Health app and telehealth startup marketing: what the FTC health data orders teach

Health apps and telehealth startups usually grow through paid social and search ads, and paid ads run on tracking: pixels, SDKs, conversion events and lookalike audiences. Between 2023 and 2024 the FTC announced five actions against digital health companies that all turned on the same thing: health information reaching advertising platforms. Each one is a list of mistakes a marketing team can check its own setup against.

This guide summarizes what the FTC alleged in each case, as stated in the FTC’s own press releases, and turns them into a checklist for anyone marketing a health app or telehealth service. The FTC Health Breach Notification Rule is covered in its own guide, the FTC Health Breach Notification Rule explained; this guide focuses on marketing. If you sell software to practices rather than to patients, such as an EHR or practice management system, see our guide to marketing EHR and health IT software, which covers ONC certification disclosures and information blocking. Before you submit an app, read our guide to App Store and Google Play rules for health apps.

Why the FTC, not HIPAA

Many health apps and direct-to-consumer telehealth services are not HIPAA covered entities, or have parts that are not covered, such as a free symptom checker or a marketing site. That does not leave health data unregulated. Section 5 of the FTC Act, 15 U.S.C. 45, prohibits unfair or deceptive acts or practices in commerce, and the FTC treats breaking a privacy promise as deception. For vendors of personal health records and related entities, the Health Breach Notification Rule, 16 CFR Part 318, adds a duty to notify users when their health information is disclosed without authorization, and the FTC has treated sharing with advertising platforms as such a disclosure.

The five cases in brief

1. GoodRx, February 1, 2023. The FTC announced its first enforcement action under the Health Breach Notification Rule against GoodRx, a prescription discount and telehealth provider, for failing to notify users of disclosures of personal health information to Facebook, Google and other companies. The FTC also alleged that GoodRx displayed a seal on its telehealth homepage falsely suggesting it complied with HIPAA. Under the proposed order, GoodRx agreed to a $1.5 million civil penalty and a permanent ban on sharing health data with applicable third parties for advertising.
2. BetterHelp, March 2, 2023. The FTC alleged that the online counseling service promised during signup not to use or disclose health data except for limited purposes, then revealed email addresses, IP addresses and health questionnaire information to Facebook, Snapchat, Criteo and Pinterest for advertising. One example in the FTC’s announcement: using email addresses and the fact that people had been in therapy to have Facebook find similar people to target. The proposed order required $7.8 million for consumers and banned sharing health data for advertising and banned sharing personal information with certain third parties for retargeting.
3. Premom, May 17, 2023. The FTC alleged that the developer of an ovulation tracking app promised in its privacy policies not to share health information without consent, then disclosed health data through third-party SDKs. It was the FTC’s second Health Breach Notification Rule action. The proposed order barred sharing health data for advertising and required consent for other sharing.
4. Monument, April 11, 2024. The FTC alleged that an alcohol addiction treatment service promised users their information would be “100% confidential” and claimed HIPAA compliance while an outside assessor it hired had found it did not fully comply. The FTC said Monument sent pixel and API events to advertising platforms with descriptive names such as “Paid: Weekly Therapy”, together with email addresses and other identifiers that let the platforms tie the events to individuals. The proposed order banned disclosing health information for advertising.
5. Cerebral, April 15, 2024. The FTC alleged that a telehealth mental health company promised “safe, secure, and discreet” services, buried data sharing disclosures in dense privacy policies, and provided sensitive information of nearly 3.2 million consumers to third parties through tracking tools. The complaint also alleged that Cerebral made cancellation a complex, multi-step process despite promising consumers they could “cancel anytime”, in violation of the Restore Online Shoppers’ Confidence Act. The proposed order required more than $7 million and banned using health information for most advertising purposes.

Six lessons for health app and telehealth marketers

Read together, the cases point to the same handful of marketing decisions.

• Your privacy promise is the standard. Every case started with a promise in a privacy policy, a signup screen or a homepage. Write only what your tracking setup actually does, and recheck it every time someone adds a tag or an SDK.
• Event names are data. A conversion event named after a therapy, a prescription or a condition tells the ad platform something about the person who triggered it. Use neutral names, and send as little as possible.
• Lookalikes and retargeting built from users are health data uses. Uploading users or patients to find similar people, or retargeting people who started a health questionnaire, were central to these cases. Build audiences from location, age and interests that say nothing about health.
• SDKs count as much as pixels. App developers often add analytics and attribution kits without reviewing what they collect. Inventory every SDK and what it sends.
• Do not imply HIPAA status. A seal suggesting HIPAA compliance (GoodRx) and a claim of HIPAA compliance (Monument) both appeared in the FTC’s allegations. Describe your actual practices instead. If you are not a covered entity, do not imply that HIPAA protects your users.
• Make cancellation as easy as signup. Subscription telehealth is a negative option business. Disclose the terms before charging and give people a simple way to cancel.

A pre-launch checklist

Before a health app or telehealth service starts paid acquisition, walk through these steps with your product, legal and marketing leads:

1. Map every data flow. List each pixel, SDK, tag manager container, server-side integration and email or SMS tool, and what each one receives.
2. Separate marketing pages from product pages. Keep advertising tags on general marketing pages and off signup, questionnaire, intake, booking and in-app screens.
3. Rewrite the privacy policy from the map. State in plain words what is shared, with whom and why, and get affirmative consent before any sharing that is not needed to provide the service.
4. Check claims in ads. Health claims need competent and reliable scientific evidence under the FTC Health Products Compliance Guidance, and testimonials need to reflect typical results. Our telehealth marketing guide covers licensure, prescribing and ad platform rules.
5. Check the platforms. Meta’s terms bar sending health information through its business tools, as our guide to Facebook and Instagram ads for medical practices explains, and Google has its own healthcare ad rules.
6. Plan for a breach. Decide who would assess an unauthorized disclosure and who would notify users, regulators and the media if the Health Breach Notification Rule applies.

If your service crosses state lines, our guide to licensure compacts and multistate telehealth ads covers state lists, ad targeting by state and location checks at booking.

How we help

We build websites and landing pages for health businesses with tracking kept off pages that collect health information, plain-language privacy pages written from an actual data map, and conversion measurement that does not send health details to ad platforms. We build with HIPAA in mind, and we confirm in writing what a BAA covers before any patient information flows through a tool; if it is not covered, we do not route patient information through it. We do not promise growth, leads or results.

Frequently asked questions

Sources

• FTC: FTC Enforcement Action to Bar GoodRx from Sharing Consumers’ Sensitive Health Info for Advertising (February 1, 2023)
• FTC: FTC to Ban BetterHelp from Revealing Consumers’ Data, Including Sensitive Mental Health Information, to Facebook and Others for Targeted Advertising (March 2, 2023)
• FTC: Ovulation Tracking App Premom Will be Barred from Sharing Health Data for Advertising Under Proposed FTC Order (May 17, 2023)
• FTC: Alcohol Addiction Treatment Firm will be Banned from Disclosing Health Data for Advertising (April 11, 2024)
• FTC: Proposed FTC Order will Prohibit Telehealth Firm Cerebral from Using or Disclosing Sensitive Data for Advertising Purposes (April 15, 2024)
• 15 U.S.C. 45, unfair methods of competition and unfair or deceptive acts or practices
• eCFR: 16 CFR Part 318, Health Breach Notification Rule
• FTC: Health Products Compliance Guidance (December 2022)

More in Health companies, vendors and employers