US state health exchanges leak sensitive data to ad tech via pixel trackers
A Bloomberg investigation found that nearly all 20 U.S. state health insurance exchanges embedded pixel trackers that transmitted over 7 million Americans' sensitive data—including citizenship status, race, prescriptions, and ZIP codes—to advertising companies like Meta, Google, TikTok, and others. Several states paused or removed the tracking tools after exposure.
What happened
Nearly all 20 U.S. state health exchanges embedded pixel trackers designed for e-commerce analytics that transmitted sensitive personal data to advertising companies including Meta, Google, TikTok, Snapchat, and LinkedIn.
Washington D.C.'s site sent race, sex, and contact details to TikTok's pixel tracker before pausing. New York's exchange shared whether applicants had incarcerated family members. Virginia sent residents' ZIP codes to Meta. Nevada leaked prescription names and dosages to LinkedIn and Snapchat. Maryland's pages on coverage for noncitizen pregnant women and DACA recipients alerted LinkedIn, Snapchat, Google, and Meta. Rhode Island's Medicaid sections reached Google, Meta, and Nextdoor.
Reported impact
Over 7 million Americans who bought insurance through state exchanges in 2026 had their citizenship status, race, prescriptions, ZIP codes, and other sensitive details harvested by advertising companies.
Bloomberg's tests linked visits across ten states to a reporter's Facebook profile, resulting in targeted ads.
Index analysis
Pixel trackers, which use invisible tracking code snippets to follow clicks and form submissions, were designed for shopping sites but inadvertently collected government healthcare enrollment data. Cybersecurity expert Zach Edwards described it as 'a flawed and brittle process' with responsibility on states to use the tools safely.
Governance controls
Several states paused or removed tracking tools after exposure: Washington paused its TikTok pixel, Virginia yanked Meta's tracker, New Mexico ditched its tracker, and D.C. paused its TikTok integration entirely. Meta, TikTok, LinkedIn, Snap, and Google stated they prohibit sensitive health or personal data in their tracking tools.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.