US Health Marketplaces Paused Data Sharing After Ad Tech Leak

Data Sharing Halt

Health insurance marketplaces in Virginia and Washington, D.C. have paused the collection and sharing of user data. The decision follows an investigation by Bloomberg which found that these government-run marketplaces were sharing sensitive user information with advertisers.

According to reports, the data being shared included highly personal details regarding the race and citizenship status of users. The pause in data operations comes as a direct response to the findings that this information was being transmitted to ad tech giants.

Legal and Regulatory Context

While specific legal filings for the Virginia and D.C. cases have not been detailed, the broader landscape of healthcare web tracking is facing increased scrutiny. Legal experts have noted that companies falling outside the perimeter of the Health Insurance Portability and Accountability Act (HIPAA)—including data brokers and digital health platforms—may be exposed to claims under the Electronic Communications Privacy Act (ECPA) and similar state laws.

To mitigate such exposure, some legal guidance suggests the most conservative approach is to disable third-party tracking technologies entirely, particularly on authenticated pages or those that are patient-facing, such as provider search or appointment booking tools. This is intended to stop the contested data flows that have driven recent privacy litigation.

Broader Privacy Trends in Ad Tech

The sharing of sensitive data by healthcare marketplaces occurs amid a wider trend of ad tech companies facing judicial scrutiny over online profiling. In a separate case, a federal judge in the Northern District of California ruled that users can proceed with privacy-related claims against the ad tech company PubMatic. U.S. District Judge Susan Illston stated that the plaintiffs had adequately alleged a "highly offensive" intrusion of privacy that violated a reasonable internet user's expectation of privacy.

Simultaneously, other major tech platforms are formalizing their advertising infrastructures. OpenAI updated its U.S. privacy policy on April 30, which now includes explicit language regarding the receipt of purchase data from advertisers and the sharing of user information with marketing partners for third-party ad targeting.

Impact on Vulnerable Populations

The exposure of citizenship and race data is particularly sensitive given the concerns of immigrant populations regarding data privacy. Research indicates that 51 percent of immigrant adults overall, and approximately 78 percent of those likely to be undocumented, express concern that healthcare professionals may share their information with immigration enforcement officials.

Furthermore, racial gaps in healthcare access remain a significant issue. In Iowa, reports indicate that changes to the Affordable Care Act (ACA) marketplaces and new restrictions affecting asylees and immigrants are eroding access to care, with disproportionate impacts on Black, Hispanic, and American Indian and Alaska Native communities.