Gregory Hong is an IPilogue Writer and a 1L JD candidate at Osgoode Hall Law School

BetterHelp is a mental health platform that provides online mental health services, “the largest therapy platform in the world. We change the way people approach their mental health and help them tackle life’s challenges by providing accessible and affordable care. With BetterHelp, you can message a professional therapist anytime, anywhere”. reads: “Making professional therapy accessible, affordable, and convenient — so anyone who struggles with life's challenges can get help, anytime and anywhere”. Their primary business is online counseling and therapy provided online through web-based interaction and phone/text communication with professional counselors.

Privacy Misrepresentation

According to the , BetterHelp requires a questionnaire that asks for sensitive mental health information – “such as whether they have experienced depression or suicidal thoughts and are on any medications” – along with personal information. details BetterHelp’s dubious privacy practices, many of which display an egregious lack of concern for privacy interests. The complaint also details the privacy representations made by BetterHelp, some of which have been altered over time. An example of these changes was seen in the intake questionnaire, where a question asking “Are you currently taking any medication?” included a privacy statement that went through a few iterations (emphasis on alteration added in the complaint):

Up to Dec 2020: “Rest assured—any information provided in this questionnaire will stay private between you and your counselor.”

Dec 2020: “Rest assured—this information will stay private between you and your counselor”

Jan 2021: “Rest assured—your health information will stay private between you and your counselor”

Oct 2021: The statement was removed altogether

Revealing Private Information to Advertisers

The FTC release indicates that BetterHelp “did not obtain consumers’ affirmative express consent before disclosing their health data” and “failed to place any limits on how third parties could use consumers’ health information—allowing Facebook and other third parties to use that information for their own internal purposes, including for research and development or to improve advertising”. According to the complaint, BetterHelp used and revealed consumers’ email addresses, IP addresses, and health questionnaire information to Facebook, Snapchat, Criteo, and Pinterest for advertising purposes”, including “identify[ing] similar consumers and target[ing] them with advertisements for BetterHelp’s counseling service.”

The Punishment

The FTC has issued a (a legal document that outlines the terms and conditions for resolving a complaint or an investigation related to unfair or deceptive business practices) requiring that BetterHelp return funds – amounting to $7.8 million – to customers whose health data was compromised.  The proposed order also bans BetterHelp from disclosing health information for advertising, prohibits misrepresenting its sharing practices and requires several changes to company practices regarding health and personal data. BetterHelp writes in that this settlement is “no admission of wrongdoing” and that their “industry-standard practice is routinely used by some of the largest health providers, health systems, and healthcare brands”. The says that this enforcement action is not the first of its kind, as it follows the , and that “the FTC has made it clear of its intent to crack down on the trafficking in sensitive health data by businesses not strictly classified as health care providers and thus not covered by HIPAA, the federal privacy rules that govern the health care industry”. Hopefully, this sets a precedent for more stringent enforcement of good privacy practices, particularly regarding the sale of personal and health information.

The post FTC Punishes BetterHelp for Sharing Mental Health Information with Advertisers appeared first on IPOsgoode.

Nikita Munjal is a 3L JD/MBA Candidate at Osgoode Hall Law School. This article was written as a requirement for Prof. Pina D’Agostino’s IP Intensive Program.

Using the Internet inevitably requires consenting to have your personal information used, collected, and disclosed by the websites you visit. A common reason for individuals, corporations, and non-profit organizations to collect your personal information is to influence your behaviour online, from your to your . One of the most effective ways to influence consumer behaviour online is through targeted advertising.

Value for Advertisers

Access to personal information has become necessary for advertisers to convert potential leads into customers. Think back to 2012, for example, when a suggested that a statistician working at Target predicted a teenage girl’s pregnancy based on her shopping habits. What did Target do with this information? It mailed her coupons for baby clothes and cribs.

that the value of your personal information to advertisers depends on various factors. Factors influencing value include your gender, race, and sensitivity of the information (that is, cost more than ). If, for example, the target audience for a new sneaker launch is young males of middle eastern origin, the spent to acquire your personal information is a minor investment to incur to influence you to purchase $180 sneakers.

Value for Users

Traditionally, users have valued the ability to share their personal information while using online services, like search engines or social media platforms, citing their .

However, increasingly, . This trend has mobilized startups in Silicon Valley to appeal to privacy-conscious users by providing them an incentive to share their personal information. Known as paid-to-surf models, companies in this space require their users to install browser extensions to track their browsing.

What monetary value do some privacy-conscious users demand to share their personal information? $20 a month for users of . Others are . While these paid-to-surf models have the potential to be disruptive, they are not yet a viable alternative, as users must surf a certain amount before they can cash out.  

Value Going Forward

The tech industry has built empires based on collecting, using, and selling its users’ personal information to third-party advertisers. Surprisingly, some factions of the tech industry are modifying their business models to limit the tracking of personal information. Apple, for example, introduced a new iOS in 2021, s. Similarly, on its Chrome browser is estimated to impact millions of advertisers.

Apple and Google argue that these changes are necessary to respond to increasing and customer sensitivity to sharing personal information (the IPilogue has documented increased regulation in the and ). However, , including , lament that the changes are veiled anti-competitive practices.

Interestingly, increasing barriers to the online advertising ecosystem may benefit users. If access to personal information becomes impeded, interested parties may need to incentivize users to share their personal information, increasing users’ bargaining power. Although it is unclear what effect Apple and Google’s changes will have on the ecosystem, I am hopeful that users can leverage more control over their personal information for fair compensation by technology companies or advertisers for their valuable commodity.

The post How Much is Your Personal Information Worth? And What Will It Be Worth in the Future? appeared first on IPOsgoode.

M. Imtiaz Karamat is an IP Osgoode Alumnus and Associate Lawyer at Deeth Williams Wall LLP. This article was originally posted on  on June 15, 2022.

On June 2, 2022, the Supreme Court of British Columbia (the Court) issued its decision in the ongoing class action matter,��Douez v Facebook, Inc.,��, holding that Facebook, Inc. (Facebook) was liable under several provincial privacy statutes for using class members’ likenesses without their consent. 

As previously reported by the E-TIPS ® Newsletter , the representative plaintiff (Douez) brought a class action lawsuit against Facebook, claiming that Facebook used class members’ names and images in its advertising program, Sponsored Stories, without proper consent and contrary to the privacy legislation of British Columbia, Saskatchewan, Manitoba, and Newfoundland and Labrador (NFL).

Through Sponsored Stories, advertisers pay Facebook to associate their mark on Facebook’s social media website with users that performed certain social actions in connection with the advertiser (e.g. users who click the “like” button on the advertiser’s Facebook Page).  Facebook’s software increases the likelihood that the user’s social connections would see the user’s name, image, and social interaction in association with the advertiser’s mark.  The Sponsored Stories were not displayed on the user’s home page and Facebook did not inform the user when their name and image was part of a Sponsored Story.

Prior to assessing the substantive issues, the Court addressed Facebook’s argument that the Court lacked jurisdiction to hear the case.  Facebook argued that Manitoba’s The Privacy Act and the NFL’s Privacy Act expressly designate the superior courts of their respective provinces to adjudicate privacy claims and the Court was prohibited from deciding on the matter. The Court did not agree with this interpretation, relying on the constitutional principle that no province has the right to legislate extraterritorially and the legislatures of Manitoba and NFL lack legislative competence to prohibit the Court.

The Court addressed the liability issues by way of summary trial, determining that Douez had established a prima facie breach of the relevant privacy legislation and Facebook had the burden of proof to show that users provided valid consent. Facebook argued that users registering with Facebook’s social media website expressly consented to its terms of use, which included Facebook’s use of their information in Sponsored Stories.  However, the Court found that express consent was not established because the terms of use did not clearly inform users that their information would be incorporated into Sponsored Stories.  Further, the Court held that Facebook could not establish a basis for implied consent as users were not informed when their information was used in Sponsored Stories.  The Court held that the issue of remedies was “fact-intensive” and not suitable for summary trial, and therefore must be adjudicated at a conventional trial.

The post Facebook Held Liable For Using Personal Information Without Consent appeared first on IPOsgoode.