FTC moves to ban BetterHelp from sharing mental health data for ad targeting

The Federal Trade Commission has moved to block online counseling company BetterHelp from sharing health data, including mental health information, with the likes of Facebook and Snapchat for advertising. As part of a proposed order, BetterHelp has agreed to pay $7.8 million to consumers to settle charges that it shared sensitive data for advertising purposes after promising to keep the information private.

This marks the first time the agency has reached an agreement with a company to return money to consumers after their health data was allegedly compromised. The order will be subject to public comment for 30 days before the agency decides whether to finalize it.

If the order comes into effect, it will ban BetterHelp from sharing data from users (including those who accessed the company's website or app without signing up for its services) with select third parties for ad targeting. The FTC alleges that between 2017 and 2020, BetterHelp shared users' email addresses, IPs and health questionnaire responses with Facebook, Snapchat, Criteo and Pinterest. The agency said this allowed Facebook, for instance, to target similar users with BetterHelp ads, which helped to drive tens of thousands of paid users and millions of dollars in revenue to the counseling company.

The FTC claims BetterHelp didn't receive explicit consent from users before sharing their health data, which it pledged to keep private except for limited uses, such as counseling purposes. In its complaint (PDF), the agency also accused BetterHelp of not limiting the scope of how third-party companies could use the health data it shared with them.

"When a person struggling with mental health issues reaches out for help, they do so in a moment of vulnerability and with an expectation that professional counseling services will protect their privacy,” FTC Bureau of Consumer Protection director Samuel Levine said in a statement. "Instead, BetterHelp betrayed consumers’ most personal health information for profit. Let this proposed order be a stout reminder that the FTC will prioritize defending Americans’ sensitive data from illegal exploitation."

The proposed order, which FTC commissioners approved unanimously, will require BetterHelp to, among other things, obtain explicit consent from users before sharing their data with some third parties for any reason. The company will need to establish privacy protocols to protect user data and delete personal and health information after a certain period of time. Moreover, BetterHelp will have to instruct the companies it allegedly shared user health and personal data with to wipe such information from their servers.

Here's BetterHelp's statement in full:

We are deeply committed to the privacy of our members and we value the trust people put in us by using our services. Our technology, policies and procedures are designed to protect and secure our members' information so it is not used or shared without their approval and consent.

BetterHelp and the FTC have reached a settlement in regard to BetterHelp's advertising practices that were in effect between 2017 to 2020. The FTC alleged we used limited, encrypted information to optimize the effectiveness of our advertising campaigns so we could deliver more relevant ads and reach people who may be interested in our services. This industry-standard practice is routinely used by some of the largest health providers, health systems and healthcare brands. Nonetheless, we understand the FTC's desire to set new precedents around consumer marketing, and we are happy to settle this matter with the agency. This settlement, which is no admission of wrongdoing, allows us to continue to focus on our mission to help millions of people around the world get access to quality therapy.

To clarify, we do not share and have never shared with advertisers, publishers, social media platforms or any other similar third parties, private information such as members' names or clinical data from therapy sessions. In addition, we do not receive and have never received any payment from any third party for any kind of information about any of our members.

As part of our ongoing investment in privacy, betterhelp.com has recently been certified by HITRUST. This certification is the industry-recognized gold standard for providing the highest level of information protection and compliance assurance because of the comprehensiveness of control requirements, depth of quality review and consistency of oversight. In cooperation with the FTC, we will continue to make industry-leading investments in safeguarding the privacy of our members.

Update 3:27PM ET: Added BetterHelp's statement.