Cerebral

Is Cerebral safe?

Cerebral is usable today for therapy and non-controlled medication, but few mental health apps have a weaker record. From October 2019 to January 2023, tracking pixels on its website and app sent data on 3,179,835 people to Meta, Google, TikTok and other companies, Cerebral reported to US health regulators in 2023. The data included names, dates of birth, answers to mental health self-assessments, appointment dates and treatment details. In 2024 it settled two federal cases: one with the Federal Trade Commission over that data and its cancellation practices, and one with prosecutors and the Drug Enforcement Administration over how it pushed ADHD prescribing.

We score Cerebral 49/100, below BetterHelp at 64 and GoodRx at 60, which were both punished for sharing health data with advertisers but had no prescribing case and no security failures on Cerebral's scale.

What the FTC found

The FTC announced its case on 15 April 2024, filed by the Department of Justice in federal court in Florida. Its complaint said Cerebral promised a "safe, secure, and discreet" service, then shared sensitive information on nearly 3.2 million people through trackers on its site and apps. The list of data types is long: medical and prescription histories, pharmacy and insurance details, home addresses and birth dates among them.

The complaint went beyond advertising. It said Cerebral mailed promotional postcards, without envelopes, to more than 6,000 patients with wording that could reveal their diagnosis. Former employees could still open patient records from May to December 2021. A single sign-on flaw in the patient portal could show one patient another patient's files when both logged in at the same time.

On cancellations, the FTC said "cancel anytime" in practice meant a multi-step, often multi-day process while charges kept coming. An easier cancel button launched in April 2020 was removed after two weeks, at the direction of the then chief executive, Kyle Robertson, when cancellations rose.

Cerebral agreed to pay about $5.1 million for refunds and a $10 million civil penalty, of which $8 million was suspended because it could not pay. The order permanently bans it from using or disclosing health information for most advertising, requires a privacy and security programme, a data retention schedule and an easy way to cancel. The case against Robertson, who did not settle, is still listed as pending.

The prescribing case

On 4 November 2024 the US Attorney for the Eastern District of New York and the DEA announced a non-prosecution agreement. In it, Cerebral admitted that between 2021 and 2022 it set internal targets to raise prescribing, including a goal of 95% of new medication patients leaving their first 30-minute visit with a prescription, and a goal of "near 100%" stimulant prescriptions for ADHD patients without other conditions. It also had thousands of duplicate accounts, which let at least one patient flagged for misusing stimulants get prescriptions from several providers.

Cerebral forfeited $3,652,000. A further $2,922,000 fine is deferred for the 30-month term of the agreement and will be waived if Cerebral complies. Prosecutors credited it for firing its chief executive, dropping the metrics and stopping all controlled-substance prescribing in October 2022. Its help centre still says it prescribes none, so stimulants and benzodiazepines are off the table. Whether another medicine suits you is a question for your prescriber, not for this page.

What Cerebral shares now

The trackers named in the 2023 notice were removed, and the FTC order limits what Cerebral may do with health data. Ordinary ad tracking continues. Apple's privacy label lists identifiers used to track you across other companies' apps, and Google Play lists email, phone number and user IDs as shared with others for advertising or marketing. The privacy policy, revised in September 2025, says Cerebral shares data with ad platform vendors and serves tailored ads.

Cerebral also offers a "HIPAA Marketing Authorization" when you sign up for its newsletter. Accepting it lets Cerebral share your email, device IDs, city and zip code, how you use the website and your "long term value" to the company with Google, Meta and TikTok. The form itself warns that data shared this way may no longer be protected by HIPAA. It is optional and not required for treatment.

Cerebral's Covered Incidents page, which the FTC order requires, lists three breach reports filed with HHS in 2024. Each was a breach affecting fewer than 500 people.

How to use Cerebral more safely

1. Do not tick the HIPAA Marketing Authorization box on sign-up or newsletter forms.
2. Use "Do Not Sell or Share My Personal Information" in the site footer, and tap "Ask App Not to Track" on iPhone.
3. Use a strong, unique password: we found no two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login option.
4. Check your billing. Cerebral moved therapy to pay-per-session pricing of $150 on 6 October 2026, so look at your statement after each booking.
5. To delete your data, email the privacy team and keep the reply. Your medical record stays with the provider group for as long as state law requires.
6. Cerebral is not a crisis service. In the US, call or text 988 in an emergency.

How we scored it

Security (40) is the weakest factor: a tracker exposure covering about 3.2 million people, plus FTC findings of former staff access and a portal flaw that showed other patients' files. The regulatory record (48) reflects over $10 million paid to the FTC and the DOJ across two 2024 settlements. Scams and harmful content (66) is the strongest factor, because care is one-to-one with licensed clinicians and the prescribing practices prosecutors described ended in 2022. For a therapy service with no regulator case on record, compare Talkspace.