Mental health company Cerebral failed to protect sensitive personal data, must pay $7 million

The report details a privacy breach at telehealth provider Cerebral after the company deployed invisible tracking pixels that allegedly sent sensitive personal and health information for about 3.2 million consumers to third-party advertisers; the FTC reached a settlement imposing restrictions on data use, refunds to affected customers, and civil penalties. The article lists the types of exposed data (including PHI such as treatment details and self-assessment responses), links to regulatory notices, and offers practical post-breach advice for individuals.