You Were Vulnerable. They Monetized It.
You were struggling.
Maybe it was anxiety that wouldn't quit. Maybe depression had settled in and wouldn't leave. Maybe you just needed someone to talk to and didn't know where to start.
So you downloaded a therapy app. You answered their intake questions—honestly, because that's what you're supposed to do with mental health providers. You told them about your symptoms, your fears, your darkest moments.
You thought you were talking to a healthcare provider.
You were talking to a marketing department.
The BetterHelp Betrayal
In March 2023, the FTC announced a $7.8 million settlement with BetterHelp, one of the largest online therapy platforms in the country.
The findings were devastating:
BetterHelp collected sensitive mental health information from users—including responses about depression, anxiety, suicidal thoughts, and medication—and shared it with advertising platforms including Facebook, Snapchat, Criteo, and Pinterest.
They didn't share it accidentally. They shared it strategically.
In 2017, BetterHelp uploaded nearly 2 million email addresses to Facebook. Not just any addresses—these were people who had visited the site, taken the intake questionnaire, or engaged with mental health content. BetterHelp used Facebook's matching tools to find these people and show them ads.
They also shared with Snapchat: Email addresses and IP addresses of 5.6 million former visitors.
And with Criteo: Emails of 70,000+ visitors, including people who had specifically visited Pride Counseling, BetterHelp's LGBTQ+-focused therapy service.
Think about that last one. People seeking mental health support specifically because of their sexual orientation or gender identity. Their email addresses, handed to an advertising company.
BetterHelp promised confidentiality. They told users their information was private. Their website had reassuring language about security and trust.
They were lying.
What They Actually Shared
Let me be specific about what data flowed from BetterHelp to advertising platforms:
Email addresses — Allowing platforms to identify and target specific users
IP addresses — Enabling geographic and device-level targeting
Health questionnaire responses — Including symptom severity and treatment goals
Metadata about platform engagement — When users logged on, how long they stayed, what features they used
The FTC found that BetterHelp used this data to identify "similar consumers" for advertising purposes. In other words, they took people who were depressed, identified their characteristics, and used Facebook's lookalike audience tools to find more people like them.
They told the FTC this strategy brought them "tens of thousands of new paying users and millions of dollars in revenue."
Millions of dollars. From targeting people based on their mental health vulnerabilities.
The Cerebral Sequel
If you thought BetterHelp was an isolated case, meet Cerebral.
In April 2024, Cerebral agreed to pay $7 million to settle FTC charges that it shared patient health information—including diagnoses, medication details, and treatment information—with Google, TikTok, and Meta.
Cerebral is a telehealth company that prescribes medication for anxiety, depression, and ADHD. Real psychiatric medications prescribed based on real patient information.
That patient information? Shared with advertising platforms through tracking pixels embedded in Cerebral's website and app.
Every time someone logged in, the trackers fired. Every time someone viewed a page about a specific medication, the trackers logged it. Every time someone completed a visit, the trackers reported back.
Google, TikTok, and Meta received detailed information about what medications people were considering, what diagnoses they'd received, and how their treatment was progressing.
This wasn't anonymous. The tracking pixels included identifiers that linked back to individual users. The advertising platforms could match this health data to existing profiles and use it for targeting.
Your ADHD medication. On TikTok's servers. Powering their ad algorithm.
Why HIPAA Didn't Protect You
You might be wondering: Isn't there a law about this? What about HIPAA?
Here's the ugly truth: HIPAA probably doesn't apply to most mental health apps.
HIPAA—the Health Insurance Portability and Accountability Act—protects health information in specific contexts. It applies to "covered entities" like doctors, hospitals, and insurance companies. It applies to their "business associates" who handle data on their behalf.
But here's the gap: HIPAA typically doesn't cover you until you become a patient.
When you visit BetterHelp's website and fill out their intake questionnaire, you're not a patient yet. You're a prospective customer. The data you provide during that process—your symptoms, your mental state, your contact information—may not be protected.
Even after you become a client, the app company might argue they're a "technology platform" rather than a healthcare provider, creating legal gray areas.
The mental health app industry has grown up in this regulatory void. They collect the most sensitive health data imaginable—your mental state, your darkest thoughts, your treatment history—without the legal protections that would apply if you walked into a psychiatrist's office.
It's not a loophole. It's a canyon.
The Mozilla Study
In 2023, Mozilla's Privacy Not Included project reviewed 27 popular mental health apps.
The results:
- 44% of mental health apps share data with third parties
- Only 2 apps met Mozilla's minimum privacy standards: PTSD Coach (made by the VA) and Wysa
- The remaining 25 apps had significant privacy concerns
The failing apps included some of the biggest names in digital mental health. Apps with millions of downloads. Apps that run television commercials. Apps that position themselves as safe, confidential alternatives to traditional therapy.
They're not safe. They're not confidential. They're advertising platforms wearing a therapeutic mask.
The Intake Questionnaire Trap
Here's how the pipeline works:
You find a mental health app. You're hurting, you're vulnerable, you need help. The app asks you to complete an intake questionnaire. This is normal—therapists need information to help you.
The questions are sensitive:
- Have you experienced thoughts of suicide?
- How severe is your depression on a scale of 1-10?
- What medications are you currently taking?
- What traumatic experiences have you had?
You answer honestly because you want help. Because you trust that this is confidential. Because that's what you're supposed to do in a therapeutic context.
But you're not in a therapeutic context yet. You're filling out a marketing form.
Your answers are tagged, categorized, and used to determine your customer value. Someone who indicates severe symptoms might be a higher-value conversion. Someone who mentions specific issues might be targeted with specific messaging.
And those answers—or metadata about those answers—flow to advertising platforms. Maybe not the full text of your suicidal thoughts, but enough data to target you. To find people like you. To build audiences around mental health vulnerabilities.
The intake questionnaire isn't intake. It's lead qualification with better branding.
The Ad Targeting Feedback Loop
Here's where it gets dystopian.
You struggle with depression. You search for help. You find BetterHelp. You complete their questionnaire. Your data flows to Facebook.
Facebook now knows you're in the market for mental health services. They show you more ads for therapy apps. More ads for medication. More ads for wellness products. The algorithm has identified you as someone who converts on mental health advertising.
Meanwhile, you're still depressed. Now you're also being followed around the internet by reminders of your depression. Every platform knows you're struggling. Every advertiser has bid on your attention because you've been flagged as vulnerable.
You sought help and became a target. The system learned your pain points and exploited them.
This isn't theoretical. This is how targeted advertising works. The only question is whether you're comfortable with your mental health being the targeting variable.
What $7.8 Million Means
BetterHelp paid $7.8 million to settle with the FTC.
Let's put that in context.
BetterHelp's parent company, Teladoc Health, reported $2.4 billion in revenue in 2023. BetterHelp is their largest business unit.
$7.8 million is roughly 0.3% of one year's revenue.
BetterHelp itself admitted that their data-sharing practices generated "tens of thousands of new paying users and millions of dollars in revenue."
If they made $10 million from the practices and paid $7.8 million in fines, they still profited.
The fine isn't a punishment. It's a tax. And the tax is lower than the profits.
The Apps to Avoid (And the Ones That Are Actually Safe)
Based on Mozilla's research and FTC enforcement actions, here's what we know:
Apps with significant privacy concerns:
- BetterHelp (FTC settlement)
- Cerebral (FTC settlement)
- Talkspace (data sharing documented in privacy policies)
- Calm (shares data with third parties)
- Headspace (marketing and analytics sharing)
Apps that meet minimum privacy standards:
- PTSD Coach — Free, made by the VA, no data sharing
- Wysa — AI chatbot with strong privacy protections
Safer alternatives:
- Traditional therapy with a licensed provider (HIPAA-protected)
- Employee Assistance Programs through your employer (HIPAA-protected)
- Community mental health centers (HIPAA-protected)
- Texting/calling crisis lines (confidential by design)
The safest option remains the oldest: talking to a licensed professional in a context where HIPAA actually applies.
What You Can Do
If you've used BetterHelp or Cerebral:
The FTC settlement requires both companies to offer data deletion. You can request that they:
- Delete your personal information
- Stop sharing your data with third parties
- Remove you from marketing audiences they've created
Visit their privacy pages and submit deletion requests. Document everything.
For any mental health app:
Read the privacy policy before answering sensitive questions. I know it's the last thing you want to do when you're struggling. Do it anyway.
Look for specific language about advertising and third-party sharing. If the app mentions "marketing partners," "analytics providers," or "advertising networks," your data is being shared.
Prefer apps that explicitly don't share data. PTSD Coach and Wysa have built their business models around privacy. Others haven't.
Consider the business model. If the app is free and not run by a nonprofit or government, ask yourself how they make money. The answer is usually: you.
Use tools that reveal tracking. Apps like ZoraSafe can show you which platforms are leaking your data to third parties.
Protect yourself going forward:
- Use a separate email address for healthcare apps
- Don't connect mental health apps to social media accounts
- Consider using a VPN to obscure your IP address
- Answer intake questions with minimum necessary detail until you're an actual patient
The Bottom Line
You were in pain. You asked for help. The company you asked took your pain, packaged it, and sold it to the highest bidder.
BetterHelp promised confidentiality and delivered your email address to Facebook. Cerebral promised treatment and delivered your diagnosis to TikTok. The entire industry promised care and delivered advertising.
2 million email addresses. 5.6 million former visitors. 70,000 people who just wanted LGBTQ+-affirming therapy.
All monetized. All targeted. All betrayed.
The mental health app industry grew up in a regulatory void and decided the void was a feature, not a bug. They took the most intimate information humans can share—our struggles, our fears, our desperate moments—and turned it into targeting data.
The FTC fines are a start. They're not enough. The industry needs to be rebuilt from the ground up with privacy as a foundation, not a marketing claim.
Until then, be careful who you tell your secrets. The algorithm is listening.
And it's taking notes.
Sources: FTC enforcement action against BetterHelp (March 2023); FTC enforcement action against Cerebral (April 2024); Mozilla Foundation "Privacy Not Included" mental health app study (2023); HHS guidance on HIPAA coverage; Teladoc Health investor filings.