Mood Logs for Sale: The Unregulated Market in Your Most Private Thoughts

At 2:47 a.m., a college student in Ohio types a note into a popular mood-tracking app: feeling hopeless, can't sleep again. She believes the entry is private — a digital diary, sealed and safe. Legally speaking, she may be wrong. The note is more likely to resemble a postcard than a sealed letter, because the app handling her despair probably answers to no federal health privacy law at all.

That gap between what Americans assume and what the law actually provides is the subject of a quiet but growing debate in Washington, in courtrooms, and among the researchers who study how sensitive information travels through the advertising economy.

The HIPAA Illusion

The Health Insurance Portability and Accountability Act of 1996 is the most famous privacy law in the United States, and also the most misunderstood. HIPAA governs covered entities — hospitals, insurers, and their business associates — not the technology industry at large. A therapist's office must protect your session notes. The wellness app you downloaded from an app store generally does not.

The distinction matters because the mental health app market has exploded. Analysts estimate the sector generates billions of dollars annually, spanning meditation platforms, journaling tools, AI chatbots that promise to listen without judgment, and symptom trackers for anxiety and depression. These products sit in a regulatory gray zone. Unless an app connects to a clinic, bills insurance, or contracts with a provider, the emotional data it collects typically falls outside HIPAA's perimeter entirely.

The Federal Trade Commission has begun testing the edges of that gray zone. In 2023, the agency reached a landmark settlement with BetterHelp, ordering the online counseling platform to pay $7.8 million over allegations that it shared users' email addresses and intake questionnaire answers — including disclosures about mental health struggles — with advertisers on Facebook and Snapchat. The FTC's action was notable not only for its size but for its framing: the commission treated the disclosure of mental health information to ad platforms as a betrayal of an explicit privacy promise, not merely a technical violation.

Investigators at Mozilla have reached similar conclusions from the other direction. The foundation's Privacy Not Included reviews have repeatedly flagged mental health apps for broad data-sharing practices, weak password requirements, and vague language about "improving services" that can conceal advertising use. In one widely cited finding, the majority of mental health apps examined received the foundation's lowest privacy rating.

From Symptom to Segment

How does an anxiety log become a marketing asset? The path usually runs through the machinery of programmatic advertising.

When an app transmits user information to an advertising platform — an email address, a device identifier, an IP address, sometimes answers to intake questions — that data can be matched to existing user profiles. The person is then sorted into audiences and segments. Advertisers bid for access to those segments, sometimes without ever knowing exactly what's inside them. The result is a strange kind of laundering: no advertiser necessarily sees your therapy notes, but your phone begins showing ads for credit repair services, payday lenders, or weight loss products at precisely the moments your data suggests you're vulnerable.

Privacy researchers have documented how predictable this targeting can be. A 2022 study published by Duke University researchers analyzed data broker marketplaces and found brokers advertising segments built around mental health conditions — including one list labeled around "despair" and another around people described as feeling anxious in social situations. These were not obscure corners of the internet. They were commercial products with listed prices.

The consequences extend beyond annoyance. In an era when health data breaches regularly make headlines — from the 2024 Change Healthcare ransomware attack that disrupted pharmacies nationwide to smaller breaches at telehealth startups — sensitive information can resurface in places its owners never imagined. And while some states have begun to act, the patchwork is uneven. Washington's My Health My Data Act, which took effect in 2024, extends health privacy obligations to consumer apps. California, Nevada, and Connecticut have passed related measures. Residents of most states remain covered by little more than the app's own terms of service.

Reading the Fine Print Before the Breakdown

For consumers, the practical challenge is vetting an app before disclosing anything intimate. Privacy advocates suggest a short checklist:

• Look for the lawyer words. Search the privacy policy for phrases like "de-identified," "third parties," "advertising partners," and "business purposes." If emotional data can be "de-identified" and shared, assume re-identification is possible — research has repeatedly shown that supposedly anonymous data can often be re-linked to individuals.
• Check the permissions. A journaling app that requests access to contacts, location, or the microphone is telling you something. Ask why it needs what it's asking for.
• Find the data deletion path. A trustworthy app makes it straightforward to delete your history and your account. If deletion requires a certified letter, that's a signal.
• Prefer apps tied to clinical care. Services that operate inside a healthcare system or bill insurance are more likely to fall under HIPAA — though it's fair to ask them to confirm it in writing.
• Consider the business model. Apps that charge subscriptions have a clearer incentive than free apps whose revenue depends on advertising. Free is a price, but it's also a clue.

There is also a middle path that many overlook: analog tools. A paper journal, encrypted notes stored locally on a device, or a conversation with an actual licensed professional covered by confidentiality law all keep sensitive reflections out of the advertising economy entirely.

The Conversation Ahead

Lawmakers have noticed. Proposed federal legislation, including the Health Data Use and Privacy Commission Act and various iterations of a national privacy framework, would extend protections to consumer health data. State attorneys general are increasingly willing to sue. But regulation moves at the speed of legislation, while app stores move at the speed of a download.

The student in Ohio writing her 2:47 a.m. note deserves better than a terms-of-service document she'll never read. Until the law catches up, the burden of vigilance falls on users — an arrangement privacy scholars describe as "privacy self-management," and which, for someone in crisis, is a lot to ask.

The first step is simply knowing the question to ask: not is this app helpful? but who else is listening?