{"id":70988,"date":"2025-05-13T18:51:17","date_gmt":"2025-05-13T22:51:17","guid":{"rendered":"https:\/\/statescoop.com\/?p=70988"},"modified":"2025-05-13T18:51:20","modified_gmt":"2025-05-13T22:51:20","slug":"california-sent-residents-personal-health-data-linkedin","status":"publish","type":"post","link":"https:\/\/statescoop.com\/california-sent-residents-personal-health-data-linkedin\/","title":{"rendered":"How California sent residents\u2019 personal health data to LinkedIn"},"content":{"rendered":"\n
\"Originally<\/a><\/figure>\n\n\n\n

The website that lets Californians shop for health insurance under the Affordable Care Act, coveredca.com, has been sending sensitive data to LinkedIn, forensic testing by The Markup has revealed.<\/p>\n\n\n\n

As visitors filled out forms on the website, trackers on the same pages told LinkedIn their answers to questions about whether they were blind, pregnant, or used a high number of prescription medications. The trackers also monitored whether the visitors said they were transgender or possible victims of domestic abuse.<\/p>\n\n\n\n

Covered California, the organization that operates the website, removed the trackers as The Markup and CalMatters reported this article. The organization said they were removed \u201cdue to a marketing agency transition\u201d in early April.<\/p>\n\n\n\n

In a statement, Kelly Donohue, a spokesperson for the agency, confirmed that data was sent to LinkedIn as part of an advertising campaign. Since  being informed of the tracking, \u201call active advertising-related tags across our website have been turned off out of an abundance of caution,\u201d she added.<\/p>\n\n\n\n

\u201cCovered California has initiated a review of our websites and information security and privacy protocols to ensure that no analytics tools are impermissibly sharing sensitive consumer information,\u201d Donohue said, adding that they would \u201cshare additional findings as they become available, taking any necessary steps to safeguard the security and privacy of consumer data.\u201d<\/p>\n\n\n\n

Visitors who filled out health information on the site may have had their data tracked for more than a year, according to Donohue, who said the LinkedIn campaign began in February 2024.<\/p>\n\n\n\n

The Markup observed the trackers directly in February and March of this year. It confirmed most ad trackers, including the Meta \u201cpixel\u201d tracker, as well as all third-party cookies, have been removed from the site as of April 21.<\/p>\n\n\n\n

Since 2014, more than 50 million Americans have signed up<\/a> for health insurance through state exchanges like Covered California. They were set up under the Affordable Care Act<\/a>, signed into law by President Barack Obama 15 years ago. States can either operate their exchange websites in partnership with the federal government or independently, as California does<\/a>.<\/p>\n\n\n\n

Covered California operates as an independent entity within the state government. Its board<\/a> is appointed by the governor and Legislature.<\/p>\n\n\n\n

In March, Covered California announced<\/a> that, after four years of increasing enrollment, a record of nearly 2 million people were covered by health insurance through the program. In all, the organization said, about one in six Californians were at one point enrolled through Covered California. Between 2014 and 2023, the uninsured rate fell from 17.2% to 6.4%, according to the organization, the largest drop of any state during that time period. This coincided with a series of eligibility <\/a>expansions to Medi-Cal<\/a>, the state\u2019s health insurance program for lower-income households.<\/p>\n\n\n\n

Experts expressed alarm at the idea that those millions of people could have had sensitive health data sent to a private company without their knowledge or consent. Sara Geoghegan, senior counsel at the Electronic Privacy Information Center, said it was \u201cconcerning and invasive\u201d for a health insurance website to be sending data that was \u201cwholly irrelevant\u201d to the uses of a for-profit company like LinkedIn.<\/p>\n\n\n\n

\u201cIt\u2019s unfortunate,\u201d she said, \u201cbecause people don’t expect that their health information will be collected and used in this way.\u201d<\/p>\n\n\n\n

The LinkedIn Insight Tag<\/h3>\n\n\n\n

The Markup and CalMatters in recent months scanned for trackers on hundreds of California state and county government websites that offer services for undocumented immigrants using Blacklight<\/a>, an automated tool developed by The Markup for auditing website trackers.<\/p>\n\n\n\n

The Markup found that Covered California had more than 60 trackers on its site. Out of more than 200 of the government sites, the average number of trackers on the sites was three. Covered California had dozens more than any other website we examined.<\/p>\n\n\n\n

On coveredca.com, trackers from well-known social media firms like Meta collected information on visitor page views, while lesser-known analytics and media campaign companies like email marketing company LiveIntent also followed users across the site.<\/p>\n\n\n\n

But by far the most sensitive information was transmitted to LinkedIn.<\/p>\n\n\n\n

While some of the data sent to LinkedIn was relatively innocuous, such as what pages were visited, Covered California also sent the company detailed information when visitors selected doctors to see if they were covered by a plan, including their specialization. The site also told LinkedIn if someone searched for a specific hospital.<\/p>\n\n\n\n

In addition to demographic information including gender, the site also shared details with LinkedIn when visitors selected their ethnicity and marital status, and when they told coveredca.com how often they saw doctors for surgery or outpatient treatment.<\/p>\n\n\n\n

LinkedIn, like other large social media firms, offers a way for websites to easily transmit data on their visitors through a tracking tool that the sites can place on their pages. In LinkedIn\u2019s case, this tool is called the Insight Tag<\/a>. By using the tag, businesses and other organizations can later target advertisements<\/a> on LinkedIn to consumers that have already shown interest in their products or services. For an e-commerce site, a tracker on a page might be able to note when someone added a product to their cart, and the business can then send ads for that product to the same person on their social media feeds.<\/p>\n\n\n\n

A health care marketplace like Covered California might use the trackers to reach a group of people who might be interested in a reminder of a deadline for open health insurance enrollment, for example.<\/p>\n\n\n\n

In its statement, Covered California noted the usefulness of these tools, saying the organization \u201cleverages LinkedIn\u2019s advertising platform tools to understand consumer behavior and deliver tailored messages to help them make informed decisions about their health care options.\u201d<\/p>\n\n\n\n

Trackers can also be valuable to the social media companies that offer them. In addition to driving ad sales, they provide an opportunity to gather information on visitors to websites other than their own.<\/p>\n\n\n\n

On its informational page<\/a> about the Insight Tag, LinkedIn places the burden on websites that employ the tag not to use it in risky situations. The tag \u201cshould not be installed on web pages that collect or contain Sensitive Data,\u201d the page advises, including \u201cpages offering specific health-related or financial services or products to consumers.\u201d<\/p>\n\n\n\n

LinkedIn spokesperson Brionna Ruff said in an emailed statement, \u201cOur Ads Agreement and documentation expressly prohibit customers from installing the Insight Tag on web pages that collect or contain sensitive data, including pages offering health-related services. We don\u2019t allow advertisers to target ads based on sensitive data or categories.\u201d<\/p>\n\n\n\n