The original Bloomberg article is quite informative.

California was the only state in Bloomberg’s review that did not use advertising trackers, having removed them last year after being informed of the security risk by nonprofit news organizations CalMatters and The Markup. A separate Markup analysis of 19 state sites last year also flagged data exposures in several states that later changed some of their settings.

According to Edwards, one reason so many websites continue to share sensitive user data is that website operators deploy tracking tools without fully understanding how they work. “The onus is on them to do it safely,” he said. “You can’t protect something that you don’t understand.”

If anyone has looked into Google ads at all, the first thing they try to get you to do is install a bunch of trackers on your website. In order to do that you have to check a box that says you have a privacy policy which discloses certain information. If you try to tell them you do not have that and do not want to do tracking they will outright lie about what they are getting you to do. They tell you to just check the box and that it doesn't matter and then will tell you that it doesn't track anything. One would hope that the people doing these sites for the government would know better, but they may also just not care. They may just be using a standard SEO suite and no one bothered to mention that maybe they shouldn't on either the government side or the company side.