Online counseling service BetterHelp has received a proposed order from the FTC banning the company from sharing users' health information. According to the FTC, BetterHelp shared sensitive information about mental health challenges for advertising purposes. The proposed order also requires the company to pay $7.8 million to consumers to settle charges that it revealed consumers’ sensitive data with third parties such as Facebook and Snapchat for advertising after promising to keep such data private.
This is the first Commission action returning funds to consumers whose health data was compromised. In addition, the FTC’s proposed order will ban BetterHelp from sharing consumers’ personal information with certain third parties for re-targeting — the targeting of advertisements to consumers who previously had visited BetterHelp’s website or used its app, including those who had not signed up for the company’s counseling service. The proposed order also will limit the ways in which BetterHelp can share consumer data going forward.
Consumers interested in BetterHelp’s services must fill out a questionnaire that asks for sensitive mental health information — such as whether they have experienced depression or suicidal thoughts and are on any medications. They also provide their name, email address, birth date and other personal information. Consumers are then matched with a counselor.
The FTC states that at several points in the signup process, BetterHelp promised consumers that it would not use or disclose their personal health data except for limited purposes, such as to provide counseling services. Despite these promises, BetterHelp used and revealed consumers’ email addresses, IP addresses and health questionnaire information to Facebook, Snapchat, Criteo and Pinterest for advertising purposes, according to the FTC’s complaint.
According to the complaint, BetterHelp pushed consumers to hand over their health information by repeatedly showing them privacy misrepresentations and nudging them with unavoidable prompts to sign up for its counseling service. According to the FTC, despite collecting such sensitive information, BetterHelp failed to maintain sufficient policies or procedures to protect it and did not obtain consumers’ affirmative express consent before disclosing their health data. BetterHelp also failed to place any limits on how third parties could use consumers’ health information — allowing Facebook and other third parties to use that information for their own internal purposes, including for research and development or to improve advertising.
BetterHelp also misled users and the public in 2020 by falsely denying news reports that it revealed consumers’ personal information, including their health information, with third parties, according to the complaint.
The $7.8 million that BetterHelp must pay under the proposed order will be used to provide partial refunds to consumers who signed up for and paid for BetterHelp’s services between August 1, 2017, and December 31, 2020. In addition to banning BetterHelp from disclosing health information for advertising, the proposed order also prohibits the company from misrepresenting its sharing practices and requires it to:
- Obtain affirmative express consent before disclosing personal information to certain third parties for any purpose.
- Put in place a comprehensive privacy program that includes strong safeguards to protect consumer data.
- Direct third parties to delete the consumer health and other personal data that BetterHelp revealed to them.
- Limit how long it can retain personal and health information according to a data retention schedule.
