BetterHelp should pay $7.8 million for sharing sensitive data, FTC says

Online counseling and mental health services firm BetterHelp should stop sharing customer data with advertisers and refund $7.8 million to customers, the Federal Trade Commission said Thursday. The FTC says BetterHelp shared customers’ sensitive health data, including mental health issues, with advertisers such as Facebook and Snapchat.

“BetterHelp promised consumers that it would not use or disclose their personal health data except for limited purposes, such as providing counseling services,” the FTC statement said. “Despite these promises, BetterHelp used and disclosed email addresses, IP addresses and consumer health questionnaire information to Facebook, Snapchat, Criteo and Pinterest for advertising purposes.”

The FTC’s proposed consent order would require BetterHelp to reimburse $7.8 million to people who used the service between August 1, 2017 and December 31, 2020. The consent order would also prohibit the company from sharing health information for advertising purposes and would require it. to establish “a comprehensive privacy program,” tell third parties to delete data they’ve already shared and limit how long they can retain that data.

BetterHelp did not respond to a request for comment. In a statement posted on its website, the company said it follows “industry standard” advertising practices. “Nevertheless, we understand the FTC’s desire to set new precedents in consumer marketing, and we are pleased to resolve this issue with the agency,” the statement read.

BetterHelp said its settlement with the FTC is not an admission of wrongdoing. The company added that it “does not and has never shared” members’ names or clinical data from therapy sessions with third parties.

The proposed consent order will be open for public comment for 30 days before a final decision is made.

Facebook, Snapchat and Pinterest did not immediately respond to requests for comment. In a statement sent to CNET, Criteo said it “maintains the highest levels of privacy and data security” and could not comment on the FTC complaint because it is not named as respondent.