Telehealth Advertising Rules After the FTC Cases: What the Orders Ban, the Breach Rule and the Tracking Guidance

A telehealth company can sit under several regimes at once. Which ones apply depends on three facts: whether it is a HIPAA covered entity, what it treats, and how it sells its subscriptions.

Two terms recur in the table. Protected health information is health data that a HIPAA covered entity or its vendor holds. A business associate agreement is the contract a covered entity signs with a vendor before that vendor receives such data.

The five orders share a template. Each bars the company from sharing health information for advertising, demands affirmative consent for most other sharing, and makes it ask recipients to delete what they received. They differ in money, in scope and in whether consent can open the door to advertising use.

What the orders require. These are court orders and an administrative order. They bind the named companies only. BetterHelp's order, for example, lists its duties by part. Part I bans sharing health information "for advertising" and personal information for "re-targeting". Part II requires affirmative express consent before any other sharing (88 FR 15717). Part IV makes BetterHelp ask each recipient to delete what it received.

What the FTC alleged. The complaints describe the same mechanics. BetterHelp's intake questionnaire asked about mental health, and the company told users their information would "stay private between you and your counselor". It then used that data for advertising, according to the FTC's analysis (88 FR 15717). Cerebral's complaint listed prescription history, pharmacy and insurance data and appointment dates sent through pixels (Arnold & Porter). The Monument and Cerebral complaints also cited the Opioid Addiction Recovery Fraud Prevention Act, because both treated substance use (Choate).

Claims in the ads themselves. The orders also reach marketing copy. BetterHelp showed a HIPAA seal and told consumers it was "HIPAA certified", which the FTC called misleading because no government agency certifies HIPAA compliance (88 FR 15717). Cerebral promised that treatment data would stay "confidential", "secure" and "private" (Arnold & Porter). A privacy claim in an ad is therefore a factual claim about data flows.

What practitioners take from them (practice, not law). Counsel for telehealth companies tend to read the orders as the FTC's checklist. They map every tag, SDK and server-side event on intake and checkout. They separate health-context events from general analytics, and they keep the consent record for each third party. The settlement amounts for these and later cases sit in our pixel problem enforcement timeline.

What the rule requires. The FTC published the amended rule on 30 May 2024 and it took effect on 29 July 2024 (89 FR 47028). The eCFR, current to 5 November 2026, shows no later amendment to Part 318 (eCFR). Five provisions matter for advertising:

1. Breach of security includes "an unauthorized acquisition of unsecured PHR identifiable health information" that "occurs as a result of a data breach or an unauthorized disclosure" (§ 318.2).
2. Covered health care provider now includes "any other entity furnishing health care services or supplies" (§ 318.2).
3. Health care services or supplies means any website, app or connected device that tracks conditions, medications, fertility, sexual health, sleep, mental health, diet and similar data (§ 318.2).
4. Timing. Individual notice goes out within 60 calendar days of discovery. The FTC gets notice at the same time when 500 or more people are affected (§ 318.4).
5. Penalties. A violation counts as a violation of a trade regulation rule, so civil penalties apply (§ 318.7).

What regulators have said. When the rule was amended, the FTC noted it had brought two cases under it, GoodRx and Premom (89 FR 47028, preamble). BetterHelp's complaint had no breach-rule count, which one commissioner's statement welcomed (88 FR 15717). The Hims & Hers complaint of 2026 also did not rely on the rule, according to Venable (Venable, 10 August 2026).

A worked example. A menopause telehealth app is not a HIPAA covered entity. Its intake quiz fires a "quiz completed" event with a hashed email to an ad platform, and users did not agree to that sharing. Under the rule's text, that is an unauthorized disclosure of identifiable health information, so it can be a breach. If 2,000 users were affected, the app would owe individual notices within 60 days and a same-time notice to the FTC (§ 318.4). Whether the app is a "vendor of personal health records" is the threshold question for counsel.

What practitioners do (practice). Many health app teams now treat a misconfigured tag like a data incident. The incident plan names the ad platforms, the events sent and the dates, so the 60-day clock in § 318.4 can be assessed quickly.

What the law covers. HIPAA's Privacy Rule protects individually identifiable health information that covered entities and business associates hold. A telehealth provider that is a covered entity needs an authorization before using that information for marketing; the details sit on our HIPAA marketing rule page.

What HHS said. In December 2022, HHS's Office for Civil Rights issued a bulletin on online tracking technologies, and it revised the bulletin on 18 March 2024 (AHA v. Becerra, opinion, pp. 3 to 4). The court described the contested part as the "Proscribed Combination". That is the link between a person's IP address and a visit to an unauthenticated public web page about specific health conditions or providers.

What the court decided. On 20 June 2024, Judge Mark Pittman declared the Proscribed Combination, "as set forth in the HHS Bulletin of March 18, 2024", unlawful and vacated it. He denied a permanent injunction (opinion, pp. 30 to 31). A footnote says the vacatur should not be read as limiting "other guidance in the germane HHS document". HHS dropped its appeal at the end of August 2024 (The Record, 30 August 2024).

What remains. The ruling removed one example. It left the rest of the bulletin, including its treatment of logged-in pages such as patient portals. A telehealth intake flow that runs after login, or that identifies the patient, is outside the vacated example. The FTC and state laws also reach public pages that HIPAA may not. Our guide to HIPAA and programmatic advertising shows architectures that keep protected data away from ad platforms.

Washington. The My Health My Data Act applies to companies inside or outside the state that target Washington consumers. Since 31 March 2024, a regulated entity may collect consumer health data only with consent or as necessary for a requested service. Sharing needs a consent "separate and distinct" from the consent to collect (RCW 19.373.030).

Geofences around in-person health care providers are unlawful for tracking, data collection or ads (RCW 19.373.080). A violation is an unfair or deceptive act under the Consumer Protection Act, which opens the door to private suits (RCW 19.373.090). Our Washington My Health My Data Act page covers the MHMDA in depth.

Other states. Nevada's consumer health data law follows Washington's consent structure without a private suit; see our Nevada page. Connecticut added health-data rules to its general privacy act, covered on our Connecticut page.

Maryland bans the sale of sensitive data outright (Md. Code, Com. Law 14-4707), as our Maryland page explains. A California telehealth provider also answers to the state's medical information act; see the California page.

New York's health information privacy bill, S9269, passed both houses on 3 and 4 June 2026 and had not been delivered to the Governor on 9 November 2026 (New York State Senate, S9269). Our New York Health Information Privacy Act page tracks it. The state health privacy laws tracker compares all of them, and the US state privacy laws tracker covers sensitive-data consent in the 24 comprehensive laws.

What practitioners do (practice). A telehealth company that advertises nationally usually designs for the strictest state rather than state by state. That means two consents, collect and share, before any health event reaches an ad platform.

The 2025 and 2026 actions widen the focus from data sharing to pricing, results claims and drug promotion. Each row gives its status on 9 November 2026. Earlier cases and class-action settlements are in our pixel problem timeline.

What the Hims & Hers complaint adds. The complaint is the first FTC health case to name a server-side conversion tool alongside pixels, according to Baker Donelson (Baker Donelson, 25 August 2026). It pleads Section 5, ROSCA and state consumer protection law (Alston & Bird). These are allegations, and the company disputes them. Sources differ on whether the California party is the Attorney General or Los Angeles County.

What the FDA letters add. Drug claims are a separate exposure. The AP reported that the September 2025 letters used "cease and desist" language, and that a presidential memo had directed truthful drug ads on television, social media and websites (Fortune). A telehealth company that runs drug ads may also find our pharma programmatic advertising guide useful.

These points turn on facts or interpretation that primary sources do not settle. Each one changes the answer for a specific company.

1. Is the telehealth company a HIPAA covered entity? Many cash-pay services are not. The answer decides whether HHS guidance or the FTC breach rule applies to the same pixel.
2. Who is a "third party service provider" under the breach rule? An ad platform that receives events may be a recipient of an unauthorized disclosure, or a contracted service provider. The rule's text does not resolve it for advertising.
3. Will the FTC keep using the breach rule? Its two cases date from 2023 (89 FR 47028, preamble). The 2026 Hims & Hers complaint did not plead it.
4. Do server-side events count as "sharing" under state law? Washington's definition covers disclosing data to a third party. Whether a hashed, server-sent event qualifies has not been tested in court as far as we found.
5. How far does consent reach? GoodRx and BetterHelp can still share some data with consent; Cerebral cannot use health data for most advertising even with it.

1. Federal Trade Commission, Health Breach Notification Rule, final rule, 89 FR 47028 (30 May 2024; effective 29 July 2024). https://www.federalregister.gov/documents/2024/05/30/2024-10855/health-breach-notification-rule
2. eCFR, 16 CFR Part 318, Health Breach Notification Rule (up to date as of 5 November 2026). https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-318
3. Federal Trade Commission, BetterHelp, Inc.; Analysis of Proposed Consent Order To Aid Public Comment, 88 FR 15717 (14 March 2023). https://www.federalregister.gov/documents/2023/03/14/2023-05139/betterhelp-inc-analysis-of-proposed-consent-order-to-aid-public-comment
4. American Hospital Association v. Becerra, No. 4:23-cv-01110-P (N.D. Tex. 20 June 2024), Opinion & Order, ECF No. 67 (GovInfo). https://www.govinfo.gov/content/pkg/USCOURTS-txnd-4_23-cv-01110/pdf/USCOURTS-txnd-4_23-cv-01110-0.pdf
5. The Record, Suzanne Smalley, "HHS drops appeal of hospital web tracking decision" (30 August 2024). https://therecord.media/hhs-drops-appeal-web-tracking-hospitals
6. Gunderson Dettmer, "Spotlight on Recent FTC Enforcement Actions: Is Your Users' Health Data Being Leaked Through Your Adtech?" (29 March 2023). https://www.gunder.com/en/news-insights/insights/spotlight-on-recent-ftc-enforcement-actions-is-your-users-health-data-being-leaked-through-your-adtech
7. ZwillGen, "FTC Reinforces Restriction on Health Data Disclosures for Advertising" (3 March 2023, updated 23 March 2023). https://www.zwillgen.com/ftc-state-ag/ftc-reinforces-restriction-on-health-data-disclosures-for-advertising/
8. Choate Hall & Stewart, "FTC Seeks Significant Penalties from Two Health Companies Alleging Misuse of Consumer Personal Information" (April 2024). https://www.choate.com/insights/ftc-seeks-significant-penalties-from-two-health-companies-alleging-misuse-of-consumer-personal-information/
9. Robinson+Cole, "Federal Trade Commission Continues to Target Healthcare Companies for Unauthorized Data Disclosures" (9 May 2024). https://www.dataprivacyandsecurityinsider.com/2024/05/federal-trade-commission-continues-to-target-healthcare-companies-for-unauthorized-data-disclosures/
10. Arnold & Porter, Nancy L. Perkins, "FTC Bans Telehealth Company From Using Health Information for Advertising" (17 May 2024). https://www.arnoldporter.com/en/perspectives/blogs/enforcement-edge/2024/05/ftc-bans-health-information-for-advertising