Cybersecurity Policy Report, D. Mass.: Genetic privacy class action over Nebula Genomics web tracking may proceed, (Mar 13, 2026)

By Steven Melendez

A customer alleges the company sent genetic information to third-parties via web usage trackers, violating the Illinois Genetic Information Privacy Act.

A Massachusetts federal judge denied a motion to dismiss a class action against Nebula Genomics, Inc., finding a customer had sufficiently alleged violations of the Illinois Genetic Information Privacy Act (GIPA). The court also ruled a choice-of-law contract provision doesn’t prevent a lawsuit under the Illinois law (Portillo v. Nebula Genomics, Inc., No. 25-12288-BEM (D. Mass Mar. 10, 2026)).

Background. Nebula offers DNA testing and analysis, billing its services as “Privacy First DNA Testing.” But, a customer alleges, the company shares customer information with Meta, Microsoft, and Google through analytics and advertising tools known as the Facebook Pixel, Microsoft Conversion Tracking, Microsoft Clarity, Google Analytics, and Google Tag Manager.

The customer created an account on Nebula’s website around March 2021 and subsequently purchased and took a genetic test from the company. She then requested and viewed a report analyzing the test results and “regularly accessed the Nebula app” to review test-related information, according to the ruling. She alleges that as she accessed and reviewed the test analysis, Nebula shared with Meta, Microsoft, and Google that she had taken the test and specific information about her genetics.

She cancelled her Nebula account after renewing it in July 2021 and July 2022. And on October 10, 2024, she filed a class-action complaint in the U.S. District Court for the Northern District of Illinois, alleging violation of GIPA against Nebula and unjust enrichment against Meta, Facebook, and Google. On July 24, 2025, an Illinois federal judge dismissed the tech companies from the case and transferred the case to the District of Massachusetts.

Nebula moved to dismiss the GIPA claim—the sole remaining claim in the case—under Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6) on November 17, 2025.

Choice of law. Nebula argues that due to the Massachusetts choice of law provision in its terms of use, the customer cannot make a claim under Illinois GIPA.

“The First Circuit and Massachusetts Supreme Judicial Court have construed comparable provisions narrowly, such that the provision governs only the agreement itself, but does not preclude pursuing contract-adjacent claims under the law of another state,” according to the ruling. Here, because the “narrow choice of law provision at issue does not purport to govern the parties’ rights or obligations more broadly,” the court found the provision doesn’t bar the GIPA claim.

Standing. Nebula also argued that the customer lacks standing under FRCP 12(b)(1), having failed to allege an actionable injury. Her complaint, Nebula argues, makes claims about the current state of the Nebula website but doesn’t “purport to describe” what it was like from 2021 through 2023, including the presence of the third-party tracking code, when she had a Nebula account.

But the court ruled that it’s a “reasonable inference” to make before discovery takes place that technology that was in use in October 2024 was also in use at some point between 2021 and 2023.

Stating a claim. Nebula also argued the customer failed to state a valid claim that “genetic information” was transmitted by its website. Even assuming the website then operated how it does today, only information about the customer “creating an account and registering for and purchasing a kit was transmitted to third parties, not information about the test results themselves,” the company argued.

But, the court found, the customer alleges information from a report is transmitted to Microsoft through use of the site, and this report constitutes genetic information, so the court “need not consider whether information about creating an account or registering for and purchasing a kit is itself ‘genetic information’ protected by the statute.”

The case is No. 25-12288-BEM.

Judge: Murphy, B.

Attorneys: Jonathan Loevy (Loevy & Loevy) for Antoinette Portillo. Blake James Kolesa (Riley Safer Holmes & Cancila LLP) for Nebula Genomics, Inc.

Companies: Nebula Genomics, Inc.

Cases: CaseDecisions StateLegislationNews CyberPrivacyFeed EHRNews GeneralNews HITNews DataPrivacy MassachusettsNews DataSecurity