complaint<\/a>, filed by the Department of Justice upon notification and referral from the FTC, alleges that Monument failed to ensure it was complying with its promises and in fact disclosed users\u2019 health information to third-party advertising platforms, including highly sensitive data that revealed that its customers were receiving help to recover from their addiction to alcohol.<\/p>\n\u201cThis action continues the FTC\u2019s work to ensure strict limits on how firms handle sensitive health data, rather than putting the onus on consumers to protect themselves,\u201d said Samuel Levine, Director of the FTC\u2019s Bureau of Consumer Protection. \u201cFollowing on the heels of actions against GoodRx, BetterHelp, and Premom, the market should be getting the message that consumer health data should be handled with extreme caution.\u201d<\/p>\n
New York-based Monument offers users, depending on membership levels that cost from $14.99 to $249 a month, access to online support groups, community forums, online therapy, and access to physicians who can prescribe medications that assist in treating alcohol addiction. The company collects personal information from consumers when they sign up for the service including their name, email addresses, date of birth, phone numbers, addresses, copies of their government issued IDs, and information about their alcohol consumption and medical history, as well as their IP addresses and device IDs when they start using the service.<\/p>\n
The complaint says that from 2020-2022, Monument claimed on its website and\/or in other communications with consumers that users\u2019 personal information would be \u201c100% confidential\u201d and that the company would not disclose such data to third parties without users\u2019 consent. The company also claimed it complied with\u00a0the Health Insurance Portability and Accountability Act (HIPAA), which protects health information held by entities covered by HIPAA and their business associates, when in fact an outside assessor hired by the company found that it had not fully complied with HIPAA\u2019s requirements.<\/p>\n
According to the complaint, the company contradicted its privacy promises. From 2020-2022, the company allegedly\u00a0disclosed users\u2019 personal information, including their health information, to numerous third-party advertising platforms via tracking technologies, known as pixels and application programming interfaces (APIs), which Monument integrated into its website. Monument used the information to target ads for its services to both current users who subscribe to the lowest cost memberships and to target new consumers, according to the complaint.<\/p>\n
Monument used these pixels and APIs to track \u201cstandard\u201d and \u201ccustom events,\u201d meaning instances in which consumers interacted with Monument\u2019s website. The FTC says that Monument gave the custom events descriptive titles that revealed details about its users such as \u201cPaid: Weekly Therapy\u201d or \u201cPaid: Med Management,\u201d when a user signed up for a service. Monument disclosed this custom events information to advertising platforms along with users\u2019 email addresses, IP addresses, and other identifiers, which enabled third parties to identify the users and associate the custom events with specific individuals, according to the complaint.<\/p>\n
Monument disclosed information of as many as 84,000 users, though it did not have a precise number because it did not adequately track or inventory the personal information it collected and disclosed to third-party advertising platforms like Meta, according to the complaint.<\/p>\n
The complaint alleges that these practices violated the FTC Act\u2019s prohibition against unfair and deceptive practices and the Opioid Addiction Recovery Fraud Prevention Act of 2018 (OARFPA), which prohibits\u00a0deceptive acts or practices with respect to any substance use disorder treatment service or substance use disorder treatment product.<\/p>\n
In addition to the ban on sharing data with third parties for advertising, the proposed order with Monument, which must be approved by a federal court before it can go into effect,\u00a0also prohibits the company from misrepresenting its data collection and disclosure practices and imposes a $2.5 million civil penalty for violating OARFPA, which will be suspended due to the company\u2019s inability to pay. If the company is found to have misrepresented its finances, it will be required to pay the full amount. Other provisions of the proposed order require Monument to:<\/p>\n
\nSeek deletion of data:\u00a0<\/strong>Monument must identify all the user data it shared with third parties and direct those third parties to delete the personal data that was shared with them.<\/li>\nInform Consumers:<\/strong> Monument must inform consumers who have yet to be notified by the company about the disclosure of their health information to third parties for advertising.<\/li>\nImplement Mandated Privacy Program:\u00a0<\/strong>Monument must put in place a comprehensive privacy program that includes strong safeguards to protect consumer data and address the issues the FTC identified in its complaint. The program must include limits on how long Monument can retain personal and health information according to a data retention schedule.<\/li>\n<\/ul>\nThe Commission voted 3-0 to refer the complaint and stipulated final order to the Department of Justice for filing. The DOJ filed the complaint and stipulated order in the U.S. District Court for the District of Columbia.<\/p>\n
NOTE:\u00a0<\/strong>The Commission authorizes the filing of a complaint when it has \u201creason to believe\u201d that the named defendant is violating or is about to violate the law and it appears to the Commission that a proceeding is in the public interest.\u00a0Stipulated final orders have the force of law when approved and signed by the District Court judge.<\/p>\nThe lead staffers on this matter were Elisa Jillson and\u00a0Robin Rosen Spector in the FTC\u2019s Bureau of Consumer Protection.<\/p>\n<\/div>\n
Official news published at https:\/\/www.ftc.gov\/news-events\/news\/press-releases\/2024\/04\/alcohol-addiction-treatment-firm-will-be-banned-disclosing-health-data-advertising-settle-ftc <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"The Federal Trade Commission has taken action against an alcohol addiction treatment service for allegedly disclosing users\u2019 personal health data to third-party advertising platforms, including Meta and Google, for advertising without consumer consent, after promising to keep such information confidential. As part of a proposed order settling the FTC allegations, New York-based Monument, Inc. will […]<\/p>\n","protected":false},"author":1,"featured_media":44355,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[373],"tags":[],"class_list":{"0":"post-44354","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-finance"},"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\t \n\t\t \n\t\t \n\t\t \n\t\t \n\t\t \n\t\t \n\t\t \n\t\t \n\t\t \n\t\t \n\t\t \n\t\t \n\t\t \n\t\t \n\t\t \n\t\t \n\t\t \n\t\t