US healthcare marketplaces shared citizenship and race data with ad tech giants

Nearly all U.S. state health insurance marketplaces inadvertently shared sensitive personal data—including citizenship status, race, and family incarceration details—with major ad tech companies through misconfigured tracking pixels, affecting over seven million Americans and exposing critical gaps in data governance practices. This breach highlights systemic risks in how government and healthcare organizations manage third-party integrations and underscores the urgent need for IT leaders to audit tracking technologies, enforce strict data handling policies, and implement technical controls to prevent sensitive information leakage to external vendors. The incident carries significant regulatory, reputational, and compliance risks, particularly as healthcare privacy regulations tighten and government agencies face increased scrutiny over citizen data protection.