Telehealth Privacy: Is Your Mental Health Data Being Sold?

The rise of teletherapy apps has made mental health support more accessible than ever. However, recent investigations reveal a troubling trade-off for this convenience. Your most intimate struggles, answers to health questionnaires, and even your identity might be shared with advertising giants like Facebook and Google.

If you use apps for therapy, meditation, or prescription discounts, you need to understand how “tracking pixels” work and why current laws like HIPAA might not protect you as much as you think.

The Hidden "Observer": Tracking Pixels Explained

To understand how your data leaks, you have to look at the technology embedded in these websites and apps. The primary culprit is often the “Meta Pixel” (formerly the Facebook Pixel) or similar tracking codes from Google and TikTok.

A tracking pixel is a tiny piece of code that developers place on their websites. It records user actions to help companies measure the effectiveness of their ads. While this is standard for retail sites selling shoes or furniture, it becomes dangerous when applied to mental health platforms.

Here is what happens in practice:

  • You visit a therapy site and click on a button that says “I struggle with anxiety.”
  • The pixel records this action.
  • The pixel sends a packet of data to Facebook (Meta) linking that specific action to your IP address or Facebook ID.
  • Advertisers can then target you with ads for anti-anxiety medication or other mental health services because the algorithm now “knows” your condition.

This process often happens automatically in the background, usually without your explicit consent or knowledge.

Major Investigations and FTC Actions

The issue is not theoretical. Several major companies have faced federal scrutiny and fines for mishandling sensitive user data under the guise of standard marketing practices.

The BetterHelp Settlement

In March 2023, the Federal Trade Commission (FTC) issued a proposed order banning BetterHelp from sharing consumer health data for advertising purposes. The FTC ordered the company to pay $7.8 million to settle charges that it revealed consumers’ sensitive data to third parties like Facebook and Snapchat.

The investigation found that BetterHelp had promised users their data was private. In reality, they uploaded the email addresses of nearly 2 million current and former users to Facebook to target them and others like them with ads. They effectively used the fact that someone was seeking therapy as a marketing filter.

The GoodRx Case

Shortly before the BetterHelp ruling, the FTC took action against GoodRx, a company that helps users find prescription discounts. GoodRx agreed to pay a $1.5 million penalty.

The FTC alleged that GoodRx shared details about user medications with Facebook, Google, and Criteo. For example, if a user looked up a coupon for a heart condition or blood pressure medication, that information was allegedly shared with ad platforms to build a profile on that user’s health status.

The Cerebral Admission

Cerebral, a telehealth startup known for prescribing ADHD medication, admitted in a filing that it had shared patient data via tracking pixels. This included information on users who had taken mental health assessments on their platform. The company stated they had since disabled the tracking tools, but the admission highlighted how widespread the practice was across the industry.

The HIPAA Compliance Gap

Most Americans assume that any health-related information is automatically protected by the Health Insurance Portability and Accountability Act (HIPAA). This is a dangerous misconception.

HIPAA applies strictly to “covered entities.” This includes:

  • Doctors and hospitals.
  • Health insurance companies.
  • Healthcare clearinghouses.

Many health apps and telehealth startups classify themselves differently. They may argue they are “information connectors” or “technology platforms” rather than medical providers. If an app falls outside the definition of a covered entity, HIPAA rules regarding data privacy do not apply to them in the same way.

Even when an app is HIPAA compliant regarding your sessions with a doctor, the marketing website you visit before you sign up might not be. The intake quiz you take before you are an official patient often sits in a legal gray area. This allows companies to harvest data from the very first click, long before a doctor-patient relationship is established.

What Specific Data Is Being Shared?

Investigations by The Markup and STAT News have identified exactly what kind of information these pixels transmit. It is rarely just generic usage data.

The transmitted data often includes:

  • Intake Answers: Responses to questions like “Are you feeling depressed?” or “Do you have suicidal thoughts?”
  • Status of Treatment: Whether you are currently in therapy or looking to start.
  • Prescriptions: Names of specific medications you are searching for or purchasing.
  • Identifiers: IP addresses, mobile advertising IDs, and hashed email addresses that allow ad networks to link the health data directly to your real-world identity.

How to Protect Your Mental Health Data

While regulators are cracking down, you are your own best defense. You can take specific steps to limit who sees your health data.

1. Scrutinize the Privacy Policy

Don’t just scroll past the fine print. Search the privacy policy for terms like “third-party marketing,” “partners,” or “advertising.” If the policy states they share data to “improve your experience” or “personalize offers,” they are likely using tracking pixels.

2. Adjust Browser and Phone Settings

  • iOS Users: Use the “Ask App Not to Track” feature introduced in iOS 14.5. This blocks the app from accessing your IDFA (Identifier for Advertisers).
  • Browser Extensions: Install privacy-focused extensions like uBlock Origin or Privacy Badger. These tools specifically block tracking pixels and analytics scripts from loading on the webpages you visit.
  • Use Privacy Browsers: Browsers like Brave or Firefox (with strict privacy settings enabled) offer better native protection against cross-site tracking than standard Chrome settings.

3. Be Careful with “Quizzes”

Many mental health apps use a free assessment quiz as a lead-generation tool. Be aware that the answers you provide in these quizzes are often collected for marketing profiles before you ever speak to a therapist. If possible, skip the quiz and contact the provider directly.

Frequently Asked Questions

Is it illegal for therapy apps to share my data? It depends on how they do it and what they promised. Sharing health data isn’t always illegal if you agree to it in the Terms of Service. However, if a company promises confidentiality (like BetterHelp did) and then shares data anyway, that is considered deceptive trade practice and is illegal.

Do all mental health apps sell data? No. Some apps operate on a paid subscription model that does not rely on advertising revenue or data sharing. Always look for apps that explicitly state they do not sell or share data with third parties for marketing purposes.

Can I delete the data these apps already have? Under laws like the CCPA (California) or GDPR (Europe), you have the right to request your data be deleted. Even if you don’t live in those regions, many companies will honor a deletion request to maintain good public relations. Look for a “Delete My Data” option in the app’s settings or footer.

Does a HIPAA seal on a website mean my data is private? Not necessarily. A HIPAA seal means the company claims to follow security protocols for patient records. It does not guarantee that their marketing website is free of tracking pixels or that they aren’t sharing “anonymized” data with advertisers.