App marketing teams should check what their ad tools send before they publish a privacy promise. In 2023 the FTC ordered BetterHelp to pay $7.8 million after saying the company promised to keep health data private and then shared consumers' emails, IP addresses and questionnaire answers with Facebook, Snapchat, Criteo and Pinterest for advertising. A privacy promise is a marketing claim, and the FTC can enforce it.
What is a privacy promise in app marketing?
A privacy promise in app marketing is any sentence that tells a user how the app handles personal data, whether it appears in an ad, a store listing, an onboarding screen or a privacy policy. Growth teams write many of these sentences because they write the copy that convinces a person to install and sign up.
The BetterHelp complaint shows how the FTC reads that copy. According to the FTC's March 2023 press release, BetterHelp promised at several points in the signup process that it would not use or disclose personal health data except for limited purposes, such as providing counseling. The FTC said the company then used and revealed email addresses, IP addresses and health questionnaire information for advertising.
The lesson for a marketer is direct. The sentence on the signup screen and the data that flows to the ad platform must match. If they differ, the sentence is a false claim. This article is general information, not legal advice, so have privacy counsel review every promise and every data flow.
Why it works: The FTC judges the promise a user saw against the data the company sent. Matching the two removes the gap that created the BetterHelp case (Federal Trade Commission, March 2023).
What did BetterHelp teach app marketers?
BetterHelp taught app marketers that audience-building tools can create the violation. The FTC said the company used consumers' email addresses and the fact that they had been in therapy to tell Facebook to find similar consumers and target them with ads, which helped bring in tens of thousands of new paying users and millions of dollars in revenue.
The proposed order banned BetterHelp from sharing health data for advertising. It also banned sharing personal information with certain third parties for retargeting, which the FTC described as targeting ads to people who had visited the website or used the app, including people who had not signed up. It required affirmative express consent before disclosing personal information to certain third parties and a comprehensive privacy program.
The FTC also said BetterHelp denied news reports in 2020 that it had revealed consumers' personal information to third parties, and it called the denial false. The agency finalized the order in July 2023, according to an FTC press release on the final approval. The $7.8 million funded partial refunds to consumers.
Note one limit on the lesson. The FTC alleged these facts in a complaint and the case ended in a consent order. Treat it as a map of what the agency looks for, not as a ruling on every growth tactic.
Why it works: Ad platforms optimize on the data they receive. A list of users who share a sensitive trait tells the platform who to find next, so the data leaves the company even when no person reads it (Federal Trade Commission, March 2023).
Which app marketing tactics carry data risk?
Retargeting, lookalike audiences, customer list uploads and event tracking in the app carry the most data risk, because each one sends user information to an outside platform. The table lists the checks I would run before each launch.
| Tactic | Data that may leave the app | Check before launch |
|---|---|---|
| Retargeting | Visits, app opens, device and IP details | Does the privacy copy disclose this, and does the user consent where the law requires it? |
| Lookalike audiences | Hashed emails and a trait that defines the seed list | Is the seed list defined by a sensitive trait such as a health condition? |
| Customer list uploads | Emails and phone numbers | Did the user agree to this use, and who may see the list? |
| In-app event tracking | Screens viewed, answers entered, purchases | Does any event name or value reveal sensitive information? |
| Third-party software kits | Whatever the kit collects by default | Has the team read what the kit sends and to whom? |
The first two rows come straight from the BetterHelp case. The others follow the same logic: any tool that moves user data to another company needs a written reason and an approver. For a health, finance or children's app, add counsel to the approval step.
Why it works: A written check turns a technical default into a decision someone owns. The BetterHelp order requires a comprehensive privacy program, which shows the FTC expects named processes and not good intentions (Federal Trade Commission, March 2023).
How should an app team write privacy copy that holds up?
An app team should write privacy copy in short sentences that name what is collected, who receives it and why, and then test each sentence against the real data flow. Short copy is easier to verify, and verified copy is easier to defend.
- List every data type the app collects, from account details to device data.
- List every outside company that receives each type, including ad platforms and software kits.
- Write one sentence per data type and recipient in plain words.
- Have an engineer confirm each sentence against the live app.
- Have counsel approve the final text before it ships.
- Re-run the check whenever the marketing stack changes.
Illustrative sentence: "We share your email address with our advertising partners to show you relevant ads. You can turn this off in Settings." The sentence names the data, the recipient and the purpose, and it points to a control. It is valid only if the app shares the email address with advertising partners and the setting works as described.
Avoid absolute words such as "never," "private" and "secure" unless the sentence can be proven. BetterHelp's alleged promise that information would stay private between a user and a counselor is the kind of sentence that turns a data flow into a violation. Prefer a sentence a regulator could read next to your data map without finding a gap.
Why it works: A sentence that names a recipient can be checked, and a sentence that says "private" cannot. The FTC's complaint set the user's expectation against the actual recipients, so copy that lists the recipients leaves little to dispute (Federal Trade Commission, March 2023).
How does an app earn coverage and recommendations?
An app earns coverage and recommendations by giving reporters data and proof, then tracking whether AI engines cite the result. Muck Rack's December 2025 What Is AI Reading? report found that discovery questions rely more on earned media and journalism, while owned content matters most for direct questions about a brand.
A user who asks an AI engine for the best budgeting or meditation app is asking a discovery question. The answer depends on coverage the app has earned. Muck Rack's May 2026 edition put earned media at 84% of AI citations. An app that wants to appear in those answers needs stories in outlets that engines cite.
Build the pitch from first-party data. Anonymized, aggregated usage patterns can tell a reporter something about how people live, sleep, save or study. Keep the privacy rules in mind: aggregate, remove identifiers and have counsel confirm that the data was collected for this use.
Write one owned page that answers the direct questions: what the app does, what it costs, who runs it and how it handles data. Link it from the store listing and from every press release.
Why it works: Engines use earned coverage for discovery questions and owned pages for direct questions, so an app needs both to be found and to be described with accurate facts (Muck Rack, December 2025).
What should an app team do when a privacy report breaks?
An app team should verify the facts before it replies to a privacy report, because a wrong denial turns a data story into a deception story. The FTC said BetterHelp denied news reports in 2020 that it had revealed personal information to third parties, and the complaint treated the denial as part of the case.
Use a short routine. Ask engineering for a written account of what data left the app, to whom and when. Ask counsel to review the account. Draft a holding statement that says what is confirmed and what is under review, and name a time for the next update. My guide to the first 24 hours of a breach gives the fact sheet and holding statement format, and the crisis communication plan template covers the wider structure.
App companies that want outside help building this routine can start with 5W's app marketing practice. For the wider program, see my marketing guide and the technology companies PR guide.
Why it works: A statement built from a verified account cannot be contradicted by the next news report. The FTC listed the denial among its allegations, so accuracy in the first reply protects the company in later proceedings (Federal Trade Commission, March 2023).
What should an app marketing team fix in 30 days?
An app marketing team should fix four things in 30 days: the data map, the privacy copy, the approval step for ad tools and the response routine for a privacy report. Each task is smaller than the cost of one enforcement action.
- Draw the data map from the live app and the ad accounts.
- Rewrite the privacy copy to match the map.
- Add a written approval step for any new ad tool or audience.
- Write the holding statement and name the owner.
Put the data map and the privacy copy side by side in a shared document, and date every edit. When a regulator, a reporter or a partner asks a question, the team can answer from one source instead of from memory. Review the document each time the marketing stack, the ad accounts or the app's data collection changes.
Then ask the agency or the internal team that runs your ads to explain, in two sentences, what data each tool receives. If the answer takes a meeting, the data map is not finished.
Frequently asked questions
Is a privacy promise in an ad enforceable?
Yes. The FTC alleged that BetterHelp's data sharing for advertising contradicted the promises it made in its signup flow, and the case ended in a $7.8 million order.
What did the FTC order BetterHelp to do?
The order required BetterHelp to pay $7.8 million, stop sharing health data for advertising, stop certain retargeting, get affirmative express consent before certain disclosures and build a privacy program.
Are lookalike audiences risky?
They can be. The FTC said BetterHelp used emails and the fact that users had been in therapy to build lookalike targeting, which is why teams should check whether a seed list reveals a sensitive trait.
How does an app appear in AI recommendations?
Through earned coverage in outlets that AI engines cite. Muck Rack's May 2026 edition found that earned media accounts for 84% of AI citations.
Published October 2026. General information, not legal advice.