Blue Shield of California shared private health data of 4.7 million members with Google without consent

A hot potato: Health insurance provider Blue Shield of California is notifying customers that it had been sharing the private health information of up to 4.7 million members with Google's analytics and advertising platforms for three years without their knowledge or consent. A wide range of data was exposed, and it may have been used by Google for targeted ad purposes.

Blue Shield of California wrote on its website that it has begun notifying certain members of a potential data breach that may have included elements of their protected health information.

The issue stems from Blue Shield using Google Analytics to internally track website usage of members who entered certain Blue Shield sites.

On February 11, 2025, Blue Shield discovered that, between April 2021 and January 2024, a misconfiguration of Google Analytics on certain Blue Shield sites allowed members' sensitive health data to be shared with Google Ads ...