FTC Mental Health Marketing Rules: What Therapists Must Know in 2026

The FTC has historically focused its health enforcement on supplement companies making miracle-cure claims. Mental health services — solo therapists, small group practices — were largely off the agency's radar.

That changed in 2023 when the FTC made its most significant mental health enforcement move in years: a $7.8 million settlement against BetterHelp, the world's largest online therapy platform. The charge wasn't about clinical outcomes or licensing. It was about marketing — specifically, how BetterHelp collected sensitive mental health data from users who signed up for counseling, then used that data to target them with ads on Facebook and Snapchat.

Since that landmark case, FTC enforcement in mental health and telehealth has accelerated:

• January 2025: The FTC sued Evoke Wellness for deceptive Google ads that misled consumers about treatment costs and availability, settling for a $1.9 million civil penalty.
• July 2025: Online telemedicine company NextMed agreed to settle charges of using fake reviews and deceptive claims about weight loss and costs.
• March 2026: FTC Chairman Andrew Ferguson launched a dedicated Healthcare Task Force — a new interagency structure designed to coordinate health advertising, data privacy, and market competition enforcement.

Private practice therapists are not BetterHelp. But the FTC's authority extends to every business in commerce — and the rules that BetterHelp violated apply to your website, your review strategy, and how you handle client data.

Most therapists think about compliance through one lens: HIPAA. And HIPAA is critically important — it governs how you handle protected health information (PHI) in clinical records, billing, and patient care. But HIPAA is not the only compliance framework that applies to your practice.

The Federal Trade Commission enforces a separate set of laws focused on advertising, marketing, and consumer protection. Unlike HIPAA — which is enforced by the HHS Office for Civil Rights and primarily targets breaches of clinical data — the FTC focuses on how you attract and influence prospective clients.

	HIPAA	FTC
Enforcing Agency	HHS Office for Civil Rights	Federal Trade Commission
Primary Focus	Protection of patient health records	Truthfulness in advertising and marketing
Applies To	Covered entities (clinicians, billing, EHRs)	Every business in commerce
Key Rules	Privacy Rule, Security Rule, Breach Rule	FTC Act Section 5, Endorsement Guides, Health Breach Notification Rule
Triggers Enforcement	Data breaches, unauthorized PHI disclosure	Deceptive claims, fake reviews, misuse of health data for advertising
Penalties	Up to $1.9M per violation category per year	Unlimited civil penalties, disgorgement of profits

Both frameworks apply simultaneously. Sharing a client's diagnosis without consent is a HIPAA violation. Running an ad that makes misleading claims about your treatment success rates is an FTC violation. Using website visitor data to retarget ads at people who browsed your "anxiety therapy" page could be both.

For a deeper look at HIPAA specifically, see HIPAA-Compliant Websites for Therapists: What's Actually Required. This post focuses on the FTC side — which receives far less attention and carries risks most therapists don't know they're taking.

The BetterHelp settlement is worth examining in detail, because the practices the FTC found objectionable are more common than most mental health providers realize.

Between August 2017 and December 2020, BetterHelp collected sensitive information from users who signed up for its services: email addresses, IP addresses, and answers to intake questions about mental health diagnoses, depression, anxiety, and medication use. It then shared this data with Facebook and Snapchat — without user consent — to build targeting audiences for advertising campaigns. Specifically, BetterHelp used this data to:

• Identify which of its existing subscribers had Facebook accounts (re-engagement targeting)
• Build "lookalike audiences" of people with similar profiles to its current clients
• Run retargeting campaigns aimed at users who had interacted with BetterHelp's website or app

The FTC's March 2023 complaint made three central allegations. First, deceptive privacy claims: BetterHelp displayed HIPAA seals on its website and promised consumers their health data would only be used for treatment — not advertising. Then it used that data for advertising. The FTC considered displaying a HIPAA seal while violating the company's own privacy policy to be a deceptive act. Second, unauthorized use of sensitive health data: even absent explicit promises, the FTC's position is that using mental health data for advertising is an unfair practice — one that consumers would not expect. Third, no affirmative consent: agreeing to terms of service buried in a 40-page document does not constitute consent to share mental health information for advertising purposes.

The settlement required BetterHelp to pay $7.8 million in consumer refunds, obtain affirmative consent before sharing health data with any third party, implement a comprehensive privacy program, and instruct Facebook and Snapchat to delete the improperly shared data. Refunds went to more than 800,000 consumers who paid for BetterHelp services between 2017 and 2020 (FTC, 2024).

Why this matters for solo practices: The actions the FTC found problematic — using a Facebook Pixel or Google Ads remarketing tag on mental health service pages — are standard practice on thousands of therapist websites. The BetterHelp settlement established that the FTC considers mental health data uniquely sensitive and that standard advertising tools applied to mental health contexts require a higher standard of consent.

The FTC's authority over therapist marketing flows through several overlapping rules. Here are the four most relevant to private practice websites.

1. No deceptive claims about treatment outcomes.

The FTC Act prohibits "unfair or deceptive acts or practices in or affecting commerce." This covers claims on your services pages, specialties, and bio. Common violations on therapist websites include language like "proven to help with anxiety and depression" (requires clinical evidence), "95% of my clients achieve their goals" (requires actual data to support), or implying specialization in a modality or population you're not trained in. FTC guidance is clear: health claims must be truthful, not misleading, and supported by competent, reliable evidence.

2. Reviews and testimonials must be genuine and non-deceptive.

The FTC's Endorsement Guides (updated July 2023 — the first major revision since 2009) significantly expanded requirements for how businesses can use reviews and testimonials. Testimonials must reflect honest opinions from real clients. If you offer any incentive for a review — a discount, a gift, or any other benefit — that must be clearly disclosed. You cannot selectively display only positive reviews while suppressing negative ones. Client testimonials showing exceptional results must either be typical, or include a clear disclaimer that results vary.

3. No sharing health data for advertising without explicit consent.

If your website uses tracking tools — Facebook Pixel, Google Ads remarketing, TikTok Pixel — and those tools collect data from visitors on mental health-specific pages, you may be using health-related browsing data for ad targeting without adequate consent. The FTC's position from BetterHelp and GoodRx is that this practice requires affirmative consent, not just a generic cookie banner.

4. Health Breach Notification Rule (2024 expansion).

If your website includes any tool that handles health information — an intake form connected to a wellness database, a symptom checker, a mental health self-assessment — the FTC's updated Health Breach Notification Rule (effective July 29, 2024) may require you to notify users if that data is improperly disclosed. The 2024 amendments explicitly extended coverage to health apps and digital wellness tools not covered by HIPAA (FTC, 2024).

For most solo and small group practices, reviews and testimonials carry the most immediate FTC risk. The 2023 Endorsement Guides update closed loopholes that were widely exploited by healthcare marketers.

Review gating is now explicitly problematic. Review gating — directing unhappy clients to an internal feedback form while directing happy clients to Google or Yelp — was already against Google's terms of service. The 2023 FTC update made it a potential FTC violation: selectively directing only satisfied clients to public review platforms is considered deceptive because it creates a misleadingly positive picture of your practice's overall client satisfaction.

Incentivized reviews require disclosure. Offering any benefit in exchange for a review — a session discount, a gift card, even a free worksheet — requires conspicuous disclosure. "I received [incentive] for this review" must appear in a way the average reader will notice. Many practices run referral programs or offer small thank-you gifts without realizing these interactions are subject to disclosure requirements when they lead to reviews.

Atypical results must be labeled. If your website features a testimonial like "I finally got control of my panic attacks after 4 sessions with Dr. Smith" — and 4-session resolution is not your typical outcome — the FTC requires a clear disclaimer. Something like: "Client results are individual and may not reflect the typical experience. Many clients benefit from longer-term work." The disclaimer must be prominent, not buried in fine print.

The safest approach for private practice: Collect authentic reviews through standard channels — Google, Psychology Today, Healthgrades — by simply asking clients who express satisfaction if they'd be willing to share their experience. Avoid any incentive programs linked to reviews. Display all reviews honestly, and add a results-vary disclaimer near any testimonials that describe above-average outcomes. Document that your reviews come from genuine clients, in case of an FTC inquiry.

This is the area where the gap between standard marketing practice and FTC compliance is widest — and where private practice therapists are most exposed without knowing it.

Standard marketing wisdom says: add a Facebook Pixel to your website. This enables retargeting campaigns, lookalike audience building, and ad performance measurement. Thousands of therapist websites do this.

The FTC's BetterHelp and GoodRx enforcement actions established that this practice requires care in mental health contexts. The issue isn't the pixel itself — it's what data the pixel captures and how it's used. If someone visits your website's "Trauma Therapy" page, and a Facebook Pixel tracks that visit and uses it to categorize that person as a potential therapy client, their health-related browsing behavior has been shared with Facebook for advertising purposes — without their consent. The FTC considers this use of "sensitive health information" (browsing behavior indicating mental health concerns) to require a higher level of transparency than standard advertising tracking.

Practical guidance:

• Use analytics conservatively. Google Analytics 4 with standard configuration for understanding traffic patterns is generally fine. Retargeting pixels on mental health-specific pages are higher risk.
• Don't build retargeting audiences from mental health page visits. Even if you run Google Ads or Facebook campaigns, building audiences from visitors to pages about depression, trauma, grief, or eating disorders is exactly the practice the FTC found objectionable in BetterHelp.
• Update your Privacy Policy. Your Privacy Policy should accurately list every tracking tool on your site, what data it collects, and how it's used. Vague or template privacy policies were contributing factors in both the BetterHelp and GoodRx enforcement actions. If your footer says "We use cookies" and nothing else, that's insufficient.
• Use a cookie consent mechanism on pages with tracking. For visitors from states with privacy laws (California, Colorado, Virginia, Connecticut), a cookie opt-out mechanism for advertising trackers is increasingly a legal requirement — not just an FTC recommendation.

The BetterHelp case established a principle that applies at every scale: information that reveals someone sought mental health care — even indirectly, through browsing behavior — requires careful handling before it's shared with advertising platforms.

On March 20, 2026, FTC Chairman Andrew Ferguson launched a formal Healthcare Task Force — bringing together the FTC's Bureaus of Competition, Consumer Protection, and Economics alongside the Office of Policy Planning and Office of Technology. The Task Force is also designed to coordinate with HHS and the Department of Justice.

For mental health providers, the key mandate is "horizon-scanning" — proactively identifying enforcement priorities rather than waiting for consumer complaints. This signals a deliberate shift from reactive enforcement toward proactive market surveillance.

Three implications for private practice:

1. FTC enforcement is expanding, not contracting. The formalization of a dedicated healthcare unit means more resources, more coordination, and more consistent enforcement. The era of benign regulatory neglect toward small healthcare provider marketing is ending. The FTC isn't primarily targeting solo therapists — but the rules it enforces apply to every business that markets to consumers, and the regulatory environment is getting stricter.

2. Digital mental health platforms are primary targets. The Task Force's formation coincides with explosive growth in AI-powered mental health apps, virtual therapy platforms, and wellness tools that collect sensitive health data at scale. As the FTC tightens standards for these platforms, the compliance norms they establish become de facto standards for the broader mental health marketing ecosystem — including private practice websites.

3. Cross-agency coordination raises enforcement stakes. When the FTC and HHS coordinate investigations — which the Task Force is designed to enable — a marketing violation can trigger simultaneous FTC and HIPAA investigations. The agencies are sharing information in ways they couldn't before. A privacy complaint that might previously have been reviewed by only one agency can now trigger multi-agency scrutiny.

The Healthcare Task Force doesn't change the underlying rules. What it changes is the probability that violations will be detected and pursued. This is the right time to audit your website's marketing practices — before enforcement comes to you.

Here's a practical checklist you can run in about 30 minutes. For each item, the goal is to either confirm compliance or identify a specific action to take.

#	Check	What to Look For
1	Services page claims	Remove "proven," "guaranteed," or unsubstantiated outcome claims
2	Specialty claims	Ensure every specialty listed matches your training and credentials
3	Testimonials — authenticity	Confirm all testimonials are from real clients; no composites or fabrications
4	Testimonials — atypical results	Add "results vary" disclaimer to any exceptional success stories
5	Review incentives	Document that no gifts, discounts, or benefits were offered in exchange for reviews
6	Review gating	Confirm all clients are directed equally to review platforms (not just happy ones)
7	Facebook/TikTok Pixel	Check if retargeting pixels fire on mental health-specific pages; remove or restrict if so
8	Google Ads remarketing	Check whether remarketing audiences include visitors to condition-specific pages
9	Privacy Policy accuracy	List every tracking tool; describe what data it collects and how it's used
10	Cookie consent	If you use ad tracking, implement opt-out mechanism for users from privacy-law states
11	HIPAA seals	If you display HIPAA-related badges, confirm your actual practices support the claim
12	Health apps / intake tools	Identify any digital tools that handle health data; verify breach notification plan exists

If you complete this audit and find issues, prioritize in this order: (1) deceptive claims on services pages — fix immediately; (2) retargeting pixels on mental health pages — remove or restrict; (3) incentivized review disclosure — document retroactively if possible; (4) Privacy Policy update — complete within 30 days.

This audit doesn't replace legal counsel for practices with complex marketing programs, agency relationships, or affiliate arrangements. But for the typical solo or small group practice, it covers the highest-risk areas.

FTC compliance isn't something to retrofit onto your website after the fact. The practices that got BetterHelp into trouble — retargeting pixels on mental health pages, misleading privacy representations, data sharing without consent — were architectural decisions baked into the platform from the start. Fixing them under enforcement pressure is far more expensive than building correctly.

WebsiteTherapy's approach by default:

• No retargeting pixels on mental health service pages. We don't add Facebook Pixel, Google Ads remarketing, or similar tools to the mental health service pages your clients see. Google Analytics 4 is used for traffic analysis with standard privacy settings — not for building ad audiences from health-related page visits.
• Accurate Privacy Policy, auto-generated. Your Privacy Policy is generated based on the tools actually present on your site — not pulled from a generic template with placeholder text. When the tools change, the policy updates.
• PHI scrubbing on the visitor chat agent. If a prospective client shares health details in the chat widget, the AI scrubs that information before processing — it's not logged, stored, or used for any marketing purpose.
• Review display without manipulation. The platform doesn't gate, filter, or selectively surface reviews based on sentiment. All integrated reviews are displayed in chronological order as received.
• No implied HIPAA coverage for non-PHI surfaces. We don't claim your marketing website is "HIPAA compliant" as a blanket marketing statement — which is exactly the kind of misleading representation that landed BetterHelp in the FTC's crosshairs. We tell you precisely which parts of your stack handle PHI and which don't.

The FTC compliance landscape will keep evolving — the Healthcare Task Force has made that clear. But the core principle is stable: don't use your clients' mental health data for purposes they haven't consented to, and don't say things about your practice that aren't true. That's been the law since the FTC Act was written, and it applies to every therapist with a website. See our platform features for specifics on how compliance is built in, or check the FAQ for common questions about data handling and privacy. If you're comparing platforms, our SimplePractice comparison includes a breakdown of where marketing and clinical data handling differ between tools.

Sources: FTC v. BetterHelp, Inc., File No. 2023169 (FTC March 2023); FTC Press Release, "FTC Gives Final Approval to Order" (July 2023); FTC Press Release, "BetterHelp Customers Will Begin Receiving Refund Notices" (May 2024); FTC Press Release, "FTC Chairman Andrew N. Ferguson Launches Healthcare Task Force" (March 2026); FTC, "Updated FTC Health Breach Notification Rule" (April 2024); Federal Register, Guides Concerning the Use of Endorsements and Testimonials in Advertising (July 26, 2023); FTC v. Evoke Wellness, No. 1:25-cv-10133 (January 2025).