BetterHelp’s intake questionnaire told users that “any information provided in this questionnaire will stay private between you and your counselor.” According to the FTC’s complaint, the company then uploaded the email addresses of more than 7 million visitors and users to Facebook for advertising between 2017 and 2018.
The FTC finalized its order in July 2023: $7.8 million and a ban on sharing consumers’ health data for advertising.
Two cases followed in 2024 that are closer to home for treatment centers: Monument, an online alcohol addiction treatment service, and Cerebral, a telehealth company. Both were charged under a law written specifically for substance use disorder treatment.
None of these companies was a traditional treatment center, and the legal frame isn’t identical for a HIPAA-covered facility.
But the advertising practices at the center of these cases, from privacy promises to pixels to customer list uploads, are the same ones treatment center marketing teams use every day. This piece covers what happened, which rules apply to treatment centers, and what to change.
It’s part of the work inside our paid media practice for treatment centers. This is general information, not legal advice.
Key Takeaways
- The FTC treated BetterHelp’s privacy promises as enforceable claims. Telling users their information would stay private, then sharing it with ad platforms, was the core of the case.
- Hashing didn’t protect anyone. The FTC’s complaint says BetterHelp’s hashing “was not meant to conceal” identities from Facebook and the other platforms.
- Monument, an alcohol addiction treatment service, sent health information to advertisers through pixel events with names like “Paid: Weekly Therapy.” It was charged under the Opioid Addiction Recovery Fraud Prevention Act, which gives the FTC civil penalty authority over substance use disorder treatment services.
- The remedy in all three cases was a ban on using health information for advertising, plus consent requirements for other sharing.
- For HIPAA-covered treatment centers, HIPAA and 42 CFR Part 2 govern tracking, not the FTC’s Health Breach Notification Rule. But privacy claims on the site are still marketing claims.
What happened in the three cases
BetterHelp (2023). An online counseling service whose intake questionnaire asked about depression and suicidal thoughts. The FTC said BetterHelp used and revealed email addresses, IP addresses, and health questionnaire information to Facebook, Snapchat, Criteo, and Pinterest for advertising. It used former clients’ email addresses and the fact that they’d been in therapy to have Facebook find similar people.
The complaint also says BetterHelp displayed a HIPAA seal even though no government agency or third party had reviewed its practices for HIPAA compliance. The FTC called it the first Commission action returning money to consumers whose health data was compromised.
Monument (2024). An online alcohol addiction treatment service that told users their information would be “100% confidential.” The FTC said Monument disclosed health information for as many as 84,000 users to advertising platforms, including Meta and Google, through pixels and APIs. The custom events carried descriptive names like “Paid: Weekly Therapy” and “Paid: Med Management.”
Monument was charged under the FTC Act and the Opioid Addiction Recovery Fraud Prevention Act of 2018 (OARFPA). A $2.5 million civil penalty was suspended because the company couldn’t pay.
Cerebral (2024). A telehealth company that described its services as “safe, secure, and discreet.” The FTC said Cerebral provided sensitive information on nearly 3.2 million consumers to LinkedIn, Snapchat, TikTok, and others through tracking tools. It was also charged under OARFPA. The proposed order required more than $7 million and permanently banned Cerebral from using or disclosing consumers’ personal and health information for most marketing or advertising.
The three FTC cases at a glance
$7.8M
BetterHelp final order, July 2023
84,000
Monument users whose health information went to advertising platforms
3.2M
Cerebral consumers whose sensitive information was shared
Source: FTC press releases on BetterHelp, Monument, and Cerebral.
The law that names substance use disorder treatment
OARFPA prohibits deceptive acts or practices with respect to any substance use disorder treatment service or product. The FTC says the law lets it seek civil penalties, refunds, and other remedies.
That’s why Monument and Cerebral faced civil penalties. It’s also not limited to data. In 2025, the FTC also used it in a settlement with a treatment provider over its Google search ads. For treatment centers, OARFPA is the federal law most directly aimed at how they market.
DEFINITION
OARFPA. The Opioid Addiction Recovery Fraud Prevention Act of 2018, a federal law that prohibits unfair or deceptive acts or practices in connection with substance use disorder treatment services and products, and lets the FTC seek civil penalties for violations.
Which rules apply to a treatment center
HIPAA and Part 2 come first. Most treatment centers are HIPAA-covered entities, and many are also covered by 42 CFR Part 2. Those rules govern how patient information can be used and disclosed, including through tracking technologies.
HHS’s guidance on online tracking is in flux. A federal court vacated part of the HHS tracking bulletin in June 2024, the portion covering IP addresses combined with visits to unauthenticated public pages, and HHS hasn’t reissued it. The rest of the bulletin still stands.
The FTC’s Health Breach Notification Rule usually doesn’t. The FTC says the rule doesn’t apply to HIPAA-covered entities. It’s aimed at health apps and similar services outside HIPAA, like GoodRx, the rule’s first enforcement case.
The FTC Act and OARFPA still matter. In a July 2023 joint letter to about 130 hospital systems and telehealth providers, the FTC and HHS named the Meta pixel and Google Analytics and warned about tracking technologies. What a website promises about privacy is a marketing claim, and OARFPA applies to marketing of substance use disorder treatment specifically.
State laws add a layer. Washington’s My Health My Data Act covers consumer health data outside HIPAA and bans geofencing near health care facilities for audiences in Washington.
What to change
Audit every privacy promise. Search the site, forms, chat widgets, and ads for “confidential,” “private,” “secure,” “HIPAA compliant,” and any seals or badges. Each one is a claim. Keep the ones you can support, and remove seals that no outside reviewer issued.
Rename and strip pixel events. Monument’s events named the service the user paid for. Event names, URLs, and parameters sent to ad platforms shouldn’t describe a condition, a level of care, or a payment for treatment. Our HIPAA-safe conversion tracking guide covers neutral event design through a BAA-covered server-side layer.
Never upload patient lists. BetterHelp uploaded former clients’ emails to find similar people, and the FTC said hashing didn’t conceal their identities. Don’t upload patient or alumni lists to ad platforms, including as exclusion lists. Our guide to HIPAA-compliant Meta ads for addiction treatment covers what to do instead.
Check retargeting. BetterHelp’s order banned sharing personal information with certain third parties for retargeting. Retargeting visitors to condition or program pages sends exactly the signal these cases were about.
Get consent where you need it, and document it. The orders required affirmative express consent before other sharing. Have counsel decide what your forms and tracking need, and keep the record.
COMMON MISTAKE
Assuming hashing makes data anonymous. Hashed emails and phone numbers are designed to be matched to real accounts on the platform side.
The FTC’s BetterHelp complaint says the hashing “was not meant to conceal” identities from Facebook. Treat hashed identifiers as identifiable.
Where this fits
These cases sit inside the broader HIPAA-safe tracking work. See our guide to the Meta Conversions API for treatment centers, our testimonial compliance playbook, and the HIPAA marketing compliance glossary entry. For a site-wide review, see our website compliance checklist.
OPERATOR INSIGHT
Pull up your pixel or Conversions API event list and read it as if it were published. If an event name, URL, or parameter would tell a stranger that someone sought treatment, change it.
Then read your site’s privacy language the same way. If you couldn’t defend a promise to a regulator, don’t make it.
For how paid media fits the rest of your marketing, see the complete guide to behavioral health marketing. If you want a second look at your tracking and privacy language, book an intro meeting.
Frequently Asked Questions
Does the BetterHelp settlement apply to treatment centers?
Not directly. BetterHelp wasn’t a HIPAA-covered entity, and the FTC’s Health Breach Notification Rule doesn’t apply to covered entities.
But the FTC Act applies to deceptive privacy promises, and OARFPA applies specifically to substance use disorder treatment marketing, which is how Monument and Cerebral were charged.
The practices in these cases, pixels, list uploads, and privacy claims, are common in treatment center marketing.
What is OARFPA?
The Opioid Addiction Recovery Fraud Prevention Act of 2018 prohibits deceptive acts or practices related to substance use disorder treatment services and products.
It lets the FTC seek civil penalties, refunds, and other remedies.
The FTC has used it in cases involving health data sharing and deceptive search ads.
Is it safe to upload hashed patient emails to Meta?
Don’t upload patient or alumni lists. The FTC’s BetterHelp complaint says the hashing wasn’t meant to conceal identities from Facebook.
Hashed identifiers are built to be matched to real accounts.
Use neutral, consented conversion events through a BAA-covered layer instead, with counsel’s sign-off.
Can we say our website is HIPAA compliant?
Only if you can support it. BetterHelp displayed a HIPAA seal that no outside reviewer had issued, and the FTC cited it.
Monument’s claims about HIPAA were also contradicted by an outside assessor’s findings, according to the FTC.
Describe what you actually do to protect information, and have counsel review the wording.
What should we check first?
Your pixel and Conversions API events, and your site’s privacy language.
Event names and parameters shouldn’t reveal a condition, level of care, or payment for treatment.
Privacy promises should match what the site actually does with data.
Trevor Gage is the Director of Marketing at Webserv, a digital marketing agency for treatment centers.
