Changes to HealthCare.gov now limit personal data shared with tracking websites
Associated Press :
Context & Ripple Effects
This fix is a direct response to the Electronic Frontier Foundation's January 21 finding that HealthCare.gov was sending personal data to dozens of tracking websites — the administration moved within days of the disclosure rather than waiting for a regulatory push. The episode matters because the federal exchange is not an outlier: it is one instance of a recurring pattern across government-run insurance portals.
That pattern keeps resurfacing in the corpus. A 2018 breach of a system interacting with HealthCare.gov compromised sensitive data for roughly 75,000 people, the 2020 rules letting patients route healthcare data to third-party apps drew criticism over weak safeguards (rules criticized for lacking data protections), and a 2025 investigation found state exchanges in Nevada, Maine, Massachusetts, and Rhode Island still sharing sensitive data via web trackers.
First-order effects
- Tracking companies that were receiving HealthCare.gov visitors' personal data lose that flow at the source, and the agency running the exchange shifts its default from open data sharing to restriction.
Second-order effects
- Public scrutiny now has a template: the same reporting method that caught HealthCare.gov is what later surfaced trackers on four state exchanges sharing data with Google, LinkedIn, and Snap, putting those states under equivalent pressure to make matching changes.
Third-order effects
- If the pattern holds, government health portals will be pushed toward privacy-by-default architecture while data access simultaneously expands outward through third-party apps — a widening gap between who can take the data out and how well it is protected once it leaves.
The trend: Government-run health data systems are being forced from reactive privacy fixes toward structural safeguards as each new disclosure — trackers, breaches, third-party app rules — exposes the next layer.