks and citation omitted). 	“[A] complaint’s well-pleaded facts must be credited as
true, and all reasonable inferences from the complaint must be drawn in the plaintiff’s favor.”
Portier v. NEO Tech. Sols., 2019 WL 7946103, at *3 (D. Mass. Dec. 31, 2019), report and
recommendation adopted, 2020 WL 877035 (D. Mass. Jan. 30, 2020). The Court must determine
whether a plaintiff’s factual allegations—disregarding all “conclusory” statements—“state a claim
to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009).
III. 	Discussion
A. 	Choice of Law
Nebula argues that the Massachusetts choice of law provision in the Terms of Use governs
and that Portillo’s Complaint must be dismissed because Portillo may not make a claim pursuant
to GIPA under Massachusetts law. Dkt. 98 at 14. However, the Court must first determine whether
the provision applies to the claim at issue and would therefore preclude making such a claim under
the law of another state. 	See Kleiner v. Cengage Learning Holdings II, Inc., 66 F.4th 28, 31
(1st Cir. 2023). The Court “begin[s] with the language of the choice of law clause itself” when
“determining the scope of that clause.” Id.
The Terms of Use states that “[t]his Agreement shall be construed according to the laws of
the State of Massachusetts.” 	Dkt. 100-1 at 9. 	The First Circuit and Massachusetts Supreme
Judicial Court have construed comparable provisions narrowly, such that the provision governs
only the agreement itself, but does not preclude pursuing contract-adjacent claims under the law
of another state. 	See Kleiner, 66 F.4th at 32 (concluding that where the clause stated “‘[t]his
Case 1:25-cv-12288-BEM Document 114 Filed 03/10/26 Page 4 of 8

5
Agreement shall be construed and governed’ according to New York law” but “d[id] not otherwise
select any state’s law as governing the parties’ rights and obligations that are created by statute,”
“the agreement d[id] not suggest that the parties agreed that New York law would govern the . . .
breach[] [of] a statutory duty imposed by Massachusetts law.” (first alteration original)); Vertex
Surgical, Inc. v. Paradigm Biodevices, Inc., 390 F. App’x 1, 2 (1st Cir. 2010) (holding that a
provision stating “Massachusetts law exclusively shall govern all terms of this Agreement” did not
preclude bringing a claim under the Georgia Wholesale Distribution Act); Jacobson v. Mailboxes
Etc. U.S.A., Inc., 419 Mass. 572, 580 n.9 (1995) (“The agreement does not state that the rights of
the parties are to be governed by California law but only that the agreement is to be governed and
construed by California law. The choice of law clause does not purport to bar the application of
G.L. c. 93A to the parties’ dealings in Massachusetts.”).
Because the narrow choice of law provision at issue does not purport to govern the parties’
rights or obligations more broadly, the Court concludes that the provision does not preclude
Portillo from bringing a GIPA claim under Illinois law.3
B. 	Standing
In the alternative, Nebula moves to dismiss for lack of standing under Federal Rule of Civil
Procedure 12(b)(1) on the ground that Portillo, the named plaintiff, alleged no actionable injury
under GIPA. Dkt. 98 at 17. “To establish standing, a named plaintiff must ‘clearly . . . allege facts
demonstrating’ that she ‘(1) suffered an injury in fact, (2) that is fairly traceable to the challenged
conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.’”
Brito v. Garland, 22 F.4th 240, 252 (1st Cir. 2021) (quoting Spokeo, Inc. v. Robins, 578 U.S. 330,
3 Having determined that the choice of law provision does not apply to the sole claim in the Complaint, the
Court need not address the parties arguments’ regarding whether enforcing the provision would be contrary to a
fundamental policy of Illinois. See Hodas v. Morin, 442 Mass. 544, 550 (2004).
Case 1:25-cv-12288-BEM Document 114 Filed 03/10/26 Page 5 of 8

6
338 (2016)). An “injury in fact” is “an invasion of a legally protected interest which is (a) concrete
and particularized, and (b) actual or imminent, not conjectural or hypothetical.” Lujan v. Defs. of
Wildlife, 504 U.S. 555, 560 (1992) (cleaned up).
Portillo alleges that Nebula shares customers’ information, including her own, with Meta,
Microsoft, and Google through its use of Facebook Pixel, Microsoft conversion tracking,
Microsoft Clarity, Google Analytics, and Google Tag Manager when website users sign up on the
Nebula website, purchase and register Nebula kits, and request and view reports analyzing their
test results. Compl. ¶¶ 32, 34, 47–52, 57–63, 71–75, 77–81, 87–91. As to her own interactions
with the Nebula website, Portillo alleges, inter alia, that in 2021 she created an account on
Nebula.org, purchased and took a Nebula DNA test, and requested and reviewed a Nebula report
analyzing her genetic test. Compl. ¶¶ 98–99. Plaintiff further alleges that Nebula never informed
her that it would share her genetic information with anyone when she requested and reviewed
Nebula’s analysis of her genetic test and that she never gave Nebula consent to do so. 	Id.
¶¶ 104–05.
Nebula contends that Portillo has nevertheless failed to establish standing because “[t]he
Complaint discusses at length the alleged functionality of the site today, but does not purport to
describe what it was in 2021 to 2023,” and “[w]hen a plaintiff ‘provides no additional factual
information tying her actual activities to the allegations made by the hypothetical purportedly
demonstrating disclosure of Private Information,’ dismissal must result.” Dkt. 98 at 18 (quoting
Nienaber v. Overlake Hosp. Med. Ctr., 733 F. Supp. 3d 1072, 1083–84 (W.D. Wash. 2024)).
Specifically, Nebula highlights that Portillo alleges each technology was installed “[a]t an
Case 1:25-cv-12288-BEM Document 114 Filed 03/10/26 Page 6 of 8

7
unknown date” and that Portillo fails to make allegations about the functionality of the website or
third-party software when she was using the website. Id.; see also Compl. ¶¶ 47, 57, 71. 4
That technology in use in October 2024 was also in use for some period of time between
2021 and 2023 is a reasonable inference the Court is permitted to make at this stage, before Portillo
has had the benefit of discovery. See Jorge v. Galarza-Soto, 124 F. Supp. 3d 57, 64 (D.P.R. 2015)
(Plausibility “‘simply calls for enough facts to raise a reasonable expectation that discovery will
reveal evidence of’ the necessary element.” (quoting Bell Atl. Corp. v. Twombley, 550 U.S. 544,
556 (2007))).
C. 	Failure to State a Claim
Nebula argues, further, that Portillo failed to allege that protected “genetic information”
was transmitted by Nebula’s website and therefore failed to state a claim upon which relief can be
granted under GIPA. Dkt. 98 at 20. GIPA defines “genetic information” to include, as relevant
here, an “individual’s genetic tests” and “[a]ny request for, or receipt of, genetic services,” and
defines “genetic services” as “(1) [a] genetic test; (2) [g]enetic counseling (including obtaining,
interpreting, or assessing genetic information); or (3) [g]enetic education.” 410 Ill. Comp. Stat.
513/10.
Nebula contends that, assuming arguendo that the website operated from 2021 to 2023 the
same way that it operates today, the Complaint only alleges that information related to Portillo’s
creating an account and registering for and purchasing a kit was transmitted to third parties, not
information about the test results themselves. Therefore, Nebula argues, no “genetic information”
was disclosed in violation of GIPA.
4 The Complaint relies on descriptions of the relevant third-party software and analytics taken from their
websites as of October 2024. See, e.g., Compl. ¶¶ 33 n.11, 40 n.14, 41 n.15, 44 n.16.
Case 1:25-cv-12288-BEM Document 114 Filed 03/10/26 Page 7 of 8

8
Information about genetic test results themselves is only alleged to have been disclosed to
Microsoft via Microsoft Clarity:
[F]or Nebula users such as Plaintiff and Class Members who have uploaded their
DNA test kit results to Nebula, Nebula offers a complimentary report on different
genetic traits associated with their genome sequence. 	Customers can access this
report by clicking on the “Reporting” option, and selecting “Traits,” to view
different insights on various topics such as “Appearance & Hormones,” “Behavior
& Perception,” “Body & Athleticism,” and “Nutrition & Diet.” When a user enters
the “Traits” webpage, an HTTP session is sent to Microsoft via Clarity sharing the
customer’s test results. 	This session includes the user’s specific [Microsoft user
ID], as well as his or her genetic information such as, for example, the user’s
likelihood to have a certain skin pigmentation, hair thickness, or testosterone level.
Compl. ¶¶ 73–74 (emphasis added). 	Though this is presented as a hypothetical, the Complaint
includes additional factual allegations regarding Portillo’s use of features on Nebula’s website,
specifically that she “requested a report on Nebula’s analysis of her genetic test, which she then
reviewed.” Id. ¶ 98. As discussed above, the Court is permitted to make the reasonable inference
that the “report on Nebula’s analysis of [Portillo’s] genetic test” is the same “report on different
genetic traits associated with their genome sequence” alleged to be transmitted Microsoft via the
“Traits” webpage on the Nebula website. 	Portier, 2019 WL 7946103, at *3. 	Because the
information contained in the report doubtless constitutes “genetic information” as defined by
GIPA, the Court need not consider whether information about creating an account or registering
for and purchasing a kit is itself “genetic information” protected by the statute. 	Accordingly,
Portillo has stated a claim upon which relief can be granted under GIPA.
IV. 	Conclusion
For the foregoing reasons, Nebula’s motion to dismiss is DENIED.
So Ordered.
/s/ Brian E. Murphy
Brian E. Murphy
Dated: March 10, 2026 	Judge, United States District Court
Case 1:25-cv-12288-BEM Document 114 Filed 03/10/26 Page 8 of 8