1 

2023169 

UNITED STATES OF AMERICA

BEFORE THE FEDERAL TRADE COMMISSION

COMMISSIONERS: Lina M. Khan, Chair 

Rebecca Kelly Slaughter 

Alvaro M. Bedoya 

In the Matter of

BETTERHELP, INC., a corporation,

also d/b/a COMPILE, INC., 

also d/b/a MYTHERAPIST,

also d/b/a TEEN COUNSELING,

also d/b/a FAITHFUL COUNSELING,

also d/b/a PRIDE COUNSELING,

also d/b/a ICOUNSELING,

also d/b/a REGAIN,

also d/b/a TERAPPEUTA. 

DECISION AND ORDER 

DOCKET NO. C-4796

DECISION

The Federal Trade Commission (the “FTC” or “Commission”) initiated an investigation of 

certain acts and practices of the Respondent named in the caption. The Commission’s Bureau of 

Consumer Protection (“BCP”) prepared and furnished to Respondent a draft Complaint. BCP 

proposed to present the draft Complaint to the Commission for its consideration. If issued by the 

Commission, the draft Complaint would charge the Respondent with violations of the Federal 

Trade Commission Act.

Respondent and BCP thereafter executed an Agreement Containing Consent Order (“Consent 

Agreement”). The Consent Agreement includes: 1) statements by Respondent that it neither 

admits nor denies any of the allegations in the Complaint, except as specifically stated in this 

Decision and Order, and that only for purposes of this action, it admits the facts necessary to 

establish jurisdiction; and 2) waivers and other provisions as required by the Commission’s 

Rules. 

The Commission considered the matter and determined that it had reason to believe that 

Respondent has violated the Federal Trade Commission Act, and that a Complaint should issue 

stating its charges in that respect. The Commission accepted the executed Consent Agreement 

and placed it on the public record for a period of 30 days for the receipt and consideration of 

public comments. The Commission duly considered any comments received from interested 

persons pursuant to Section 2.34 of its Rules, 16 C.F.R. § 2.34. Now, in further conformity with 
2

the procedure prescribed in Rule 2.34, the Commission issues its Complaint, makes the 

following Findings, and issues the following Order:

Findings

1. The Respondent is BetterHelp, Inc. (“BetterHelp”), also doing business as Compile, Inc.; 

MyTherapist; Teen Counseling; Faithful Counseling; Pride Counseling; iCounseling; 

ReGain; and Terappeuta, a Delaware corporation with its principal office or place of 

business at 990 Villa St., Mountain View, CA 94041.

2. The Commission has jurisdiction over the subject matter of this proceeding and over the 

Respondent, and the proceeding is in the public interest.

ORDER

Definitions

For purposes of this Order, the following definitions apply:

A. “Affirmative Express Consent” means any freely given, specific, informed, and 

unambiguous indication of an individual consumer’s wishes demonstrating agreement by 

the individual, such as by a clear affirmative action, following a Clear and Conspicuous 

disclosure to the individual of: 

1. the categories of information that will be collected;

2. the specific purpose(s) for which the information is being collected, used, or 

disclosed;

3. the names or categories of Third Parties (e.g., “analytics partners” or “advertising 

partners”) collecting the information, or to whom the information is disclosed, 

provided that if Respondent discloses the categories of Third Parties, the 

disclosure shall include a hyperlink to a separate page listing the names of the 

Third Parties;

4. a simple, easily located means by which the consumer can withdraw consent; and 

5. any limitations on the consumer’s ability to withdraw consent.

The Clear and Conspicuous disclosure must be separate from any “privacy policy,” 

“terms of service,” “terms of use,” or other similar document. 

The following do not constitute Affirmative Express Consent:

1. Inferring consent from the hovering over, muting, pausing, or closing of a given 

piece of content by the consumer; or
3

2. Obtaining consent through a user interface that has the effect of subverting or 

impairing user autonomy, decision-making, or choice. 

B. “Clear and Conspicuous” or “Clearly and Conspicuously” means that a required 

disclosure is difficult to miss (i.e., easily noticeable) and easily understandable by 

ordinary consumers, including in all of the following ways:

1. In any communication that is solely visual or solely audible, the disclosure must

be made through the same means through which the communication is presented. 

In any communication made through both visual and audible means, such as a 

television advertisement, the disclosure must be presented simultaneously in both 

the visual and audible portions of the communication even if the representation 

requiring the disclosure (“triggering representation”) is made through only one 

means.

2. A visual disclosure, by its size, contrast, location, the length of time it appears, 

and other characteristics, must stand out from any accompanying text or other 

visual elements so that it is easily noticed, read, and understood.

3. An audible disclosure, including by telephone or streaming video, must be 

delivered in a volume, speed, and cadence sufficient for ordinary consumers to 

easily hear and understand it.

4. In any communication using an interactive electronic medium, such as the 

Internet or software, the disclosure must be unavoidable.

5. The disclosure must use diction and syntax understandable to ordinary consumers

and must appear in each language in which the triggering representation appears.

6. The disclosure must comply with these requirements in each medium through 

which it is received, including all electronic devices and face-to-face 

communications.

7. The disclosure must not be contradicted or mitigated by, or inconsistent with, 

anything else in the communication.

8. When the representation or sales practice targets a specific audience, such as 

children, the elderly, or the terminally ill, “ordinary consumers” includes

reasonable members of that group.

C. “Covered Business” means Respondent and any business that Respondent controls, 

directly or indirectly.

D. “Covered Incident” means any instance of a violation of Provision I, II, or III of this 

Order.
4

E. “Covered Information” means information from or about an individual consumer, 

including: 

1. a first and last name; 

2. a physical address, including street name and name of city or town;

3. geolocation information sufficient to identify street name and name of a city or 

town;

4. an email address or other online contact information, such as a user identifier or a 

screen name; 

5. a telephone number;

6. a government-issued identification number, such as a driver’s license, military 

identification, passport, Social Security number, or other personal identification 

number; 

7. financial institution account number;

8. credit or debit card information;

9. data that depicts or describes the physical or biological traits of an identified or 

identifiable person, including depictions, descriptions, recordings, or copies of an 

individual’s facial or other physical features, finger or handprints, voice, genetics, 

or characteristic movements or gestures; 

10. a persistent identifier, such as a customer number held in a “cookie,” a static 

Internet Protocol (“IP”) address, a mobile device ID, processor serial number, or 

any other persistent identifier that can be used to recognize a user over time 

and/or across difference devices, websites, or online services;

11. Treatment Information; or

12. any individually identifiable information combined with any of (1) through (11) 

above.

F. “Covered User” means any individual consumer who created an account for the online 

properties, services, or mobile applications associated with BetterHelp before January 1, 

2021, including those properties and mobile applications associated with BetterHelp;

MyTherapist; Teen Counseling; Faithful Counseling; Pride Counseling; iCounseling;

Regain; and Terappeuta.

G. “Customer” means any individual consumer who, between August 1, 2017, and 

December 31, 2020, signed up for and paid for the use of any online property, service, or 
5

mobile application associated with BetterHelp, including those properties, services, and 

mobile applications associated with BetterHelp; MyTherapist; Teen Counseling; Faithful 

Counseling; Pride Counseling; iCounseling; Regain; and Terappeuta.

H. “Delete,” “Deleted,” or “Deletion,” means to remove Covered Information such that it is 

not maintained in retrievable form and cannot be retrieved through physical or technical 

means.

I. “Respondent” means BetterHelp, also doing business as Compile, Inc.; MyTherapist; 

Teen Counseling; Faithful Counseling; Pride Counseling; iCounseling; ReGain; and 

Terappeuta, and its successors and assigns.

J. “Third Party” means any individual or entity other than:

1. Respondent; 

2. a service provider of Respondent that: 

a. processes, uses, or receives Covered Information collected by or on behalf 

of Respondent for and at the direction of the Respondent and no other 

individual or entity, 

b. does not disclose Covered Information, or any individually identifiable 

information derived from such Covered Information, to any individual or 

entity other than Respondent or a subcontractor to such service provider 

bound to data processing terms no less restrictive than terms to which the 

service provider is bound, and 

c. does not use Covered Information for any purpose other than performing 

the services specified in the service provider’s contract with Respondent;

3. a therapist or counselor employed by or contracted with Respondent; 

4. an employee benefit program that contracts with Respondent for therapy services 

on behalf of the employee benefit program’s members, employees, and/or clients,

provided that before Respondent may disclose any information about any of those 

members, employees, and/or clients to the employee benefit program, Respondent 

must require the employee benefit plan to obtain the authorization of the 

members, employees, and/or clients for such disclosure; or 

5. any entity (including a service provider) that uses Covered Information only as 

reasonably necessary to:

a. comply with applicable law, regulation, or legal process;

b. detect, prevent, or mitigate fraud or security vulnerabilities;
6

c. debug to identify and repair errors that impair existing intended 

functionality provided that any such use is reasonably necessary and 

proportionate to achieve the purpose for which the Covered Information 

was collected or processed; or

d. undertake internal research for the technological development and 

demonstration of Respondent’s products or services provided that any 

such use is reasonably necessary and proportionate to achieve the purpose 

for which the Covered Information was collected or processed.

K. “Treatment Information” means individually identifiable information relating to the past, 

present, or future physical or mental health or condition(s) of a consumer, including:

1. drug, prescription, and pharmacy information; 

2. information concerning the consumer’s diagnosis; 

3. information concerning the consumer’s use of, creation of an account associated 

with, or response to a question or questionnaire related to, a service or product 

offered by Respondent or through one of any of Respondent’s online properties, 

services, or mobile applications;

4. information concerning medical- or health-related purchases; 

5. information concerning the past, present, or future payment for the provision of 

health care to the consumer; or

6. information derived or extrapolated from any of (1)-(5) above (e.g., proxy, 

derivative, inferred, emergent, or algorithmic data).

Provisions

I. Prohibition Against the Disclosure of Treatment Information and Covered Information 

for Certain Advertising Purposes

IT IS ORDERED that Respondent and Respondent’s officers, agents, employees, and 

attorneys, and all other persons in active concert or participation with any of them, who receive 

actual notice of this Order, whether acting directly or indirectly, are prohibited from disclosing to 

a Third Party for the purposes of advertising, marketing, promoting, offering, offering for sale, or 

selling any product or service: (1) Treatment Information; and (2) Covered Information for the 

purpose of targeting the consumer to which the disclosed information pertains. 
7

II. Affirmative Express Consent

IT IS FURTHER ORDERED that, within 30 days of the effective date of this Order, 

Respondent and Respondent’s officers, agents, employees, and attorneys, and all other persons in 

active concert or participation with any of them, who receive actual notice of this Order, in 

connection with any product or service, prior to disclosing any consumer’s Covered Information 

to any Third Party, must obtain the relevant consumer’s Affirmative Express Consent.

III. Prohibition Against Misrepresentations about Privacy of Covered Information

IT IS FURTHER ORDERED that Respondent and Respondent’s officers, agents, 

employees, and attorneys, and all other persons in active concert or participation with any of 

them, who receive actual notice of this Order, whether acting directly or indirectly, in connection 

with promoting or offering for sale any product or service must not misrepresent (or assist 

another in misrepresenting) in any manner, expressly or by implication: 

A. the extent to which Respondent collects, maintains, uses, discloses, Deletes, or permits or 

denies access to any Covered Information, or the extent to which Respondent protects the 

privacy, security, availability, confidentiality, or integrity of any Covered Information;

B. the purpose(s) for which Respondent, or any entity to whom Respondent discloses or 

permits access to Covered Information, collects, maintains, uses, discloses, or permits

access to any Covered Information;

C. the extent to which a consumer can maintain privacy and anonymity when visiting or 

using any online properties, services, or mobile applications associated with Respondent; 

D. the extent to which consumers may exercise control over Respondent’s collection of, 

maintenance of, use of, Deletion of, disclosure of, or permission of access to, Covered 

Information, and the steps a consumer must take to implement such controls; and

E. the extent to which Respondent is a member of, adheres to, complies with, is certified by, 

is endorsed by, or otherwise participates in any privacy, security or any other compliance 

program sponsored by a government or any self-regulatory or standard-setting 

organization, including the Digital Advertising Alliance, the Digital Advertising 

Accountability Program, or any entity that certifies compliance with HIPAA; and

F. the extent to which Respondent is a HIPAA-covered entity, and the extent that 

Respondent’s privacy and information practices are in compliance with HIPAA 

requirements.

IV. Data Deletion

IT IS FURTHER ORDERED that Respondent and Respondent’s officers, agents, 

employees, and attorneys, and all other persons in active concert or participation with any of 

them, who receive actual notice of this Order, must:
8

A. within 60 days after the effective date of this Order:

1. identify all Third Parties that accessed, received, or acquired Covered Information 

from Respondent in any form, including hashed or encrypted Covered Information, 

without a consumer’s Affirmative Express Consent;

2. identify what Covered Information was disclosed to each Third Party identified in 

sub-Provision IV.A.1; and

3. submit a list of the information identified in sub-Provisions IV.A.1-2 and the 

methodologies used to identify the information in sub-Provisions IV.A.1-2 to: 

DEbrief@ftc.gov or sent by overnight courier (not the U.S. Postal Service) to:

Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade 

Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject 

line must begin: “In re BetterHelp, Inc., [X-number].”

B. within 90 days after the effective date of this Order, provide a copy of the Complaint and 

Order to all Third Parties identified in sub-Provision IV.A.1, notify all such Third Parties 

in writing that the Federal Trade Commission alleges that Respondent disclosed Covered 

Information of consumers to them in a manner that was unfair or deceptive and in 

violation of the FTC Act, and instruct those Third Parties to Delete all Covered 

Information accessed, received, or acquired from Respondent without a consumer’s 

Affirmative Express Consent. Respondent’s instruction to each such Third Party shall 

include a list of the Covered Information identified in sub-Provision IV.A.2 and shall 

demand written confirmation from each such Third Party that it has Deleted such

Covered Information. Respondent must provide all instructions sent to the Third Parties 

to: DEbrief@ftc.gov or sent by overnight courier (not the U.S. Postal Service) to: 

Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade 

Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line 

must begin: “In re BetterHelp, Inc., [X-number]”

C. as of the issuance of this Order:

1. Respondent shall not disclose any Covered Information in any form, including hashed 

or encrypted Covered Information, to any Third Party identified in sub-Provision

IV.A.1 until Respondent confirms each Third Party’s receipt of the instructions 

required by sub-Provision IV.B. This sub-Provision is subject to the prohibitions set 

forth in Provision I. Respondent must provide all receipts of confirmation and any 

responses from Third Parties within five (5) days of receipt to: DEbrief@ftc.gov or 

sent by overnight courier (not the U.S. Postal Service) to: Associate Director for 

Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 

Pennsylvania Avenue NW, Washington, DC 20580. The subject line must begin: “In 

re BetterHelp, Inc., [X-number].”
9

2. Respondent shall not use any Third Party identified in sub-Provision IV.A.1 to 

advertise, market, promote, offer, offer for sale, or sell any product or service until 

Respondent confirms each Third Party’s receipt of the instructions required by subProvision IV.B.

V. Notice to Users

IT IS FURTHER ORDERED that, on or before 14 days after the effective date of this 

Order, Respondent must email all Covered Users, using the last known verified email address in 

Respondent’s possession, custody, or control, an exact copy of the notice attached hereto as 

Exhibit A (“Notice”), provided however, that if Respondent does not have email information for 

any Covered User, Respondent must send the Notice to that Covered User through Respondent’s 

primary means of communicating with that user. Respondent shall not include with the Notice 

any other information, documents, or attachments.

VI. Mandated Privacy Program

IT IS FURTHER ORDERED that any Covered Business, in connection with the 

collection, maintenance, use, or disclosure of, or provision of access to, Covered Information,

must, within 60 days of the effective date of this Order, establish and implement, and thereafter 

maintain, a comprehensive privacy program (“Privacy Program”) that protects the privacy,

security, availability, confidentiality, and integrity of such Covered Information. To satisfy this 

requirement, Respondent must, for each Covered Business, at a minimum:

A. document in writing the content, implementation, and maintenance of the Privacy 

Program;

B. provide the written program and any evaluations thereof or updates thereto to the

Covered Business’s board of directors or governing body or, if no such board or 

equivalent governing body exists, to a senior officer of the Covered Business responsible 

for the Covered Business’s Privacy Program at least once every 12 months and promptly 

(not to exceed 30 days) after a Covered Incident;

C. designate a qualified employee or employees, who report(s) directly to an executive, such 

as the Chief Executive Officer, Chief Compliance Officer, or Chief Legal Officer, to 

coordinate and be responsible for the Privacy Program; and keep the executive and the 

Board of Directors informed of the Privacy Program, including all actions and procedures 

implemented to comply with the requirements of this Order, and any actions and 

procedures to be implemented to ensure continued compliance with this Order;

D. assess and document, at least once every 12 months and promptly (not to exceed 30 days) 

following a Covered Incident, internal and external risks in each area of the Covered 

Business’s operations to the privacy, security, availability, confidentiality, and integrity 

of Covered Information that could result in the unauthorized access, collection, use, 

destruction, or disclosure of, or provision of access to, Covered Information;
10

E. design, implement, maintain, and document safeguards that control for the internal and 

external risks to the privacy, security, availability, confidentiality, and integrity of 

Covered Information identified by the Covered Business in response to sub-Provision 

VI.D. Each safeguard must be based on the volume and sensitivity of the Covered 

Information that is at risk, and the likelihood that the risk could be realized and result in 

the unauthorized access, collection, use, Deletion, disclosure of, or provision of access to,

the Covered Information. Such safeguards must also include:

1. policies, procedures, and technical measures to systematically inventory Covered 

Information in the Covered Business’s control and Delete Covered Information that is 

no longer reasonably necessary and in accordance with applicable retention laws and 

regulations;

2. policies, procedures, and technical measures to prevent the collection, maintenance, 

use, or disclosure of, or provision of access to, Covered Information inconsistent with 

the Covered Business’s representations to consumers;

3. audits, assessments, and reviews of the contracts, privacy policies, and terms of 

service associated with any Third Party to which the Covered Business discloses, or 

provides access to, Covered Information;

4. policies and technical measures that limit employee and contractor access to Covered 

Information to only those employees and contractors with a legitimate business need 

to access such Covered Information;

5. mandatory privacy training programs for all employees on at least an annual basis, 

updated to address the collection, use, and disclosure of Covered Information for 

advertising purposes; any internal or external risks identified by Respondent in subProvision VI.D; and safeguards implemented pursuant to sub-Provision VI.E, that 

include training on the requirements of this Order;

6. a data retention policy that, at a minimum, includes:

a. a retention schedule that limits the retention of Covered Information for only as 

long as is necessary to fulfill the purpose for which the Covered Information was 

collected; provided, however, that such Covered Information need not be Deleted, 

and may be disclosed, to the extent requested by a government agency or required 

by law, regulation, or court order; and

b. a requirement that Respondent documents, adheres to, and makes publicly

available on its terms of service/use a retention schedule for Covered Information, 

setting forth: (1) the purposes for which the Covered Information is collected; (2) 

the specific business need for retaining each type of Covered Information; and (3) 

a set timeframe in accordance with applicable laws and regulations for Deletion of 

each type of Covered Information (absent any intervening Deletion requests from 

consumers) that precludes indefinite retention of any Covered Information;
11 

7. for each product or service, policies and procedures to document internally the 

decision to collect, use, Delete, disclose, or provide access to, each type of Covered 

Information. Such documentation should include: (a) the name(s) of the person(s)

who made the decision; (b) for what purpose the type of Covered Information is being 

collected; (c) the data segmentation controls in place to ensure that the Covered 

Information collected is only used and/or disclosed for the particular purpose(s) for 

which it was collected; (d) the data retention limit set and the technical means for 

achieving Deletion; (e) the safeguards in place to prevent unauthorized disclosure of 

each type of Covered Information; and (f) the access controls in place to ensure only 

authorized employees with a need-to-know have access to the Covered Information; 

8. audits, assessments, reviews, or testing of each mechanism by which the Covered 

Business discloses Covered Information to a Third Party or provides a Third Party 

with access to Covered Information (including but not limited to web beacons, pixels, 

and Software Development Kits); and

9. for each product or service offered by any Covered Business, Clearly and 

Conspicuously disclose the categories of Covered Information collected from 

consumers, the purposes for the collection of each category of Covered Information, 

and any transfer of Covered Information to a Third Party. For each such transfer of 

Covered Information, the disclosure must, at a minimum, include: (a) the specific 

categories of Covered Information transferred; (b) the identity of each Third Party 

receiving the transfer; (c) the purposes for which the Covered Business transferred the 

Covered Information; (d) the purposes for which each Third Party receiving the 

Covered Information may use the Covered Information, including but not limited to 

the purposes for the Third Party reserves the right to use such Covered Information; 

and (e) whether each Third Party receiving the transfer of Covered Information 

reserves the right to transfer the Covered Information to other entities or individuals. 

F. assess, at least once every 12 months, and promptly (not to exceed 30 days) following a 

Covered Incident, the sufficiency of any safeguards in place to address the internal and 

external risks to the privacy, security, availability, confidentiality, and integrity of 

Covered Information, and modify the Privacy Program based on the results; 

G. test and monitor the effectiveness of the safeguards at least once every 12 months, and 

promptly (not to exceed 30 days) following a Covered Incident, and modify the Privacy 

Policy based on the results; 

H. select and retain service providers capable of safeguarding Covered Information they 

receive from the Covered Business, and contractually require service providers to 

implement and maintain safeguards for Covered Information; and 

I. evaluate and adjust the Privacy Program in light of any material changes to the Covered 

Business’s operations or business arrangements, the results of the testing and monitoring 

required by sub-Provision VI.G, a Covered Incident, and any other circumstances that the 
12

Covered Business knows or has reason to believe may have a material impact on the 

effectiveness of the Privacy Program or any of its individual safeguards (including but 

not limited to new or more efficient technological or operational methods to control for 

the risks identified in sub-Provision VI.D). The Covered Business may make this 

evaluation and adjustment to the Privacy Program at any time, but must, at a minimum, 

evaluate the Privacy Program at least once every 12 months and modify the Privacy 

Program as necessary based on the results.

VII. Privacy Assessments by a Third-Party Assessor

IT IS FURTHER ORDERED that, in connection with its compliance with Provision 

VI, for any Covered Business that collects, maintains, uses, discloses, or provides access to 

Covered Information, Respondent must obtain initial and biennial assessments (“Assessments”):

A. The Assessments must be obtained from a qualified, objective, independent third-party 

professional (“Assessor”), who: (1) uses procedures and standards generally accepted in 

the profession; (2) conducts an independent review of the Privacy Program; (3) retains all 

documents relevant to each Assessment for 5 years after completion of such Assessment; 

and (4) will provide such documents to the Commission within 10 days of receipt of a 

written request from a representative of the Commission. No documents may be withheld 

on the basis of a claim of confidentiality, proprietary or trade secrets, work product 

protection, attorney-client privilege, statutory exemption, or any similar claim. The 

Assessor must have a minimum of 3 years of experience in the field of privacy and data 

protection.

B. For each Assessment, Respondent must provide the Associate Director for Enforcement 

for the Bureau of Consumer Protection at the Federal Trade Commission with the name, 

affiliation, and qualifications of the proposed Assessor, whom the Associate Director 

shall have the authority to approve in his or her sole discretion.

C. The reporting period for the Assessments must cover: (1) the first 240 days after the 

issuance date of the Order for the initial Assessment; and (2) each 2-year period 

thereafter for 20 years after the issuance date of the Order for the biennial Assessments. 

D. Each Assessment must, for the entire assessment period:

1. determine whether Respondent has implemented and maintained the Privacy Program 

required by Provision VI;

2. assess the effectiveness of Respondent’s implementation and maintenance of subProvisions VI.A-I;

3. identify any gaps or weaknesses in the Privacy Program, or instances of material 

noncompliance with, sub-Provisions VI.A-I;
13

4. address the status of gaps or weaknesses in the Privacy Program, as well as any 

instances of material non-compliance with sub-Provisions VI.A-I, that were identified 

in any prior Assessment required by this Order; and

5. identify specific evidence (including, but not limited to, documents reviewed, 

sampling and testing performed, and interviews conducted) examined to make such 

determinations, assessments, and identifications, and explain why the evidence that 

the Assessor examined is (a) appropriate for assessing an enterprise of Respondent’s 

size, complexity, and risk profile; and (b) sufficient to justify the Assessor’s findings. 

No finding of any Assessment shall rely solely on assertions or attestations by 

Respondent, Respondent’s management, or a Covered Business’s management. The 

Assessment must be signed by the Assessor, state that the Assessor conducted an 

independent review of the Privacy Program and did not rely solely on assertions or 

attestations by Respondent, Respondent’s management, or a Covered Business’s 

management, and state the number of hours that each member of the Assessor’s

assessment team worked on the Assessment. To the extent a Covered Business 

revises, updates, or adds one or more safeguards required under sub-Provision VI.E in 

the middle of an Assessment period, the Assessment must assess the effectiveness of 

the revised, updated, or added safeguard(s) for the time period in which it was in 

effect, and provide a separate statement detailing the basis for each revised, updated, 

or additional safeguard.

E. Each Assessment must be completed within 60 days after the end of the reporting period 

to which the Assessment applies. Unless otherwise directed by a Commission 

representative in writing, Respondent must submit the initial Assessment to the 

Commission within 10 days after the Assessment has been completed via email to 

DEbrief@ftc.gov or by overnight courier (not the U.S. Postal Service) to: Associate 

Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 

600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must begin, “In 

re BetterHelp, Inc., [X-number].” All subsequent biennial Assessments must be retained 

by Respondent until the Order is terminated and provided to the Associate Director for 

Enforcement within 10 days of request.

VIII. Cooperation with Assessor

IT IS FURTHER ORDERED that Respondent, whether acting directly or indirectly, in 

connection with the Assessments required by Provision VII, must:

A. provide or otherwise make available to the Assessor all information and material in its 

possession, custody, or control that is relevant to the Assessment for which there is no 

reasonable claim of privilege; 

B. provide or otherwise make available to the Assessor information about all Covered 

Information in Respondent’s custody or control so that the Assessor can determine the 

scope of the Assessment; and
14

C. disclose all material facts to the Assessor, and not misrepresent in any manner, expressly 

or by implication, any fact material to the Assessor’s: (1) determination of whether 

Respondent has implemented and maintained the Privacy Program required by Provision 

VI; (2) assessment of the effectiveness of the implementation and maintenance of subProvisions VI.A-I; or (3) identification of any gaps or weaknesses in, or instances of 

material noncompliance with, the Privacy Program required by Provision VI.

IX. Annual Certification

IT IS FURTHER ORDERED that Respondent must:

A. one year after the issuance date of this Order, and each year thereafter for 10 years, 

provide the Commission with a certification from a senior corporate manager, or, if no 

such senior corporate manager exists, a senior officer of each Covered Business that: (1) 

the Covered Business has established, implemented, and maintained the requirements of 

this Order; (2) the Covered Business is not aware of any material noncompliance that has 

not been (a) corrected or (b) disclosed to the Commission; and (3) includes a brief 

description of any Covered Incident. The certification must be based on the personal 

knowledge of the senior corporate manager, senior officer, or subject matter experts upon 

whom the senior corporate manager or senior officer reasonably relies in making the 

certification.

B. unless otherwise directed by a Commission representative in writing, submit all annual 

certifications to the Commission pursuant to this Order via email to DEbrief@ftc.gov or 

by overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, 

Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue 

NW, Washington, DC 20580. The subject line must begin, “In re BetterHelp, Inc., [Xnumber].”

X. Covered Incident Reports 

IT IS FURTHER ORDERED that Respondent, within 30 days after Respondent’s 

discovery of a Covered Incident, must submit a report to the Commission. The report must 

include, to the extent possible:

A. the date, estimated date, or estimated date range when the Covered Incident occurred;

B. a description of the facts relating to the Covered Incident, including the causes and scope 

of the Covered Incident, if known; 

C. the number of consumers whose information was affected; 

D. the acts that Respondent has taken to date to remediate the Covered Incident; protect 

Covered Information from further disclosure, exposure, or access; and protect affected 

individuals from identity theft or other harm that may result from the Covered Incident; 

and 
15

E. a representative copy of any materially different notice sent by Respondent to consumers 

or to any U.S. federal, state, or local government entity.

Unless otherwise directed by a Commission representative in writing, all Covered Incident 

reports to the Commission pursuant to this Order must be emailed to DEbrief@ftc.gov or sent by 

overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, Bureau of 

Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, 

DC 20580. The subject line must begin: “In re BetterHelp, Inc., [X-number].”

XI. Monetary Relief

IT IS FURTHER ORDERED that:

A. Respondent must pay to the Commission $7,800,000, which Respondent stipulates its

undersigned counsel holds in escrow for no purpose other than payment to the 

Commission.

B. Such payment must be made within 8 days of the effective date of this Order by 

electronic fund transfer in accordance with instructions provided by a representative of 

the Commission.

XII. Additional Monetary Provisions

IT IS FURTHER ORDERED that:

A. Respondent relinquishes dominion and all legal and equitable right, title, and interest in 

all assets transferred pursuant to this Order and may not seek the return of any assets.

B. The facts alleged in the Complaint will be taken as true, without further proof, in any 

subsequent civil litigation by or on behalf of the Commission to enforce its rights to any 

payment pursuant to this Order, such as a nondischargeability complaint in any 

bankruptcy case.

C. The facts alleged in the Complaint establish all elements necessary to sustain an action by 

or on behalf of the Commission pursuant to Section 523(a)(2)(A) of the Bankruptcy 

Code, 11 U.S.C. § 523(a)(2)(A), and this Order will have collateral estoppel effect for 

such purposes.

D. All money paid to the Commission pursuant to this Order may be deposited into a fund 

administered by the Commission or its designee to be used for relief, including consumer 

redress and any attendant expenses for the administration of any redress fund. If a 

representative of the Commission decides that direct redress to consumers is wholly or 

partially impracticable or money remains after redress is completed, the Commission may 

apply any remaining money for such other relief (including consumer information 

remedies) as it determines to be reasonably related to Respondent’s practices alleged in 
16

the Complaint. Any money not used is to be deposited to the U.S. Treasury. Respondent 

has no right to challenge any activities pursuant to this Provision.

E. All decisions regarding the administration and amount of redress provided shall be made 

by the Commission in its sole discretion; however, the names and identifying information 

of all consumers who receive redress shall be provided solely to the Redress 

Administrator pursuant to Provision XIII.

F. In the event of default on any obligation to make payment under this Order, interest, 

computed as if pursuant to 28 U.S.C. § 1961(a), shall accrue from the date of default to 

the date of payment. In the event such default continues for 10 days beyond the date that 

payment is due, the entire amount will immediately become due and payable.

G. Each day of nonpayment is a violation through continuing failure to obey or neglect to 

obey a final order of the Commission and thus will be deemed a separate offense and 

violation for which a civil penalty shall accrue.

H. Respondent acknowledges that its Taxpayer Identification Numbers (Social Security or 

Employer Identification Numbers), which Respondent has previously submitted to the 

Commission, may be used for collecting and reporting on any delinquent amount arising 

out of this Order, in accordance with 31 U.S.C. § 7701.

XIII. Independent Redress Administrator

IT IS FURTHER ORDERED that an independent redress administrator 

(“Administrator”) shall be appointed to assist with the efficient administration of consumer 

redress:

A. Commission staff, in their sole discretion, shall select the Administrator, who shall be an 

independent third party, not an employee of the Commission or Respondent.

B. Within 7 days of entry of this Order, Respondent must provide the Administrator with all 

information necessary to identify all Customers and all information necessary for the 

efficient administration of consumer redress to those Customers. Respondent stipulates it 

has provided such information to its undersigned counsel. If a representative of the 

Commission or the Administrator requests any additional information related to 

consumer redress, Respondent must provide it, in the form prescribed by the Commission 

or the Administrator, within 14 days of the request, provided that, any request for 

personally identifying Customer information shall be directed solely to the Administrator.

C. The Administrator shall be responsible for reviewing, assessing, and evaluating the 

Customer information for consumer redress, and for ensuring the efficient administration 

of consumer redress as follows:

1. The Administrator shall receive, review, and assess the Customer information 

provided by Respondent to ensure it is sufficient for the efficient administration of 
17

consumer redress as determined by the Commission. If a representative of the 

Commission requests any additional information related to redress, the 

Administrator must provide it, in the form prescribed by the Commission, within 

14 days, provided however, that the Administrator may not share personally 

identifying Customer information with the Commission.

2. Within 45 days of entry of this Order, the Administrator shall confirm in writing 

that it has a complete list of Customers, or that the Administrator does not and 

why not.

3. The Administrator is responsible for conducting supplemental address searches or 

other inquiries related to consumer redress if the Commission or the 

Administrator determines it necessary or advisable.

4. The Administrator is authorized to choose, engage, and employ service providers

as the Administrator deems advisable or necessary in the performance of the 

Administrator’s duties and responsibilities under the authority granted by this 

Order. The Administrator may only employ service providers capable of 

safeguarding Customer information they receive from the Administrator, and the 

Administrator must contractually require service providers to implement and 

maintain safeguards for such Customer information.

5. The Administrator shall administer consumer redress as specified by the 

Commission. The Administrator must follow all instructions dictated by the 

Commission for the efficient administration of consumer redress, including but 

not limited to instructions pertaining to consumer communications and redress 

process and distributions.

6. The Administrator must cooperate with the Commission to request the transfer of 

funds necessary for consumer redress distribution.

7. No later than three months after the date on which the Administrator is retained, 

and every three months thereafter until such time the Commission determines the 

administration of consumer redress has concluded, the Administrator shall submit 

a report to the Commission concerning the status of consumer redress and

detailing the progress of the administration of consumer redress, including but not 

limited to the amounts of funds distributed for redress payment, the consumer 

participation rate, the length of time for consumers to receive redress payment, 

and any complaints received regarding consumer redress.

D. Respondent shall fully cooperate with and assist the Administrator. That cooperation and 

assistance shall include, but not be limited to, providing information to the Administrator 

as the Administrator deems necessary to be fully informed and discharge the 

responsibilities of the Administrator under this Order. For matters concerning this Order, 

the Administrator is authorized to communicate directly with Respondent.
18 

E. Respondent is responsible for all costs and fees invoiced by the Administrator for its 

services, and the provision of consumer redress. The FTC is not responsible for any such 

costs or fees. None of the funds used to satisfy Provision XI of this Order shall be used to 

pay for the Administrator or any of its associated costs or fees.

XIV. Acknowledgments of the Order

IT IS FURTHER ORDERED that Respondent obtain acknowledgments of receipt of 

this Order:

A. Respondent, within 10 days after the effective date of this Order, must submit to the 

Commission an acknowledgment of receipt of this Order sworn under penalty of perjury. 

B. For 10 years after the issuance date of this Order, Respondent must deliver a copy of this 

Order to: (1) all principals, officers, directors, and LLC managers and members; (2) all 

employees having managerial responsibilities for conduct related to the subject matter of 

the Order and all agents and representatives who participate in conduct related to the 

subject matter of the Order; and (3) any business entity resulting from any change in 

structure as set forth in Provision XV. Delivery must occur within 10 days after the 

effective date of this Order for current personnel. For all others, delivery must occur 

before they assume their responsibilities.

C. From each individual or entity to which Respondent delivered a copy of this Order, that 

Respondent must obtain, within 30 days, a signed and dated acknowledgment of receipt 

of this Order.

XV. Compliance Reports and Notices

IT IS FURTHER ORDERED that Respondent makes timely submissions to the 

Commission:

A. One hundred and eighty days after the effective date of this Order, and annually 

thereafter for five more years, Respondent must submit a compliance report, sworn under 

penalty of perjury, in which Respondent must: (a) identify the primary physical, postal, 

and email address and telephone number, as designated points of contact, which 

representatives of the Commission, may use to communicate with Respondent; (b) 

identify all of that Respondent’s businesses by all of their names, telephone numbers, and 

physical, postal, email, and Internet addresses; (c) describe the activities of each business, 

including the services offered, the means of advertising and marketing, what Covered 

Information it collects, how Covered Information is used and disclosed to Third Parties; 

(d) describe in detail whether and how Respondent is in compliance with each Provision 

of this Order, including a discussion of all of the changes Respondent made to comply 

with the Order; and (e) provide a copy of each Acknowledgment of the Order obtained 

pursuant to this Order, unless previously submitted to the Commission. 
19 

B. Respondent must submit a compliance notice, sworn under penalty of perjury, within 14 

days of any change in: (a) any designated point of contact; or (b) the structure of any 

Covered Business, including: creation, merger, sale, or dissolution of the entity or any 

subsidiary, parent, or affiliate that engages in any acts or practices subject to this Order. 

C. Respondent must submit notice of the filing of any bankruptcy petition, insolvency 

proceeding, or similar proceeding by or against such Respondent within 14 days of its 

filing.

D. Any submission to the Commission required by this Order to be sworn under penalty of 

perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by 

concluding: “I declare under penalty of perjury under the laws of the United States of 

America that the foregoing is true and correct. Executed on: _____” and supplying the 

date, signatory’s full name, title (if applicable), and signature. 

E. Unless otherwise directed by a Commission representative in writing, all submissions to 

the Commission pursuant to this Order must be emailed to DEbrief@ftc.gov or sent by 

overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, 

Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue 

NW, Washington, DC 20580. The subject line must begin: “In re BetterHelp, Inc., [Xnumber].” 

XVI. Recordkeeping

IT IS FURTHER ORDERED that Respondent must create certain records for 20 years after 

the issuance date of the Order, and retain each such record for 5 years, unless otherwise specified 

below. Specifically, Respondent for each Covered Business, must create and retain the following 

records:

A. accounting records showing the revenues from all products or services sold, the costs 

incurred in generating those revenues, and resulting net profit or loss; 

B. personnel records showing, for each person providing services in relation to any aspect of 

the Order, whether as an employee or otherwise, that person’s: name; addresses; 

telephone numbers; job title or position; dates of service; and (if applicable) the reason 

for termination;

C. copies or records of all consumer complaints and refund requests concerning the 

collection, use, maintenance, disclosure, deletion, or permission of access to Covered 

Information, whether received directly or indirectly, such as through a Third Party, and 

any response; 

D. records of all disclosures of consumers’ Covered Information to Third Parties showing, 

for each Third Party that received Covered Information, the name and address of the 

Third Party, the date(s) of such disclosures, the purpose(s) for which the Covered 
20 

Information was transferred, and how and when Respondent obtained consumers’ 

Affirmative Express Consent for the disclosures in accordance with Provision II; 

E. a copy of each unique advertisement or other marketing material making a representation 

subject to this Order; 

F. a copy of each widely disseminated representation by Respondent that describes the 

extent to which Respondent maintains or protects the privacy, security, availability, 

confidentiality, or integrity of any Covered Information, including any representation 

concerning a change in any website or other service controlled by Respondent that relates 

to the privacy, security, availability, confidentiality, or integrity of Covered Information; 

G. for 5 years after the date of preparation of each Assessment required by Provision VII, all 

materials relied upon to prepare the Assessment, whether prepared by or on behalf of 

Respondent, including all plans, reports, studies, reviews, audits, audit trails, policies, 

training materials, and assessments, and any other materials concerning Respondent’s 

compliance with related Provisions of this Order, for the compliance period covered by 

such Assessment;

H. for 5 years from the date received, copies of all subpoenas and other communications 

with law enforcement, if such communication relate to Respondent’s compliance with 

this Order;

I. for 5 years from the date created or received, all records, whether prepared by or on 

behalf of Respondent, that tend to show any lack of compliance by Respondent with this 

Order; and

J. all records necessary to demonstrate full compliance with each Provision of this Order, 

including all submissions to the Commission. 

XVII. Compliance Monitoring 

IT IS FURTHER ORDERED that, for the purpose of monitoring Respondent’s 

compliance with this Order:

A. Within 10 days of receipt of a written request from a representative of the Commission, 

Respondent must: submit additional compliance reports or other requested information, 

which must be sworn under penalty of perjury, and produce records for inspection and 

copying. 

B. For matters concerning this Order, representatives of the Commission are authorized to 

communicate directly with Respondent. Respondent must permit representatives of the 

Commission to interview anyone affiliated with Respondent who has agreed to such an 

interview. The interviewee may have counsel present.
21 

C. The Commission may use all other lawful means, including posing through its

representatives as consumers, suppliers, or other individuals or entities, to Respondent or

any individual or entity affiliated with Respondent, without the necessity of identification

or prior notice. Nothing in this Order limits the Commission’s lawful use of compulsory

process, pursuant to Sections 9 & 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-1.

XVIII. Order Effective Dates

IT IS FURTHER ORDERED that this Order is final and effective upon the date of its 

publication on the Commission’s website (ftc.gov) as a final order. This Order will terminate 20 

years from the date of its issuance (which date may be stated at the end of this Order, near the 

Commission’s seal), or 20 years from the most recent date that the United States or the 

Commission files a complaint (with or without an accompanying settlement) in federal court 

alleging any violation of this Order, whichever comes later; provided, however, that the filing of 

such a complaint will not affect the duration of: 

A. any Provision in this Order that terminates in less than 20 years;

B. this Order’s application to Respondent that is not named as a defendant in such

complaint; and

C. this Order if such complaint is filed after the Order has terminated pursuant to this

Provision.

Provided, further, that if such complaint is dismissed or a federal court rules that Respondent did 

not violate any Provision of the Order, and the dismissal or ruling is either not appealed or 

upheld on appeal, then the Order will terminate according to this Provision as though the 

complaint had never been filed, except that the Order will not terminate between the date such 

complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date 

such dismissal or ruling is upheld on appeal. 

By the Commission. 

 April J. Tabor 

 Secretary 

SEAL:

ISSUED: July 7, 2023
22 

Exhibit A

Notice to Covered Users

[Subject: The Federal Trade Commission Alleges That We Shared Information About You 

Without Your Permission] 

[To appear with the BetterHelp logo] 

Hello, 

We are contacting you because you used BetterHelp’s services (or its partner services Pride 

Counseling, Teen Counseling, Faithful Counseling, iCounseling, ReGain, or Terappeuta) or 

created an account for one of these services between January 2013 and December 2020. When 

you used our services, we promised to keep your personal health information private. The 

Federal Trade Commission (“FTC”) alleges that we shared health information about you to other 

companies without your approval.   

What happened?  

The FTC alleges that we shared information about you, including information that could be used 

to identify you, with Facebook, Inc. (now “Meta”); Snapchat (Snap Inc.); Pinterest; and/or 

Criteo. The FTC alleges that this information may have included: 

• Your hashed email address, which these companies used to identify you if you had an 

account with them 

• The IP address that may identify your device when you access our service

• If you answered “yes” to the Intake Questionnaire question “Have you ever been in 

therapy before?” 

• If you answered “good” or “fair” to the Intake Questionnaire question “How would you 

rate your current financial status?”

The FTC alleges that, in many cases, the companies we shared your information with linked it 

with your accounts on their platforms so we could show ads to you or people like you. 

We didn’t share your messages, transcripts of conversations, sessions data, journal entries, 

worksheets, or any other type of communications between you and your therapist with these 

companies.
23 

What are we doing in response? 

We have entered into an agreement with the FTC relating to the sharing of this information. To 

resolve the case: 

• We’ll tell the advertising companies that received your information to delete it.

• We aren’t sharing your health information with other companies for advertising anymore.

And we aren’t sharing your personal information for advertising without your permission.

• We’ll enhance our privacy program to better protect your personal health information. An

independent third party will audit our program to make sure we’re protecting your

information. These audits will happen every two years for the next 20 years.

Learn more

If you have any questions, email us at [email address]. 

To learn more about the settlement, go to ftc.gov and search for “BetterHelp.” 

For advice on protecting your health privacy, read the FTC’s Does your health app protect your 

sensitive info?