Investigation: health care exchanges in Nevada, Maine, Massachusetts, and Rhode Island share sensitive data with Google, LinkedIn, and Snap via web trackers
But trackers we found logged details like one's operating system, browser, device, and times of visit. themarkup.org/pixel-hunt/2... Mastodon: Ashe Dryden / @Ashedryden@xoxo.zone : The data, including prescription drug names and dosages, was sent by web trackers on state exchanges set up under the Affordable Care Act to help Americans purchase health coverage. — https://themarkup.org/... @themarkup@mastodon.themarkup.org : State healthcare sites have been quietly sending sensitive user data to Google and LinkedIn. — We scanned the websites of states that independently operate their own online health exchange, and found four states — Nevada, Maine, Rhode Island, and Massachusetts — exposed users' sensitive health info. …
Context & Ripple Effects
This finding extends a long-running pattern: HealthCare.gov’s use of numerous tracking sites was documented in 2015, and a 2022 analysis found hospital sites transmitting prescription and condition details through Meta Pixel. The issue is not simply whether a site uses analytics, but whether health-enrollment activity crosses a meaningful permission boundary.
The state-exchange cases matter because enrollment portals handle information tied to coverage decisions and medication needs. Subsequent reporting that trackers appeared across nearly 20 state-run exchanges suggests this is a broader implementation and oversight problem, not an isolated web configuration.
First-order effects
- Nevada, Maine, Massachusetts, and Rhode Island must assess the tracker integrations on their exchanges and the scope of user information exposed to Google, LinkedIn, and Snap.
- The named platforms face renewed scrutiny over data received through third-party tags, including data connected to prescription names, dosages, devices, and visit timing.
Second-order effects
- Exchange operators and their vendors may need to inventory tags, limit third-party scripts, and change analytics or advertising workflows that place trackers on enrollment journeys.
- The findings raise the compliance and reputational cost of using general-purpose ad-tech tooling in health contexts, increasing pressure on platforms to police sensitive-data collection from customer sites.
Third-order effects
- If similar findings continue, health-sector digital services will move toward stricter separation between essential site measurement and advertising-tracker infrastructure—a durable state-exchange tracker pattern rather than a one-off flaw.
- The central governance question will increasingly be whether organizations can prove that consent, data minimization, and vendor controls match the sensitivity of the service, rather than merely relying on third-party tracking defaults.
The trend: Health-related websites are being pushed to replace broad ad-tech data flows with more tightly governed, purpose-limited measurement practices.