Comments of EPIC in re the Federal Trade Commission’s Proposed Order & Settlement with BetterHelp, Inc.

Dear Chair Khan and Commissioners Slaughter and Bedoya,

By notice published March 14, 2023, the Federal Trade Commission (FTC) announced its proposed consent order and settlement with BetterHelp Inc., for BetterHelp’s alleged violations of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a), prohibiting unfair or deceptive acts or practices.^[1] The proposed consent order with BetterHelp is the result of the FTC’s eight-count complaint alleging that BetterHelp failed to obtain requisite consent before collection, use and disclosure of consumer health information, and that BetterHelp misrepresented and failed to disclose their use of consumer health information for advertising.

The Electronic Privacy Information Center (EPIC) submits this letter in support of the proposed consent order. EPIC is a public interest research center in Washington, D.C. established in 1994 to focus on public attention on emerging civil liberties issues and to secure the fundamental right to privacy in the digital age for all people through advocacy, research, and litigation. EPIC routinely files comments in response to proposed FTC consent orders and complaints regarding business practices that violate privacy rights.^[2]

EPIC commends the Commission for using its Section 5 authority to take enforcement actions against companies like BetterHelp that are engaged in unfair and deceptive practices involving health data, especially where insufficient protections for personal information are involved. We note that the Commission could likely also have brought this complaint as a violation of the Health Breach Notification Rule, much as it did in the recent GoodRx enforcement action.[3] EPIC encourages the FTC to continue using its Section 5 unfairness and deception authority, as well has the Health Breach Notification Rule, to address violations of consumer health data privacy.

In recent years, Americans have increasingly sought out mental health services.^[4] The COVID-19 pandemic created myriad stressors, and many Americans elected to seek therapy online. As a result, BetterHelp saw “explosive growth [over] the last few years,” signing up over 2 million users and earning over $720 million in 2021.^[5] Throughout the lengthy intake process, BetterHelp provided periodic privacy assurances, only to break those privacy promises by sharing personal information and health information with third parties and for its own advertising purposes.^[6] BetterHelp knew that these privacy assurances were material to consumers, acknowledging to FTC staff that consumers want “privacy in the context of therapy.”^[7] Nonetheless, BetterHelp used, shared, and sold consumer data to optimize its advertisements, target potential new consumers, and re-target visitors with ads, bringing in “hundreds of thousands of new Users, resulting in millions of dollars in additional revenue.”^[8]

EPIC commends the Commission’s strong prohibitions in Section I of the proposed order against disclosure of health information for certain advertising purposes. The proposed order flatly bars BetterHelp from disclosing Treatment Information to third parties for various advertising and marketing purposes.^[9] Critically, the Commission prohibits such disclosure without exceptions including consent. The “Treatment Information” definition rightly encompasses a broad range of sensitive information involved in online therapy, including prescription information, diagnosis information, and “information concerning the consumer’s use of, creation of an account associated with, or response to a question or questionnaire related to, a service or product offered by Respondent or through one of any of Respondent’s online properties, services, or mobile applications.”^[10] Additionally, the definition covers identifiable information spanning past, present, and future physical or mental health conditions.

While BetterHelp’s privacy misrepresentations can be broadly categorized as Section 5 violations, EPIC applauds the Commission for explicitly listing each prohibition against the various, harmful misrepresentations of Covered Information in Section III. The proposed order bars BetterHelp from misrepresenting its data collection and use practices, consumer data rights, and the extent to which it is HIPAA compliant or otherwise certified by a self-regulatory or standard-setting organization.^[11] By enumerating those examples, the Commission continues to build out a clearer framework and understanding of common, harmful privacy misrepresentations related to privacy policies and other consumer data rights.

Finally, EPIC commends the Commission’s attention to the downstream effects of unauthorized consumer health data disclosure. In a complex data-driven economy, it is vital to ensure that businesses not party to an enforcement action nevertheless delete ill-gotten personal data, as Section IV does here.^[12]

EPIC urges the Commission to finalize the proposed BetterHelp consent order. Additionally, EPIC encourages the Commission to both (1) continue building on its use of Section 5 deception and unfairness authority in privacy and data security matters, and (2) maximize its use of the Health Breach Notification Rule as the Commission addresses ongoing threats to the security of health data.

Respectfully submitted,

/s/ John Davisson
EPIC Director of Litigation &
Senior Counsel

/s/ Suzanne Bernstein
EPIC Law Fellow

ELECTRONIC PRIVACY
INFORMATION CENTER (EPIC)
1519 New Hampshire Ave. NW
Washington, DC 20036
202-483-1140 (tel)
202-483-1248 (fax)

[1] Analysis of Proposed Consent Order to Aid Public, 88 Fed. Reg. 15,717 (Mar. 14, 2023), https://www.federalregister.gov/documents/2023/03/14/2023-05139/betterhelp-inc-analysis-of-proposed-consent-order-to-aid-public-comment.

[2] See, e.g., Comments of EPIC, In re Chegg, Inc., FTC File No. 202-3151 (2022), https://epic.org/documents/comments-of-epic-in-re-the-federal-trade-commissions-proposed-order-settlement-with-chegg-inc/; Comments of EPIC, FTC Proposed Trade Regulation Rule on Commercial Surveillance and Data Security (Nov. 2022), https://epic.org/wp-content/uploads/2022/12/EPIC-FTC-commercial-surveillance-ANPRM-comments-Nov2022.pdf; Comments of EPIC, In re CafePress, File No. 192-3209 (2022), https://epic.org/wp-content/uploads/2022/04/EPIC-comments-in-re-cafepress.pdf; Comments of EPIC, In re Matter of Support King, LLC (SpyFone.com), FTC File No. 192-3003 (2021), https://archive.epic.org/apa/comments/In-re-SpyFone-Order-EPIC-comment-100821.pdf; Comments of EPIC et al., In re Zoom Video Communications, Inc., FTC File No. 192-3167 (2020), https://epic.org/apa/comments/EPIC-FTC-Zoom-Dec2020.pdf; Complaint of EPIC, In re Online Test Proctoring Companies (Dec. 9, 2020), https://epic.org/wp-content/uploads/privacy/dccppa/online-test-proctoring/EPIC-complaint-in-re-online-test-proctoring-companies-12-09-20.pdf; Complaint of EPIC, In re Airbnb (Feb. 26, 2020), https://epic.org/privacy/ftc/airbnb/EPIC_FTC_Airbnb_Complaint_Feb2020.pdf; Complaint of EPIC, In re HireVue (Nov. 6, 2019), https://epic.org/privacy/ftc/hirevue/EPIC_FTC_HireVue_Complaint.pdf; Comments of EPIC, In re Unrollme, Inc., FTC File No. 172-3139 (2019), https://epic.org/apa/comments/EPICFTC-Unrollme-Sept2019.pdf.

[3] Press Release, FTC Enforement Action to Bar GoodRx from Sharing Consumers’ Sensitive Health Info for Advertising, FTC (Feb. 1, 2023), https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising.

[4] See Lenny Bernstein, This Is Why it’s So Hard to Find Mental Health Counseling Right Now, Wash. Post (Mar. 6, 2022), https://www.washingtonpost.com/health/2022/03/06/therapist-covid-burnout/.

[5] BetterHelp Inc. Complaint, In the Matter of BetterHelp, Inc., FTC File No. 202-3169 (2022), https://www.ftc.gov/system/files/ftc_gov/pdf/2023169-betterhelp-complaint_.pdf.

[6] Id. at 2–3 (BetterHelp subsidiaries targeted unique populations with particularly sensitive data: Faithful Counseling aimed at consumers of the Christian faith, Pride Counseling for members of the LGBTQ community, and Teen Counseling for users 13-18 years old).

[7] Id. at 13.

[8] Id. at 10.

[9] BetterHelp Inc. Decision and Proposed Order, In the Matter of BetterHelp, Inc., FTC File No. 202-3169 at 6 (2022), https://www.ftc.gov/system/files/ftc_gov/pdf/202_3169-betterhelp-consent.pdf.

[10] Id.

[11] Id. at 7.

[12] Id.