Blue Shield Exposed Health Data of 4.7 Million via Google Ads

Blue Shield of California has disclosed a significant data privacy incident affecting up to 4.7 million members, after discovering that protected health information (PHI) may have been inadvertently shared with Google Ads over nearly three years.

The healthcare provider is now alerting potentially impacted members and implementing new safeguards to prevent future breaches.

The breach centers on the use of Google Analytics—a common website tracking tool—on certain Blue Shield web portals.

On February 11, 2025, Blue Shield determined that, between April 2021 and January 2024, Google Analytics was configured in a way that allowed member data to be transmitted to Google’s advertising platform, Google Ads.

While intended to improve online services, this configuration error meant that sensitive data could have been used by Google to target advertisements to members.

Blue Shield emphasizes that there is no evidence of the involvement of a malicious actor.

According to ...