The Markup reports that after California's health insurance exchange transmitted pregnancy and domestic abuse data during a marketing campaign, the exchange is reviewing its website practices.
How one state sent residents' personal health data to LinkedIn
The website that lets Californians shop for health insurance under the Affordable Care Act, coveredca.com, has been sending sensitive data to LinkedIn, forensic testing by The Markup has revealed.
As visitors filled out forms on the website, trackers on the same pages told LinkedIn their answers to questions about whether they were blind, pregnant, or used a high number of prescription medications. The trackers also monitored whether the visitors said they were transgender or possible victims of domestic abuse.
Covered California, the organization that operates the website, removed the trackers as The Markup and CalMatters reported this article. The organization said they were removed "due to a marketing agency transition" in early April.
In a statement, Kelly Donohue, a spokesperson for the agency, confirmed that data was sent to LinkedIn as part of an advertising campaign. Since being informed of the tracking, "all active advertising-related tags across our website have been turned off out of an abundance of caution," she added.
"Covered California has initiated a review of our websites and information security and privacy protocols to ensure that no analytics tools are impermissibly sharing sensitive consumer information," Donohue said, adding that they would "share additional findings as they become available, taking any necessary steps to safeguard the security and privacy of consumer data."
Visitors who filled out health information on the site may have had their data tracked for more than a year, according to Donohue, who said the LinkedIn campaign began in February 2024.
The Markup observed the trackers directly in February and March of this year. It confirmed most ad trackers, including the Meta "pixel" tracker, as well as all third-party cookies, have been removed from the site as of April 21.
Since 2014, more than 50 million Americans have signed up for health insurance through state exchanges like Covered California. They were set up under the Affordable Care Act, signed into law by President Barack Obama 15 years ago. States can either operate their exchange websites in partnership with the federal government or independently, as California does.
Covered California operates as an independent entity within the state government. Its board is appointed by the governor and Legislature.
In March, Covered California announced that, after four years of increasing enrollment, a record of nearly 2 million people were covered by health insurance through the program. In all, the organization said, about one in six Californians were at one point enrolled through Covered California. Between 2014 and 2023, the uninsured rate fell from 17.2% to 6.4%, according to the organization, the largest drop of any state during that time period. This coincided with a series of eligibility expansions to Medi-Cal, the state's health insurance program for lower-income households.
Experts expressed alarm at the idea that those millions of people could have had sensitive health data sent to a private company without their knowledge or consent. Sara Geoghegan, senior counsel at the Electronic Privacy Information Center, said it was "concerning and invasive" for a health insurance website to be sending data that was "wholly irrelevant" to the uses of a for-profit company like LinkedIn.
"It's unfortunate," she said, "because people don't expect that their health information will be collected and used in this way."
It promises greater convenience, but digital privacy advocates are skeptical that patients' sensitive personal data will be stored securely.
