$7.8 Million: The BetterHelp Settlement Over Sharing Therapy Patients' Data

Online counseling platform BetterHelp, Inc. agreed to pay $7.8 million to settle Federal Trade Commission charges announced March 2, 2023, that the company shared consumers' sensitive health information, including details revealed during its intake questionnaire, with third-party advertising platforms despite repeated promises that the data would remain private and confidential.DOCUMENTED

The settlement, structured as a proposed federal court order, followed a similar FTC action against digital health company GoodRx just weeks earlier, and marked the first time the agency had returned funds directly to consumers whose health data was compromised through a Section 5 enforcement action.DOCUMENTED

What the intake questionnaire collected

According to the FTC's complaint, BetterHelp requires new users to complete a detailed intake questionnaire before being matched with a therapist, asking about topics including whether the user has previously received mental health treatment, their current emotional state, and other sensitive information directly relevant to their mental health history and current condition.DOCUMENTED

The complaint alleges that despite explicit assurances that this information was confidential and would only be used to facilitate BetterHelp's own therapy-matching service, the company used consumers' email addresses and health-questionnaire responses to create custom audiences on Facebook and other advertising platforms, effectively telling those platforms which users had expressed interest in mental health treatment so that BetterHelp's own ads could be more precisely targeted at them.DOCUMENTED

Beyond Facebook: Snapchat, Pinterest, and Criteo

The FTC's complaint identifies BetterHelp's data-sharing practices as extending beyond Facebook to include Snapchat, Pinterest, and the advertising technology company Criteo, each of which allegedly received some combination of consumers' email addresses, IP addresses, and information revealed during the health intake process, despite BetterHelp's assurances on its website that such information would remain private and would not be shared with, or used to advertise through, outside companies.DOCUMENTED

The complaint also alleges that BetterHelp overstated its compliance with health-privacy standards, specifically alleging the company misrepresented that its practices were consistent with recognized standards for handling protected health information, such as HIPAA-style safeguards, when BetterHelp is not itself a covered entity under HIPAA and its actual data practices did not match those representations.DOCUMENTED

The FTC's rationale

"Let's be very clear: mental health information is exceptionally sensitive and can be used to stigmatize or discriminate against people," the FTC stated in materials accompanying the settlement announcement. "BetterHelp's data practices demonstrate a clear failure to honor its promises and consumers' trust." Samuel Levine, then Director of the FTC's Bureau of Consumer Protection, added that the case sent a message to all health apps handling sensitive data: promises of privacy and confidentiality carry legal weight, and can result in a Section 5 enforcement action when a company's actual data-sharing practices fall short.DOCUMENTED

How BetterHelp responded

BetterHelp did not admit wrongdoing as part of the settlement.DOCUMENTED

Part of a broader health-privacy enforcement wave

The BetterHelp settlement followed the FTC's February 2023 action against GoodRx, which paid a $1.5 million civil penalty and was permanently barred from sharing user health data with advertisers after the agency alleged the prescription discount platform had shared similar categories of health information with Facebook and Google despite comparable privacy promises. Legal commentary at the time described the two settlements as providing a joint roadmap for how the FTC intends to police health data practices at companies not covered by HIPAA, using both Section 5 of the FTC Act and the agency's Health Breach Notification Rule as enforcement tools.REVIEWED

Taken together, the BetterHelp and GoodRx cases mark a turning point in how the FTC treats sensitive health data collected outside the traditional, HIPAA-regulated health care system: apps and websites that ask consumers detailed health questions, even when operating entirely outside a hospital or insurance context, are now understood to face direct FTC liability if their advertising and data-sharing practices diverge from what they've told consumers.

The BetterHelp case also highlights a broader vulnerability specific to mental health and telehealth platforms that fall outside HIPAA's traditional coverage: because HIPAA generally applies only to health care providers, insurers, and their business associates, a standalone therapy or counseling app can collect data just as sensitive as anything a hospital handles while facing a considerably different, and in some ways less developed, regulatory framework. The FTC's reliance on Section 5's general deception authority, rather than a health-specific statute, in cases like BetterHelp and GoodRx reflects the agency's effort to fill that gap using its broadest existing tool, given that dedicated federal health-privacy legislation covering non-HIPAA health apps has yet to be enacted.REVIEWED

For consumers, the case is also a reminder that a company's use of the word "encrypted" to describe shared data, as BetterHelp did in its public response, does not necessarily mean the underlying information cannot still be used to identify or target a specific individual once matched against other data an advertising platform already holds.REVIEWED

Teladoc Health's ownership of BetterHelp adds another layer to the case worth noting: as one of the largest telehealth companies in the country, Teladoc's broader business spans services that do fall under HIPAA, meaning the settlement effectively drew a regulatory line between its HIPAA-covered offerings and BetterHelp's separate, non-covered counseling platform, even though both operate under the same corporate parent.REVIEWED

Have documents relevant to this story? Reach us through our tips channel.