State Health Insurance Marketplaces Shared Citizenship and Race Data with Ad Tech Companies

May 4, 2026

A Bloomberg investigation revealed that nearly all of the 20 state-run health insurance exchange websites embedded ad trackers that shared sensitive personal information including citizenship, race, sex, and ZIP codes with tech companies like Meta, TikTok, Google, Snap, and LinkedIn. States including Washington, Virginia, New York, New Mexico, Maryland, and Rhode Island transmitted user data through these trackers, which were intended to improve marketing targeting on social platforms. Virginia and several other states removed the trackers only after Bloomberg contacted them for comment, with officials claiming they did not fully understand what data was being transmitted. The data sharing occurred despite tech companies' terms of service prohibiting such sensitive information, and in the absence of comprehensive federal privacy law, leaving responsibility unclear between state governments and platforms.

Personal Data Shared Through State Health Insurance Website Trackers

▪New York's health insurance exchange tracks what pages visitors view and sends activity about incarcerated family member details to tech platforms when users click through to enter such information.
▪Virginia's health insurance exchange exposed ZIP codes to Meta through embedded trackers.
▪Washington State's health insurance exchange shared information about sex, citizenship, and race through embedded trackers.
▪State-run health insurance exchange websites in Washington State, Virginia, New York, New Mexico, Maryland, and Rhode Island embedded trackers that sent personal information to TikTok, Meta, Snap, LinkedIn, and Google.
▪Almost all of the 20 state-run health insurance exchange websites embedded trackers that sent personal information to tech companies.
▪California removed trackers from its state health insurance exchange website before Bloomberg's review.
▪Healthcare.gov, which is used by 30 states, does not embed the specific trackers found on state-run health insurance exchange websites.

How and Why the Data Sharing Occurred

▪The TikTok tracker on Washington State's health exchange stripped out broader racial categories but left specific ethnicity details in the data sent.
▪Several states removed trackers from their health insurance exchange websites only after Bloomberg contacted them for comment.
▪A cybersecurity expert described the process for filtering unwanted information from trackers as flawed and brittle.
▪State health insurance exchange websites did not fully understand all the information being sent through embedded trackers.
▪Keyword filters used by some trackers to block sensitive data from reaching tech platforms do not always catch everything.
▪A Virginia spokesperson stated that ZIP codes were not personally identifiable information, though the tracker exposing ZIP codes was later removed.
▪State health insurance exchange websites embedded trackers to better target their marketing on platforms like Facebook and TikTok.

Accountability and Regulatory Gaps

▪There is no federal privacy law in the United States to protect consumers from data sharing by state health insurance exchange websites.
▪Hospital websites deploying similar trackers dropped from 98% in 2021 to 30% in 2025 due to the threat of costly litigation.
▪State privacy laws in the United States are patchwork with varying standards for what counts as sensitive data.
▪Tech companies stated that their terms of service prohibit advertisers from sharing sensitive information with them, pointing responsibility at state governments instead.

Perspective of State health insurance exchanges

▪State health insurance exchange websites did not fully understand all the information being sent through embedded trackers.
▪State health insurance exchange websites embedded trackers to better target their marketing on platforms like Facebook and TikTok.

Perspective of Tech companies (Meta, TikTok, Google, Snap, LinkedIn)

▪Tech companies stated that their terms of service prohibit advertisers from sharing sensitive information with them, pointing responsibility at state governments instead.

Perspective of Privacy advocates and cybersecurity experts

▪A cybersecurity expert described the process for filtering unwanted information from trackers as flawed and brittle.
▪There is no federal privacy law in the United States to protect consumers from data sharing by state health insurance exchange websites.
▪Keyword filters used by some trackers to block sensitive data from reaching tech platforms do not always catch everything.