FTC reaches deal with online therapy company over data misuse claims

The Federal Trade Commission reached a settlement with online therapy company BetterHelp over allegations it shared customers’ sensitive health data with third parties for advertising purposes, according to documents from the agency’s in-house court filed this morning and reviewed by POLITICO.

The Teladoc-owned company has agreed to pay $7.8 million and change a variety of its business practices to resolve allegations that it shared consumer data with third parties despite telling customers it would not, according to the documents. The commission voted 4-0 to approve the settlement on Thursday morning, according to an FTC official who was granted anonymity to speak about a confidential matter.

Under the settlement, BetterHelp is barred from sharing health data, including sensitive information about its customers mental health struggles, with Meta and others for advertising purposes. It will use the $7.8 million to provide affected BetterHelp customers with partial refunds.

BetterHelp requires anyone interested in its services to fill out a lengthy questionnaire about their health, like whether or not they’ve previously been in counseling before, as well as personally identifiable information. The FTC asserts that though the company promises not to share this data, it sent personal health information to Facebook, Snapchat, Criteo, and Pinterest for marketing purposes.

"This industry-standard practice is routinely used by some of the largest health providers, health systems, and healthcare brands," BetterHelp said in a prepared statement. "Nonetheless, we understand the FTC’s desire to set new precedents." BetterHelp said the settlement is not an admission of wrongdoing and that it did not share patients names or their clinical information with third parties.

In addition to the fine and a ban on sharing health data to advertise, the FTC requires BetterHelp to get express consent from consumers to share their data for any additional purposes and to implement a privacy program as well as limits on how long they store personal data. The company will also have to ensure that any third parties will delete data they had received from the company it sent data to previously.

The case follows a similar settlement with online pharmacy GoodRx. That settlement prohibits GoodRx from sharing consumer data with third parties for advertising purposes and requires it to get explicit consent from consumers for any other kind of data sharing. It must also pull back previously shared data from companies like Google and Facebook, and pay a $1.5 million fine.

In addition to unfair and deceptive practices, GoodRx was accused of violating the 2009 Health Breach Notification Rule, a rule that protects health data not governed by the Department of Health and Human Services or HIPAA, which sets privacy rules for medical providers.

Sharing personal consumer data, including health information, in order to retarget ads to people who once showed interest in a product is a widespread practice.

Last June, Sen. Ron Wyden (D-Ore.), raised concerns that two tele-mental health companies, BetterHelp and Talkspace, appeared to be “taking advantage of the regulatory gray area” in HIPAA in order to use patient data for marketing purposes.

Prior to Wyden’s letter, several reports pointed to gaps in BetterHelp’s privacy policy and security practices. BetterHelp also reportedly shares metadata with Facebook, Google, Snapchat and others.

Since 2020, the FTC has taken several actions to protect consumer health data collected online and in apps. In addition to GoodRx, the agency brought cases against period tracking app Flo Health and data broker Kochava.

The FTC’s ability to reign in data collection and sharing could expand in other ways as well. In August, the agency kicked off the process to write new, wide-ranging rules for data privacy and “commercial surveillance” practices across the economy. The FTC has received over 10,000 comments and proposed rules could come later this year.