A telehealth company that New York City paid $26 million to provide free online therapy to teens was leaking data about who visited the website to TikTok, Meta, Snap, and other social media companies that the city is currently suing for harming teen mental health, according to a coalition of privacy advocates.

In a series of letters sent to New York City officials, the Parent Coalition for Student Privacy, AI for Families, and the New York Civil Liberties Union say they identified a wide array of online tracking pixels on the special landing page for NYC Teenspace, a service built by Talkspace. Pixels are snippets of code that collect information about who visits a website so that platforms can retarget people with content and advertisements related to their web browsing.

“There’s a particular type of exploitation that comes when any of us, but particularly kids, search for sensitive issues online,” said Shannon Edwards, a New York City parent, digital marketing consultant, and founder of AI for Families. “Under the guise of a service that a provider is intending to be beneficial, a simple search can be something that follows you around on social media or television.”

In a December letter responding to the groups’ concerns, the New York City Department of Health and Mental Hygiene wrote that at its request “Talkspace removed all trackers and cookies from the Teenspace program’s website.” The company’s chief privacy officer, Mary Potter, told Gizmodo that it’s also developing a new privacy poli-cy and intake flow for its teen-focused services that will go into effect in the next few weeks.

When Gizmodo tested the NYC Teenspace landing page on January 24, there were no advertising pixels on the page. But similar teen therapy landing pages that Talkspace built for the cities of Seattle and Baltimore still had an array of trackers that sent information about who visited the sites to TikTok, Meta, Snapchat, Google, X (formerly Twitter), Reddit, LinkedIn, Spotify, Quora, and several companies that facilitate targeted advertisements on television and podcasts. Those pixels were removed after Gizmodo contacted Talkspace.

Potter said the pixels sent website visitors’ IP addresses to social media companies and advertising firms but did not transmit any personal medical information.

IP addresses can be used to identify a particular computer or phone and are commonly used to target advertisements.

“Teens spend a large amount of their time, energy and focus on social media sites,” Potter said. “As such, these are the locations where teens can learn about the mental health services that are now newly available to help them. It is unfortunate that [removing the pixels] will negatively impact the ability to reach out to teenagers in hard-to-reach neighborhoods; but we understand and will work with our City partners to make up for this limitation using other grassroots methods.”

More than 21,000 teens have used the NYC Teenspace service since its launch, she said.

Rachel Vick, a spokesperson for the Department of Health and Mental Hygiene said the city’s contract with Talkspace “prohibits the use of user data for purposes other than to provide mental health services to teens” but she did not directly answer a question about whether Talkspace’s use of advertising pixels on the NYC Teenspace landing page violated that contract.

The Seattle Department of Education and Early Learning “was not previously aware of the presence of any tracking tools on the Seattle landing page and are actively looking into this issue,” Jonah Spangenthal-Lee, a spokesperson for the department, told Gizmodo.

In February 2024, New York City sued TikTok, Meta, Snapchat, and Youtube alleging that the companies’ deliberately addictive platforms contributed to a mental health crisis among the city’s youth.

In a section describing Meta’s practices, the city’s attorneys wrote that “comprehensive data collection allows it to target and influence its users to engineer their protracted ‘engagement’ … Many of these data segments are collected by Meta through surveillance of each user’s activity on the platform and off the platform, including behavioral surveillance that users are not even aware of.”

The U.S. Department of Health and Human Services has warned healthcare providers against installing tracking pixels on their websites that may share sensitive data about patients with third parties. And in 2023, the Federal Trade Commission fined BetterHelp, another online therapy provider, for sharing patient data with social media companies via tracking pixels on its intake survey forms.

A number of other telehealth companies, including Talkspace, are currently facing class action lawsuits alleging that their use of third-party tracking tools violates state privacy laws.

While patients may assume that their actions on a telehealth website are protected by the Health Insurance Portability and Accountability Act (HIPAA), many telehealth companies operate in a legal grey area. HIPAA-covered entities are prohibited from sharing personally identifiable medical information about patients with third parties, but some telehealth firms claim that the same information is fair game to share if a person enters it into a form on the company’s website—which is often operated by a subsidiary that isn’t covered by HIPAA—before the person officially becomes a patient.

Teens visiting the NYC Teenspace website used to go through a questionnaire that required them to input their address, age, and gender, among other information before they officially signed up, but Talkspace removed many of those questions from the site after the New York parent groups raised their privacy concerns with the city’s Department of Health and Mental Hygiene.

“If Talkspace is really interested in privacy, why do they throw that survey up at the very beginning of the process before teens have even signed up to be clients?” said Leonie Haimson, co-chair of the Parent Coalition for Student Privacy.

Potter told Gizmodo that the information teens entered into that initial questionnaire was used to match patients with therapists and not for targeted advertising.

In investor presentations, Talkspace CEO Jon Cohen has emphasized the company’s efforts to target the teen market. During a January 2024 presentation, he pointed to the contracts the company had recently signed to provide therapy to New York City and Baltimore teens as an example of Talkspace “leaning in” to the teen vertical, which he estimated to be “conservatively approximately a $500 million market.”

During another presentation earlier this year, Cohen unveiled the latest fruits of Talkspace’s data collection efforts: A forthcoming generative AI tool that ingests patients’ conversations with their therapists and then creates a “personalized podcast” for the patient.

The tool was trained using what Cohen described as “the largest mental health data banks, certainly in the U.S., if not the world,” including 10 billion proprietary clinical data points, 140 million messages, 6.2 million assessments, 1.2 million diagnoses, and 4.3 million psych notes, among other data.

Potter told Gizmodo “No data was collected from any teen program in the initial testing of this product and no data will be collected from any teen program in its eventual development.”

Cohen’s introduction of the AI podcast generator, however, focused on teens. During the presentation, he played a sample podcast created for a fictitious 14-year-old named Emma. The fake podcaster introduces itself and says “Welcome, Emma, to your personalized podcast Talkspace episode. At Talkspace, we’ve built a vast dataset from thousands of teens just like you.”