Live Out Loud Now

Have you ever talked about something, searched for it once, or visited a website, and suddenly advertisements for that very thing seem to follow you everywhere?

Sometimes I laugh and think, Okay, how did they know that? But after learning more about the legal and ethical side of mobile marketing, I started asking a different question: How much should a company be allowed to know about us simply because we use its website or app?

That question becomes even more serious when healthcare is involved.

When Private Information Becomes Marketing Data

Cerebral is an online mental health company, and its case immediately caught my attention. According to the Federal Trade Commission (FTC), Cerebral allegedly disclosed sensitive consumer information through tracking technologies used on its websites and apps. The information involved nearly 3.2 million consumers and included medical and prescription histories, contact information, insurance information, and other health-related data (Federal Trade Commission [FTC], 2024).

The legal issues went beyond privacy. The FTC alleged that Cerebral violated the Restore Online Shoppers’ Confidence Act (ROSCA) by failing to clearly disclose important cancellation terms. Although consumers were told they could “cancel anytime,” the FTC alleged that some continued to be charged after requesting cancellation (FTC, 2024). In 2025, more than $5 million was sent to 40,249 consumers who had attempted to cancel but continued to be charged (FTC, 2025).

For me, there is a big difference between a customer telling a retailer, “I like red shoes,” and someone sharing information about medications, treatment, or mental health. One is a shopping preference. The other was shared because the person was seeking healthcare.

Cerebral Was Not Alone

My additional research led me to GoodRx, a digital healthcare company that provides prescription discounts and other health services. The FTC alleged that GoodRx disclosed users’ personal health information to companies including Facebook and Google and failed to notify consumers and others about those disclosures as required by the Health Breach Notification Rule (HBNR) (FTC, 2023).

The case resulted in a $1.5 million civil penalty. The court order also prohibited GoodRx from sharing applicable health information for advertising and required affirmative express consent before certain other disclosures (FTC, 2023).

Now we have two different companies, but I see the same underlying problem: consumers lost control of information they trusted a company to protect.

The Consumer Pays a Price Too

Companies may receive the fines, but consumers experience the consequences. Cerebral customers allegedly faced unwanted charges and disclosure of sensitive information. GoodRx users faced unauthorized disclosures of health information to advertising platforms.

Once personal health information leaves the space where a consumer expected it to remain, restoring that privacy can be difficult or impossible. The consequences are not only financial. Consumers can lose trust in the very digital services they depended on.

There Is a Price for Getting It Wrong

These cases also show that violating legal and ethical standards can result in more than bad publicity. Companies can face civil penalties, consumer refunds, restrictions on how they use customer data, requirements to obtain affirmative consent, and court or FTC orders changing their business practices.

For Cerebral, the proposed settlement included nearly $5.1 million for consumer refunds and a $10 million civil penalty, with most of the civil penalty suspended based on the company’s inability to pay (FTC, 2024). GoodRx agreed to the $1.5 million civil penalty and significant restrictions on its future handling of health information (FTC, 2023).

What Should Marketers Learn?

My biggest takeaway is simple: permission should actually mean permission.

Marketers should clearly explain what consumers are opting into, obtain appropriate consent before collecting or sharing information, protect the data they collect, make opting out or canceling easy, and honor that decision when a consumer says stop. They should also collect only the information they actually need instead of gathering information simply because technology allows them to do it.

I use email, text messaging, and other mobile communication in my own business, so this lesson is not just academic for me. If someone gives me her phone number or email address, I want her to understand what she is agreeing to receive and how she can change her mind.

Laws create the boundaries, but ethical marketing requires one more question:

If I were the consumer, would I feel respected by what this company is doing with my information?

Because at the end of the day, there is something more valuable than an open rate, a click, or even a sale.

Trust.

And once a company loses that, no marketing campaign can guarantee it will get it back.

References

Federal Trade Commission. (2023, February 1). FTC enforcement action to bar GoodRx from sharing consumers’ sensitive health info for advertising.

Federal Trade Commission. (2024, April 15). Proposed FTC order will prohibit telehealth firm Cerebral from using or disclosing sensitive data for advertising purposes, and require it to pay $7 million.

Federal Trade Commission. (2025, May 8). More than $5 million in refunds sent to consumers as a result of the FTC’s action against Cerebral over deceptive cancellation practices.

AI Use Acknowledgment

I used ChatGPT to assist with organizing ideas, reviewing the assignment requirements, and refining the clarity and structure of this blog post. I reviewed and edited the final content and verified the supporting information using the cited sources.