Mental health provider accused of sharing data with Meta, Google settles lawsuit for $3M
Mental health provider chain LifeStance Health has agreed to a $3 million settlement to put to rest a 2023 class action lawsuit, stemming from its use of third-party tracking technologies on its website.
According to the complaint, between March 2020 and April 2023 the publicly traded, for-profit mental health services company was running code on its website that sent personal information on users to big tech companies for the purposes of serving custom ads, mainly Meta and Google.
Such tracking cookies capture information such as IP addresses, browsing history and more—including what a user views on a website and what they type into forms, such as search fields. In this case, that could reveal personal information on users related to a mental health diagnosis or treatment.
As these tracking technologies follow people on the web and create profiles of their activity, it’s not difficult for tech companies to slowly identify precisely who a user is, albeit for the purposes of advertising.
“In the case of information collected by LifeStance and sent to Facebook, such information is then linked to users’ unique Facebook user ID, which allows Facebook and other third parties to personally identify those users and associates their private information with their Facebook profiles,” the complaint reads. “As a result, there is no anonymity in the information disclosed to Facebook for marketing and analytics purposes.”
Per the terms of the settlement, LifeStance has agreed to discontinue all use of these trackers on its website. The company, however, does not admit to any wrongdoing, and rejects the claim it knowingly violated the privacy of its users for personal gain.
“Although LifeStance does not agree with the allegations in this lawsuit, we chose to resolve the matter so we can remain focused on our mission of expanding access to trusted, affordable and personalized mental healthcare,” a spokesperson said in a statement. “Patient privacy and safety are critically important to everything we do and we take our responsibility to protect them very seriously.”
“We are committed to safeguarding personal health information and maintaining full compliance with Health Insurance Portability and Accountability Act (HIPAA), as well as all federal, state and local laws.”
According to the complaint, use of ad trackers in this particular case would violate provisions of HIPAA, as private information is being shared with an outside party without the consent of patients.
Two LifeStance members filed the complaint, but the class of plaintiffs represents anyone whose data was swept up by the pixel trackers over the three-year timeframe—meaning over 1 million people are potentially eligible to benefit from the settlement.
A hearing to finalize the terms is scheduled for Oct. 16.
A recurring theme
Looking back at 2026 alone, the story of HIPAA-covered entities sharing data with companies like Google, Microsoft and Facebook through code running on their websites is a recurring theme, resulting in multiple lawsuits.
In March 2026, a breast cancer patient in Vermont filed a complaint against Novartis, alleging the Swiss pharmaceutical company shared her personal health information with Google.
In July, Atrium Health agreed to pay a $1.8 million settlement to end a class action lawsuit that alleged it shared sensitive patient data with multiple big tech advertising companies.
Last week, University of Colorado Health was sued over its alleged data-sharing with Facebook. The plaintiff in that case is seeking class-action status for his complaint.
Chad is an award-winning writer and editor with over 15 years of experience working in media. He has a decade-long professional background in healthcare, working as a writer and in public relations.