Cerebral Data Lawsuit: The Telehealth Privacy Case

What Cerebral Did

Cerebral is an online mental-health company that treats conditions like anxiety, depression and ADHD remotely, gathering deeply personal information from patients — including their answers to an intake questionnaire about their mental-health symptoms. According to the Federal Trade Commission, from 2019 to 2023 Cerebral embedded tracking tools on its site and apps that sent the sensitive data of roughly 3.2 million people to third parties such as Meta (Facebook), TikTok and Google for advertising — including, in some cases, the intake answers themselves, along with contact details, medical and prescription histories and insurance information. The FTC also faulted Cerebral for making cancellation difficult and other deceptive practices.

For a mental-health provider to leak what patients disclose about their symptoms to ad networks is an especially serious breach of trust.

The Settlement

In 2024, the FTC ordered Cerebral to pay more than $7 million and, importantly, barred it from using or disclosing sensitive consumer health data for advertising. The monetary piece included about $5.1 million to provide refunds to affected customers and a civil penalty (a $10 million penalty was largely suspended because Cerebral could not pay it in full, with $2 million required). Cerebral also had to tighten its data-security and privacy practices and make canceling easier.

The core remedy — a ban on monetizing sensitive health data through ad trackers — matters more than the dollar figure.

What Patients Should Know

This case is part of a broader crackdown on health and wellness apps that quietly feed sensitive data to advertising platforms. If you use telehealth or health apps, review their privacy disclosures and settings, be cautious about what you enter into intake forms, and remember that ‘health’ apps are not always bound by the same rules as your doctor’s office. Regulators are increasingly treating this kind of data-sharing as unlawful.