Adolescent Mental Health Application Directly Transmitted Users' Information to TikTok
In a recent revelation, a New York City-funded telehealth platform offering free online therapy to teenagers was discovered leaking user data to social media giants, including TikTok, Meta (Facebook), and Snapchat, despite the city suing these companies over their impact on teen mental health. This information was brought to light by a coalition of privacy advocates, including the Parent Coalition for Student Privacy, AI for Families, and the New York Civil Liberties Union.
With a series of letters to New York City officials, these groups highlighted a multitude of online tracking pixels found on the special landing page for NYC Teenspace, a service provided by Talkspace. These pixels collect data about website visitors to target them with related content and advertisements.
Shannon Edwards, a New York City parent, digital marketing consultant, and founder of AI for Families, expressed concerns about this exploitation, emphasizing that sensitive searches can follow users across various digital platforms.
Talkspace, acknowledging the issue, removed all trackers and cookies from the Teenspace program's website upon request in a December letter to the advocacy groups. The company also stated that it was developing a new privacy policy and intake flow for its teen-focused services, which would come into effect in the following weeks.
When Gizmodo tested the NYC Teenspace landing page in January, no advertising pixels were detected. However, similar teen therapy landing pages built for Seattle and Baltimore by Talkspace still contained an array of trackers. These trackers were subsequently removed after Gizmodo contacted Talkspace, with the company stating that they only sent IP addresses to social media companies and advertising firms without transmitting any personal medical information.
Despite the removal of tracking pixels, concerns remain. IP addresses can be used to identify specific devices, potentially exposing personal information to targeted advertisements. Talkspace acknowledged these limitations while expressing regret over the impact on teenagers in underserved neighborhoods, saying they would work with city partners to mitigate these effects.
The NYC Department of Health and Mental Hygiene confirmed that its contract with Talkspace prohibits the use of user data for purposes beyond providing mental health services to teens. However, they did not directly address any potential violations regarding the use of advertising pixels on the NYC Teenspace landing page.
The Seattle Department of Education and Early Learning admitted to being unaware of the tracking tools on Seattle's landing page and is currently investigating the issue.
In 2024, New York City filed a lawsuit against TikTok, Meta, Snapchat, and YouTube, alleging that these companies' platforms contributed to a mental health crisis among the city's youth through addictive practices.
Confidentiality regulations like HIPAA complicate data handling in the telehealth industry. While HIPAA-covered entities are prohibited from sharing medical information with third parties, some telehealth firms argue that any data entered on their websites is fair game, even before a patient officially signs up.
These practices have stirred up class-action lawsuits against various telehealth companies, including Talkspace, alleging violations of state privacy laws.
Throughout 2023, the U.S. Department of Health and Human Services cautioned healthcare providers against sharing sensitive patient data using tracking pixels with third parties, and the Federal Trade Commission fined BetterHelp for engaging in such practices.
The consequences of unauthorized data collection can result in extensive legal and reputational damage. Moreover, the lack of transparency and explicit consent from users, abstractly, raises serious ethical concerns, particularly for youth.
[1] [1] Von Scodari, M. (2024). Telehealth Privacy: What Every Patient and Employee should Know. Digital Privacy Alliance.
- Despite Talkspace's removal of trackers on the NYC Teenspace landing page, concerns persist about the use of IP addresses for targeted advertising, potentially compromising user privacy.
- In the future, as the use of technology in mental health services continues to grow, clearer regulations are needed to ensure user data is protected and consent is obtained before sharing sensitive information.
- The leakage of user data from the New York City-funded telehealth platform to tech giants has exposed the complexities of privacy in the tech industry, particularly when it comes to advertising pixels and retargeting.
- In the wake of this scandal, tech companies and telehealth providers must prioritize the privacy of their teen users, implementing robust policies and seeking explicit consent before collecting and sharing their data.
