In September 2020, Hindenburg Study introduced its report on Nikola, saying itwas “an intricate fraud.” The firm acknowledged a truck appearing to cruise down a desert street under its personal electrical power in a online video was not. The SEC released an inquiry. Eventually, Trevor Milton, Nikola’s founder, was convicted of fraud. Nikola settled with the SEC for $125 million.
In 2021, J Cash Exploration posted a report contacting Faraday Upcoming “nothing but a bucket to obtain funds from U.S. traders and pour it into the black hole of personal debt designed by its founder.” A enterprise spokesperson explained “the substantive allegations of inaccurate disclosures” in the report “ended up not supported by the evidence reviewed.” The SEC launched an investigation, and the enterprise underwent a transformative restructuring.
Now, people corporations are experiencing other pressures.
Nikola and Faraday Long run in their 2022 once-a-year filings both equally disclosed “significant question” about their capabilities to continue on as heading fears.
Nikola had about seven months’ value of cash to address working expenses as of its most recent SEC submitting. The corporation did not respond to requests for comment. Nikola begun income of its battery-electrical major-duty truck final 12 months and expects to commence manufacturing on hydrogen gas mobile vans in the next 50 {515baef3fee8ea94d67a98a2b336e0215adf67d225b0e21a4f5c9b13e8fbd502} of 2023.
Faraday Foreseeable future experienced a lot less than a month’s worthy of of dollars to include running fees. A spokesperson mentioned in a assertion that the organization had elevated more funds and expects to acquire an added $65 million over the coming thirty day period, and that even though there were “troubles that impeded our progress in the previous,” Faraday Future ideas to make its 1st customer deliveries of a automobile in April.
Faraday Foreseeable future “feels comfy with its recent liquidity supporting the start out of manufacturing and delivery of our flagship FF 91 Futurist,” claimed the spokesperson.
But these stumbles and other individuals started to erode investor self-assurance in electrical autos from other firms, far too.
“You experienced companies’ just outright fraud investigations early on, and that didn’t assistance,” said Robert Bollinger, the founder and CEO of Bollinger Motors. Some traders saw those people investigations “as fodder for why they may possibly be shy to spend.”
In 2020, Bollinger Motors’ net dollars delivered by financing pursuits was additional than $20 million. The subsequent year, that amount was down to about $9 million. Mullen Automotive Inc. obtained a managing desire in Bollinger late previous yr, but in June, Bollinger had hard cash to go over a very little more than a month of running bills. Bollinger only just revived its initial items, two electric off-street cars, and is continue to waiting around to begin generation of a Course 4 truck.
As the Biden administration attempts to allay panic in the U.S. banking procedure adhering to final week’s collapse of Silicon Valley Bank, analysts following the vacation tech sector say begin-ups might have some limited-time period money challenges, but the threat of longer-phrase implications has eased.
The next-largest financial institution failure in U.S. background, the Federal Deposit Coverage Corp. took manage of SVB, which performs with a significant part of U.S. and U.K. startups, on Friday adhering to a run on deposits. That led to a “serious scramble” for Silicon Valley companies, Vacation Tech Consulting president and founder Norm Rose explained.
“Any time you won’t be able to withdraw your revenue from an establishment, the cash which is your income or your customers’ income, that is a genuine dilemma, especially on the latter portion,” he claimed.
Several travel tech vendors supplied assurance more than the weekend that their functions would go on. Navan, the recently rebranded TripActions, in a statement claimed that SVP was a “extended-standing fiscal husband or wife and purchaser” given that the company’s inception but that “Navan’s monetary position stays strong” adhering to its closure.
“A lot less than 5 per cent of our liquid property were being held by SVB,” Navan claimed in its assertion. “We have a strong community of money associates, together with Goldman Sachs, Citibank and Bank of America and do not depend entirely on SVB to offer our providers.”
Digital card payment startup Teampay on Friday afternoon said on Twitter that it “sees no possibility to operations” despite its partnership with SVB, as it suppliers its cash in other establishments.
Sonder Holdings in a assertion stated it was “actively [monitoring] the evolving scenario” with SVB. The brief-phrase lodging supplier claimed as of March 9, it had about $2 million in an working hard cash account and about $20 million in deposit accounts with SVB as properly as a $60 million line of credit rating facility.
Some firms, like American Specific World Small business Journey and AI computer software supplier Execs, submitted filings with the U.S. Securities and Exchange Commission to advise buyers that they do not have funds deposits or securities with SVB.
Further than the travel tech market, the collapse also hit organizations that relied on accounts with SVB for costs. In its assertion, Navan advised shoppers with payment accounts joined to SVB to switch to a further account to avoid disruptions in bookings. Travel management company startup TakeTwo said its U.S. functions workforce also worked in excess of the weekend to aid customers applying SVB payment instruments, such as wellbeing care management system Intelycare.
IntelyCare company travel supervisor Tricia Jenkins, in a assertion supplied by TakeTwo, claimed the problem disrupted both the firm’s immediate-monthly bill card and person company playing cards but was in a position to update with on line booking device and get alternative payment tools in place “inside hrs” by operating with TakeTwo.
Since Friday’s collapse, the Federal Reserve announced an unexpected emergency lending application, regulators have promised depositors comprehensive compensation and President Joe Biden instructed People to “have self-confidence that our technique is safe and sound” although promising to push for stricter banking laws to reduce long term failures. Even though the FDIC took management of a second financial institution, New York-primarily based Signature Bank, on Sunday, TSI running companion Matt Zito said the actions probable have prevented that “contagion” that would lead to added bank failures.
“Everyone’s likely to get their revenue out of SVB, and the lending facility will backstop just about anything a lot more that arrives down the pike,” he said. “Finally, this will blow by, and in a month we in all probability is not going to even be talking about it.”
Zito, whose current aim is coaching journey CEOs on how to construct sellable business, claimed it need to be a wakeup connect with for travel tech corporations on running banking danger and staying away from having additional than the $250,000 that is FDIC-insured in organization examining accounts. He advises spreading out resources in numerous accounts and certain investments, these types of as four-7 days U.S. treasury costs, a approach he explained that possibly “80 to 90 percent” of startups now are not next. Digital media participant manufacturer Roku, for instance, documented obtaining almost $500 million, about a quarter of all its dollars, in SVB.
Startups currently being in a position to exhibit their capacity to prevail over long run collapse in their pitch could mitigate the get worried they are possible to see from buyers in the small-expression as a final result of the collapse, Zito claimed. In the lengthier expression, investments will keep on being offered to “the best startups and most effective thoughts, and the largest concepts and the ideal teams,” he claimed.
Rose also expressed assurance in the potential of journey tech startup investments.
“Even in the worst of times, investment will come again, and innovation arrives again, and that’s a wonderful testimony in the way of the American economic system,” Rose explained. “If this is pointing to some strain in the small term, in the medium and prolonged time period, things will be fine.”
The sales year started off with a whimper. First, the covid stimulus package for the auto industry – a cut from June 1-Dec 31 of the car sales tax from 10{515baef3fee8ea94d67a98a2b336e0215adf67d225b0e21a4f5c9b13e8fbd502} to 5{515baef3fee8ea94d67a98a2b336e0215adf67d225b0e21a4f5c9b13e8fbd502} – expired. Those planning to buy cars in early 2023 instead made their purchases last year. In addition, the Chinese central government has been winding down its incentives for New Energy Vehicles (NEVs) for several years. They, too, expired at the end of 2022. That pulled planned NEV sales from 2023 into 2022, over and above the impact of the covid tax cut. In other words, electric vehicle (“EV”) sales in late 2022 were artificially high. This year will be grim across the board for the China automotive sector.
Local government incentives aren’t picking up the slack. Beijing has capped its 2023 NEV license plate incentives at the 2022 level of 70K units, while for 2023 Shanghai eliminated free license plates for PHEVs (and refuses to license urban commuter EVs such as the GM Wuling Hongguang Mini). Now Hunan has begun a 元5000 cash-for-clunkers subsidy, and the central government is urging local governments to upgrade their fleets from ICEs to EVs. However, more prosperous localities such as Shenzhen have already completed the switchover to EV taxis and buses. Most regional and lower-tier cities face a budget crunch, so the process will be slow and will focus on low-priced vehicles. That’s bad news for the many NEV startups, and for Tesla, Inc. (NASDAQ:TSLA) which sit in the premium segment.
Analysis is complicated by the Chinese [lunar] New Year holiday in late January. China is now an urban society, but its cities are populated by workers who migrated from rural areas. This year, around 250 million people traveled back to their hometowns. Car dealerships were closed, and those that reopened early remained empty. Of course, the government offices that issue license plates were closed, too.
To reiterate, it’s payback time. January sales fell 35{515baef3fee8ea94d67a98a2b336e0215adf67d225b0e21a4f5c9b13e8fbd502} overall, and 28{515baef3fee8ea94d67a98a2b336e0215adf67d225b0e21a4f5c9b13e8fbd502} for battery EVs (“BEVs”). However, as I outline below, February sales looked good only in comparison to January. That is bad news for Tesla, which will face lower margins and higher costs, due to lower capacity utilization and the delayed feed-through of higher commodity prices. It is worse news for the many startups, which will see poor sales from now until the normal cyclical increase that starts in September. NEVs are also facing pricing pressures, due to the multitude of players and spearheaded by Tesla’s price cuts.
Additional months of negative cash flow are very bad news. Already, Weltmeister (not traded) has effectively gone out of business, selling no cars this year and closing most of its remaining facilities last week. In their latest financial statements, available on Seeking Alpha, operating income remained negative for Li Auto, Inc. (LI) [Dec 2022], XPeng Inc. (XPEV) [Sep 2022], and NIO Inc. (NIO) [Dec 2022]. Sales of other entrants – Neta, Zeekr and others (not traded) – remain at very low levels. Again, BYD is an exception, as is GAC with its Aion brand. Both are profitable (or are part of larger, profitable enterprises), and so face no immediate pressures. They (alongside Tesla) also happen to be the two largest and best-performing NEV players.
Below I look at overall passenger vehicle sales, and then turn to NEVs. Going into 2023 Chinese analysts were already looking at lower growth, of the order of 30{515baef3fee8ea94d67a98a2b336e0215adf67d225b0e21a4f5c9b13e8fbd502}. I believe that is optimistic in terms of unit sales, and will represent minimal growth in 2023 for revenue and a negative for cash flow. I don’t attempt projections, since there are many articles on Seeking Alpha to provide a baseline. My last section focuses on Tesla, reiterating my January 2022 SA article projecting that Model 3 sales would decline.
Note that my core datasets are for retail sales of light passenger vehicles, but do not include imports. They also do not cover light commercial vehicles or buses, and are not wholesale shipments so ignore exports.
Payback: Overall Vehicle Sales
First, China remains the largest vehicle market, surpassing both Europe and North America. But it’s not growing. The migration for towns and farms to cities has ceased, consumers are under pressure as growth remains slow and real estate prices continue to fall, and the working-age population has been falling for a decade. Sales peaked in 2017, and will not expand going forward.
Author’s database, compiled from China Auto Dealers Assoc reports
What are the prospects for CY2023? The government is hoping for 5{515baef3fee8ea94d67a98a2b336e0215adf67d225b0e21a4f5c9b13e8fbd502} growth, but is looking to achieve that through pushing banks to lend for infrastructure and real estate investment. To use a monetary policy aphorism, that’s pushing on a wet string. Local governments saw their fiscal position deteriorate the past two years, and now have bills to pay for the covid testing mandated (but not paid for) by the central government under last year’s rolling lockdowns.
I spent most of my career as a specialist on Japan’s economy, and was in Tokyo in 1992 when their real estate bubble burst, and worked for a Japanese bank before graduate school. I’ve spent days in seminars looking at the evergreening of bad real estate loans, and how that undermined the effectiveness of macro policy. China is going down the same route, in part because that’s the only policy tool Beijing has, given the already complete buildout of regional airports, high speed rail and, lest we forget, a national expressway system that is more extensive than those of the U.S. or Europe – and doesn’t yet need maintenance.
Let’s return to automotive, and look in more detail at passenger vehicle sales. The graph below provides sales using a 3-month moving average. To help with interpretation, December each year is marked with a red dot. First, sales show a distinct seasonal pattern, peaking at the end of winter, in January when the New Year falls later in February, and otherwise (as this winter) in December. Sales then fall through August, in some years with a June bump, before beginning their annual fall ascent.
However, 2022 was different from the previous 7 years, with the rolling average showing an early August peak. That difference represents roughly 700,000 extra sales, sales that will not be booked in the first half of 2023. Compared to recent years, that suggests that sales through July will be down 10{515baef3fee8ea94d67a98a2b336e0215adf67d225b0e21a4f5c9b13e8fbd502}, assuming that consumers will be spending as normal. The Chinese government doesn’t believe that will be the case, accepting lower growth and instead focusing on financial system stability. (See, amongst many possible examples, “Caixin Global, Mar 8, 2023: China’s Financial Shake-Up Shows Policymakers’ Growing Focus on Stability, Risk.”) For the sake of brevity, I won’t examine other indicators, such as commercial vehicle sales. All point in the same direction.
Authors database, compiled from monthly CADA reports
EV Sales
What though of NEV sales? While I otherwise ignore the differentiation, one segment was up in January, PHEV (plug-in hybrids), and by 48{515baef3fee8ea94d67a98a2b336e0215adf67d225b0e21a4f5c9b13e8fbd502}. After all, battery-only EVs don’t fit every use case, and news stories over the Chinese New Year holidays were replete with EV drivers waiting in line to plug into snow-covered chargers, as cold weather depleted their range. There weren’t many PHEV options in 2020, but then not that many EVs were sold, either. The data show the relative weight of PHEVs consistently rising, from about 1 in 8 NEVs sold in 2021Q1 to a bit over 1 in 5 in 2022Q4. That suggests an additional source of pressure on pure EV sales.
Second, the rate of diffusion of NEVs has slowed. Again, as the introduction noted, national incentives have expired and local/provincial ones haven’t increased. Historically, Shanghai has been the single biggest market; altogether, the top 10 cities account for over 1 in 3 NEVs sold (source: my compilation of monthly CPCA reports). Those markets are becoming saturated, with 40{515baef3fee8ea94d67a98a2b336e0215adf67d225b0e21a4f5c9b13e8fbd502} of sales now NEVs. They are also the wealthiest cities, and so are buying the higher-priced vehicles that NEV makers must sell to be profitable. Expanding sales requires moving into Tier 3-4 cities, but those have lower incomes, are losing populations, have governments that are in fiscal straits, and face the largest real estate losses. The latter are the dominant form of household savings, and in a down market are illiquid. (For more details on real estate, see Kenneth Rogoff and Yuanchen Yang, “A Tale of Tier 3 Cities.” IMF Working Paper 22/196, September 2022.)
Authors database, drawn from icauto.com.cn and other sources
Third, there’s a price war going on. While that’s potentially good for sales volumes, it’s bad for everyone in the industry. Unfortunately for both firms and investors, competition is fierce. I track new model announcements. In 2022, my data include 232 new models and full model changes (and another 466 facelifts and minor changes). Of the new models, 70 were EVs and another 31 PHEVs. This year will see far more, with IHS anticipating 180 new EVs and PHEVs.
Authors database, drawn from icauto.com.cn and other sources
Over the course of 2023, the market will thus become more fragmented, even if some firms exit and some go out of production (as reflected in the blue line of counts of models in my database in the above graph). This should help offset the overall slowdown, as consumers will be more likely to find a model that hits their sweet spot, but it won’t help pricing. At the firm level, the net impact will depend on how many of these are new “top hats” to existing platforms that will come off an existing assembly line. For firms successfully employing a platform strategy, that will increase capacity utilization and economies of scale in component sourcing, even as it decreases sales for each individual model. Whether that will increase net profits (or slow losses) will depend on how much prices deteriorate. I don’t have access to such detailed data, nor do I have the full-time research assistant needed to pull it all together. The only analyst who seems to dive into that level of detail is Eunice Lee at Bernstein, but I have no funds invested with them so no access to those reports, which in any case I wouldn’t be able to cite.
Finally, to me the most sobering item is the 50{515baef3fee8ea94d67a98a2b336e0215adf67d225b0e21a4f5c9b13e8fbd502} fall of lithium carbonate prices since December 2022. It’s not because of a large new mine entering production, or new refining capacity. Carmakers overestimated the end-of-year sales surge of consumers rushing to buy before incentives rolled off (see here), and started paring production plans. They similar underestimated the payback of lower sales in January and particularly February. Why? – because the underlying demand for BEVs is proving below consensus.
CnEVPost
Let’s look at the performance in the major non-Tesla brands (Tesla couldn’t be included because they are slow to release domestic retail data). What the following graph illustrates is nothing short of disaster, because February sales failed in bounce back from the January holiday doldrums. The new entrants need growth to survive. Only 2 firms managed to beat December sales levels: the Guangzhou Automobile Group Co., Ltd. (GNZUF) (“GAC”) Aion brand, whose 4 models racked up sales of 270,000 units in 2022, and the small Neta (also called Hozon in some sources), with 3 models (one launched in November) and 2022 sales of 151,000. I am watching GAC, which is profitable, pays a dividend, and is trading at half of peak. Unfortunately there is no recent analysis on SA, and this article will not attempt to remedy that. Overall, though, I do not believe any of the new entrants in the graph provide “long” investment cases.
Gasgoo web site
Source: auto.gasgoo.com, to which the author appended English company names.
Tesla China
Will Tesla prove robust to these headwinds? How they fare in China in 2023 is central to their growth story and their profitability. The stock price depends on keeping both those narratives intact. Shanghai is Tesla’s largest production facility, so keeping capacity utilization high will be important to controlling costs and preserving margins. Ditto maintaining pricing.
Until we have data for 2023Q1, we will not know whether Tesla has at last dropped its pattern of end-of-quarter retail surges. Changing that habit would mean fewer exports early in a quarter and more later on, and so would leave Europe short of product, leading to a transitional quarter of poor sales. Likewise, in China operations would have to push for more sales early in the month. My own sense of organizational inertia is that such a shift could not be implemented in the space of a month or two, so again would lead to poor sales figures for the transitional quarter. I believe that Tesla management will weigh the gains in operational efficiency against the damage to the growth narrative, and choose the status quo.
That proviso aside, the data show several things.
One is Tesla’s inability to grow domestic sales of the Model 3, which in fact peaked in 2020Q4. Absent a refreshed interior and new sheet metal to update styling, sales will continue to fall under the onslaught of new models in 2023.
The second is the success of the Model Y, which sells far better than the Model 3 ever has. With a higher selling price but non-battery production costs similar to the Model 3, it is central to Tesla’s profitability.
The third is the dependence of Shanghai on exports, which since 2021Q2 have accounted for over a third of output (2022Q2 was an exception). Without the ability to sell into the European market, Shanghai would operate at under 70{515baef3fee8ea94d67a98a2b336e0215adf67d225b0e21a4f5c9b13e8fbd502} of capacity. Lower labor costs and component costs imply that fixed costs are a higher share. Ironically, that raises Shanghai’s breakeven point. (Thanks to Glenn Mercer for this point.)
Authors database, compiled from multiple underlying sources
All of this raises a number of questions.
First, as Berlin ramps up, how will Shanghai keep utilization high? No other export markets (think Australia) are big enough to absorb the excess, but preliminary data for February show domestic sales below November and December 2022, while exports were over 50{515baef3fee8ea94d67a98a2b336e0215adf67d225b0e21a4f5c9b13e8fbd502} of wholesale shipments (source: CnEVPost: Tesla delivers 33,923 … exports 40,479). I follow China, not Europe, so will lean on comments in the discussion to flesh out scenarios.
Second, Reuters reported on March 1 that Tesla will start producing a refreshed Model 3 – some new sheet metal, a modified interior – in September. However, as I argued previously on SA, the Model 3 is not in a particularly attractive segment, though sedans continue to do better in China than in North America. This should certainly stop the slide in sales, but I do not believe it will offset the limitations of the segment. Furthermore, we have no confirmation from Tesla, and every reason to believe they will miss the target date. Additionally, what will Tesla do to maintain sales of the old version after the new one has its public reveal, while will be before it is actually available for sale? Model changeovers are generally accompanied by price reductions, which with September as the date would hit both the top and bottom line in 2023Q2. Given a long history of delays, however, it’s more likely that this is a story for 2024, not this year.
Third, will sales of the Model Y hold up? That single model is now the dominant product for Tesla in China, but it is also a stupendous cash cow, maintaining enviable volume even though it is entering its third year in the Chinese market. My sense is that there is no upside potential. Unlike the U.S., in China the share of the premium market is not expanding, and the dozen or so large, high-income cities that account for most Model Y sales are becoming saturated. Lower lithium prices will support discounting across the NEV spectrum, so will not necessarily help the Model Y. It will however allow premium EV makers with their larger batteries to lower prices more than carmakers operating in lower price brackets. With higher production volumes, and tooling costs now written off, Tesla has more room to discount than new entrants with lower volumes and brand new factories and tooling. So, I also see little downside in volume terms.
Authors database, compiled from various Chinese sources
Conclusions
There are many uncertainties going into 2023. I expect the first half of the year to see much slower growth for NEVs amidst an onslaught of new product. Sales will improve only in 2023Q4, with the normal seasonal upturn, resumed albeit slow economic growth, and lower NEV prices. New entrants in automotive face high hurdles, and I expect another one or two of the smaller NEV players to exit by year’s end, and stillbirths among those just launching their initial products. Watch for additional Chinese EV IPOs – and avoid!
Among the incumbents, GAC remains interesting, with its Aion NEV. Geely Automobile Holdings Limited (OTCPK:GELYF) has about 300,000 in NEV sales, but those are spread across multiple brands and models and corporate entities. That impedes achieving scale in production, and lowers the efficiency of its platform sharing. They nevertheless remain better than other incumbents such as Great Wall, SAIC, VW, GM, Toyota, Honda, Hyundai/Kia, FAW, Dongfeng, Changan, Chery – and on and on. China remains the world’s biggest automotive market, the biggest automotive producer, and is now a net exporter in volume terms. It is also a mature market, and that lowers its attractiveness for investors. Actions speak louder than words: I have yet to take the plunge.
Tesla remains highly profitable in its China operations, but 2023 will be challenging for the Chinese industry as a whole, and Tesla will not be exempt from those pressures. Tesla increasingly depends upon sales of a single product, the Model Y, as the Model 3 is past its prime. The Model Y continues to sell well, and is in a good segment, mid-sized SUVs. However, the premium segment is not expanding, and the steady stream of new NEV models will pressure margins for all producers. Factors such as falling lithium prices help everyone, and with competition, ultimately benefit no one (other, that is, than the final consumer).
In addition, the cash cow of Tesla Shanghai faces a major risk, its reliance on exports to Europe. No other new export markets are large enough to offset any decline there. If Tesla does launch a refreshed Model 3, it will be late in the year so the impact will be in 2024. Meanwhile, while the Cybertruck will launch in the U.S. in late 2023, it is a non-starter in China, where pickups remain utilitarian work trucks that sell in modest numbers in rural areas, and not in the major, high-income cities that comprise Tesla’s core market. Newer, less expensive models are years away and will carry smaller margins multiplied by lower prices.
In sum, Tesla has less downside than the many small players in the NEV market. In line with the NEV market as a whole, Tesla did well in 2022. It’s now payback time, and in line with the NEV market as a whole, Tesla also faces little upside in 2023. That is bad news for a growth stock.
Editor’s Note: This article discusses one or more securities that do not trade on a major U.S. exchange. Please be aware of the risks associated with these stocks.
Open the website of Workit Health, and the path to treatment starts with a simple intake form: Are you in danger of harming yourself or others? If not, what’s your current opioid and alcohol use? How much methadone do you use?
Within minutes, patients looking for online treatment for opioid use and other addictions can complete the assessment and book a video visit with a provider licensed to prescribe suboxone and other drugs.
But what patients probably don’t know is that Workit was sending their delicate, even intimate, answers about drug use and self-harm to Facebook.
advertisement
A joint investigation by STAT and The Markup of 50 direct-to-consumer telehealth companies like Workit found that quick, online access to medications often comes with a hidden cost for patients: Virtual care websites were leaking sensitive medical information they collect to the world’s largest advertising platforms.
On 13 of the 50 websites, STAT and The Markup documented at least one tracker — from Meta, Google, TikTok, Bing, Snap, Twitter, LinkedIn, or Pinterest — that collected patients’ answers to medical intake questions. Trackers on 25 sites, including those run by industry leaders Hims & Hers, Ro, and Thirty Madison, told at least one big tech platform that the user had added an item like a prescription medication to their cart, or checked out with a subscription for a treatment plan.
advertisement
The trackers that STAT and The Markup were able to detect, and what information they sent, is a floor, not a ceiling. Companies choose where to install trackers on their websites and how to configure them. Different pages of a company’s website can have different trackers, and this analysis did not test every page on each company’s site.
All but one website examined sent URLs users visited on the site and their IP addresses — akin to a mailing address for a computer, which can be used to link information to a specific patient or household — to at least one tech company. The only telehealth platform that the analysis did not find sharing data with outside tech giants was Amazon Clinic, a platform recently launched by Amazon.
Health privacy experts and former regulators said sharing such sensitive medical information with the world’s largest advertising platforms threatens patient privacy and trust and could run afoul of unfair business practices laws. They also emphasized that privacy regulations like the Health Insurance Portability and Accountability Act (HIPAA) were not built for telehealth. That leaves “ethical and moral gray areas” that allow for the legal sharing of health-related data, said Andrew Mahler, a former investigator at the U.S. Department of Health and Human Services’ Office for Civil Rights.
“I thought I was at this point hard to shock,” said Ari Friedman, an emergency medicine physician at the University of Pennsylvania who researches digital health privacy. “And I find this particularly shocking.”
In October and November, STAT and The Markup signed up for accounts and completed onboarding forms on 50 telehealth sites using a fictional identity with dummy email and social media accounts. To determine what data was being shared by the telehealth sites as users completed their forms, reporters examined the network traffic between trackers using Chrome DevTools, a tool built into Google’s Chrome browser.
On Workit’s site, for example, STAT and The Markup found that a piece of code Meta calls a pixel sent responses about self-harm, drug and alcohol use, and personal information — including first name, email address, and phone number — to Facebook.
The investigation found trackers collecting information on websites that sell everything from addiction treatments and antidepressants to pills for weight loss and migraines. Despite efforts to trace the data using the tech companies’ own transparency tools, STAT and The Markup couldn’t independently confirm how or whether Meta and the other tech companies used the data they collected.
After STAT and The Markup shared detailed findings with all 50 companies, Workit said it had changed its use of trackers. When reporters tested the website again on Dec. 7, they found no evidence of tech platform trackers during the company’s intake or checkout process.
“Workit Health takes the privacy of our members seriously,” Kali Lux, a spokesperson for the company, wrote in an email. “Out of an abundance of caution, we elected to adjust the usage of a number of pixels for now as we continue to evaluate the issue.”
“Advertisers should not send sensitive information about people through our Business Tools,” Dale Hogan, a spokesperson for Meta, wrote in an email.
Patients may assume that health-related data is always protected by privacy regulations including HIPAA. Workit, for one, begins its intake form with a promise that “all of the information you share is kept private and is protected by our HIPAA-compliant software.”
“The very reason why people pursue some of these services online is that they’re seeking privacy,” said David Grande, a digital health privacy researcher at the University of Pennsylvania.
But the reality online is more complex, making it all but impossible for the average user to know whether the company they’re entrusting with their data is obligated to protect it. “Individually, we have a sense that this information should be protected,” said Mahler, who is now vice president of privacy and compliance at CynergisTek, a health care risk auditing company. “But then from a legal and a regulatory perspective, you have organizations saying … technically, we don’t have to.”
Rather than providing care themselves, telehealth companies often act as middlemen connecting patients to affiliated providers covered by HIPAA. As a result, information collected during a telehealth company’s intake may not be protected by HIPAA, while the same information given to the provider would be.
“All the privacy risks are there, with the mistaken but entirely reasonable illusion of security,” said Matthew McCoy, a medical ethics and health policy researcher at the University of Pennsylvania. “That’s a really dangerous combination of things to force the average consumer to deal with.”
In response to questions for this story, representatives of Meta, Google, TikTok, Bing, Snap, and Pinterest said advertisers are responsible for ensuring they aren’t sending sensitive information via the tools. Twitter did not respond to requests for comment.
“Doing so is against our policies and we educate advertisers on properly setting up Business tools to prevent this from occurring,” wrote Meta’s Hogan. “Our system is designed to filter out potentially sensitive data it is able to detect.”
LinkedIn’s tracker “collects URL information which we immediately encrypt when it reaches our servers, delete within 7 days and do not add to a profile,” Leonna Spilman, a spokesperson for the company, wrote in an email.
Nevertheless, three of the seven big tech companies also said they had taken action to investigate or stop the data sharing.
Google is “currently investigating the accounts” in question, spokesperson Elijah Lawal wrote in an email.
“In response to this new information, we have paused data collection from these advertisers’ sites while we investigate,” Snap spokesperson Peter Boogaard wrote in an email.
Pinterest “offboarded the companies in question,” spokesperson Crystal Espinosa wrote in an email.
A boom industry on the edge of the law
Together, the companies in this analysis reflect an increasingly competitive — and lucrative — direct-to-consumer health care market. The promise of a streamlined, private prescription process has helped telehealth startups raise billions as they seek to capitalize on a pandemic-driven boom in virtual care.
Hims & Hers, one of the largest players in the space, is now a publicly traded company valued at more than $1 billion; competitor Ro has raised $1 billion since its founding in 2017, with investors valuing the company at $7 billion. Thirty Madison, which operates several telehealth companies focused on different medical needs, is valued at more than $1 billion.
The industry’s rapid growth has been enhanced by its ability to use data from tools like pixels to target advertisements to increasingly specific patient populations and to put ads in front of users who have visited their site before. The companies we analyzed mostly provide care and prescriptions for conditions like migraines, sexual health, or mental health disorders rather than comprehensive primary or urgent care — making browsing their websites inherently sensitive.
In the same way visiting an opioid use disorder treatment center can identify an individual as an addiction patient, data about someone visiting a telehealth site that treats only one condition or provides only one medication can give advertisers a clear window into that person’s health. Direct answers to onboarding forms could be even more valuable because they’re more detailed and specific, said McCoy. “And it’s more insidious because I think it would be all that much more surprising to the average person that information that you put in a form wouldn’t be protected. It’s both worse and more unexpected.”
Consider the form for Thirty Madison’s Cove, which offers migraine medications. It prompts visitors to share details about their migraines, past diagnoses, and family history — and during our testing sent the answers to Facebook and Google. If a user added a medication to the cart, detailed information about the purchase, including the drug’s name, dose, and price, were also sent to Facebook, along with the user’s hashed full name, email, and phone number.
While hashing obscures those details into a string of letters and numbers, it does not prevent tech platforms from linking them to a specific person’s profile, which Facebook explicitly says it does before discarding the hashed data.
A Google tracker collects answers to medical screening questions on Cove’s website.
A tracker tells Facebook when a user adds a medication to the cart. It also sends the user’s hashed name, email, and phone number.
“It’s a pure monetization play,” said Eric Perakslis, chief science and digital officer at the Duke Clinical Research Institute. “And yes, everybody else is doing it, it’s the way the internet works. … But I think that it’s out of step with medical ethics, clearly.”
In particular, experts worry that health data could be used to target patients in need with ads for services and therapies that are unnecessary or even harmful.
The big tech platforms that responded for this story say they do not allow targeted advertising based on specific health conditions, and some telehealth companies said they only use the data collected to measure the success of their advertising. However, as The Markup has previously reported, advertisers may still be able to target ads on Facebook using terms that are close proxies for health conditions.
On 35 of the 50 websites, STAT and The Markup found trackers sending individually identifying information to at least one tech company, including names, email addresses, and phone numbers.
That presents patients with a Catch-22. “It requires anyone that wants to take advantage of telehealth … to expose a lot of the same information that they would reveal within a protected health care relationship,” said Woodrow Hartzog, a privacy and technology law professor at Boston University — but without the same protections.
In recent months, regulators have begun cracking down on the indiscriminate collection and sale of personal health data.
After issuing a warning to businesses about selling health information in July, the Federal Trade Commission sued data broker Kochava, alleging that the company put consumers at risk by failing to protect location data that could reveal sensitive details about people’s health, such as a visit to a reproductive health clinic or addiction recovery center. Kochava has asked for the case to be dismissed and countersued the FTC.
The increased attention reflects growing fears about how health data may be used once it enters the black boxes of corporate data warehouses — whether it originates from a hospital, a location tracker, or a telehealth website.
“The health data market just continues to kind of spiral out of control, as you’re seeing here,” said Perakslis.
But thanks to their business structures, many of the companies behind telehealth websites appear to be operating on the outskirts of health privacy regulations.
‘It does seem deceptive’
When users visit Cerebral, a mental health company whose prescribing and business practices came under federal investigation this year, they are required to answer a series of “clinically tested questions” that can cover a wide range of conditions, including depression, anxiety, bipolar disorder, and insomnia. During testing, with every response — such as clicking a button to indicate feeling depressed “more than half the days” over the last two weeks — a pixel sent Facebook the text of the answer button, the specific URL the user was visiting when clicking the button, and the user’s hashed name, email address, phone number.
At a doctor’s office, that kind of detail collected on an intake form would likely be subject to HIPAA. But as with most of the telehealth companies in this analysis, Cerebral Inc. itself doesn’t provide care; its website connects patients with providers like those employed by Cerebral Medical Group, P.A. and others. While those medical groups are HIPAA-covered entities that cannot share protected health information with third parties except under narrow circumstances, Cerebral claims in its privacy policy to be a go-between that is not covered by HIPAA — except in limited cases when it acts as a business associate of a medical group, pharmacy, or lab.
Cerebral did not answer detailed questions that would clarify what these cases might be. But in a Nov. 30 email, spokesperson Chris Savarese said the company would adjust its use of tracking tools. “We are removing any personally identifiable information, including name, date of birth, and zip code from being collected by the Meta Pixel,” he wrote.
However, when STAT and The Markup tested Cerebral’s website again on Dec. 7, reporters found that a Meta Pixel was still sending answers to some intake questions and hashed names to Facebook, and trackers from Snap and Pinterest were also collecting hashed email addresses.
A Facebook tracker collected answers from a Cerebral intake form during an October test by STAT and The Markup.
During a December test, a Facebook tracker was still collecting Cerebral’s intake form answers.
The telehealth companies that responded to detailed queries said their data-sharing practices adhered to their privacy policies. Those kinds of policies commonly include notice that some — but not all — health data shared with the site is subject to HIPAA. Many companies responded that they were careful to ensure that data shared via third-party tools was not considered protected health information.
But the structure of the companies’ businesses — and the inscrutable language in their privacy policies and terms of use — make it difficult for consumers to know what data would qualify as protected, and when.
“There is so much intransparency, and that makes it complex and maybe even deceptive for consumers,” said Sara Gerke, a professor of health law and policy at Penn State Dickinson Law.
Several telehealth companies claimed that the information collected from their websites was not personally identifiable because it was hashed. HIPAA allows health information to be shared when it has been de-identified. However, hashing does not anonymize data for the tech platforms that receive it and match it to user profiles. And every data packet sent by a tech company’s tracker includes the user’s IP address, which is one of several unique identifiers that explicitly qualify health data for protection under HIPAA.
Further complicating decisions for patients, at least 12 of the direct-to-consumer companies examined in this investigation promise on their websites that they are “HIPAA-compliant.” That could encourage users to think all the data they share is protected and lead them to divulge more, said Hartzog. Yet the regulations apply to the websites’ data use only in limited cases.
Monument, a site that offers alcohol treatment, starts its intake form by saying, “Any information you enter with Monument is 100{515baef3fee8ea94d67a98a2b336e0215adf67d225b0e21a4f5c9b13e8fbd502} confidential, secure, and HIPAA compliant.” Yet in its responses to STAT and The Markup, it said that it does not consider information transmitted to third parties from that form — including answers to questions like “In the past year, have you continued to drink even though it was making you feel depressed or anxious or adding to another health problem? or after having had a memory blackout?” — to be protected health information under HIPAA.
“If they’re not covered by HIPAA and they have a HIPAA-compliant badge, that seems like a case the FTC could bring,” said Justin Brookman, the director of technology policy for Consumer Reports and former policy director with the FTC, which has previously charged companies for deceptive use of HIPAA-compliant badges. “There’s an implication there that you’re regulated in certain ways, that your data is protected, and so it does seem deceptive.”
Such data sharing could be particularly damaging to patients seeking care for substance use disorders, said Jacqueline Seitz, senior staff attorney for health privacy at the Legal Action Center — especially if it enters opaque data brokerages where it can be resold and repurposed indefinitely.
Several companies in this analysis are capitalizing on federal waivers activated during the pandemic that allow controlled substances like suboxone, which is used to treat opioid use disorder, to be prescribed virtually. Under federal law, qualifying addiction treatment providers — including those that prescribe suboxone — are held to patient privacy standards even stricter than HIPAA. For example, Workit’s physician group states it is forbidden from acknowledging “to anyone outside of the program that you are a patient or disclos[ing] any information identifying you as a substance use disorder patient” except in narrow situations.
Nonetheless, STAT and The Markup found that Workit and other telehealth companies — in their role connecting patients to providers — share information that identifies a user as someone seeking addiction treatment. On Boulder Care’s website, a pixel sent Facebook our name and email when we joined a suboxone treatment program waitlist. And trackers on the website of Bicycle Health, another online suboxone provider, notified Google and Bing that our email address had been entered on an “enrollment confirmation” URL.
Boulder Care chief operating officer Rose Bromka said the company had started improving its “website hygiene” before being contacted for this article, and restricted the information sent by the Meta pixel after reviewing our findings.
However, Bromka added that Boulder still tracks some information about website visitors to guide its advertising.
“We are always looking to balance ensuring we are able to get the word out about options with holding to our value set,” she said.
Big tech’s black boxes
Meta, Google, TikTok, Bing, LinkedIn, Snap, and Pinterest say they have policies against using sensitive health data to help target advertisements.
“We clearly instruct advertisers not to share certain data with us and we continuously work with our partners to avoid inadvertent transmission of such data,” TikTok spokesperson Kate Amery wrote in an email, adding, “[W]e also have a policy against targeting users based on their individual health status.”
Meta and Google claim to have algorithmic filters that identify and block sensitive health information from entering their advertising systems. But the companies did not explain how those systems work or their effectiveness. By Facebook’s own admission to investigators from the New York Department of Financial Services in 2021, its system was “not yet operating with complete accuracy.”
To trace what happened to data collected by trackers, STAT and The Markup created dummy accounts logged into Facebook, TikTok, and Twitter while testing the telehealth websites. Reporters then used the platforms’ “download your data” tools in an attempt to determine whether any health information the trackers collected was added to our profiles.
The information provided by those tools was so limited, however, that STAT and The Markup couldn’t confirm how or whether the sensitive health information was used.
For example, a Meta Pixel on RexMD, which prescribes erectile dysfunction drugs, collected the name of the medication in our cart, our email, gender, and date of birth. Facebook’s transparency tool, however, only showed 10 “interactions” on RexMD’s website, with generic descriptions like “ADD_TO_CART.” It did not provide details about the specific data Facebook ingested during those interactions. A TikTok pixel collected some of that same information from RexMD, but TikTok’s report on our “usage data from third-party apps and websites” had just one line: “You have no data in this section.”
Our Twitter data showed that the company knew the dummy account user had selected a product on RexMD’s website and the exact URL on which that product was selected.
On some websites, users’ data was also being collected by “custom events,” meaning that a website owner deliberately created a custom tracking label that could have a phrase such as “checkout” in it but wouldn’t necessarily show up in the tech platforms’ transparency tools.
Only four companies answered whether they had ever been notified by Facebook of potentially sensitive health information. Monument and Favor had data flagged but said they determined it wasn’t sensitive. Lemonaid received a notification in error related to a promotional code, and Boulder Care had received none.
Telehealth websites should be held accountable for the trackers they install, said Hartzog, the Boston University law professor. But “big platforms that are deploying these surveillance technologies also need to be held accountable, because they’re able to vacuum up every ounce of personal data on the internet in the absence of a rule that tells them not to.”
The companies in this investigation said their services fill an important need. “The makeup of the traditional health care system has in many cases prevented people from accessing treatment for conditions that should be easy to treat,” Scott Coriell, a spokesperson for Hims & Hers, wrote in an email. Companies that serve patients with mental health or substance use disorders emphasized that long wait times to see in-person providers, and the stigma associated with seeking care, made virtual services especially valuable.
Marketing supported by third-party tracking is part of making that care accessible, some argued. “Monument uses online advertising platforms to raise awareness of our evidence-based treatment for alcohol use disorder, and get people the support and relief they deserve,” wrote CEO Michael Russell. “We transmit the minimum amount of data required to allow us to track the effectiveness of our advertising campaigns.” Favor spokesperson Sarah Abboud argued that calling standard industry practices into question could threaten trust in those services.
But health privacy and policy experts see a disconnect between the industry’s stated emphasis on privacy and its data-sharing practices. “Telemedicine providers should have realized from the get-go that if their entire business model is to seamlessly move people from marketing to care and the care will be online, then there’s going to be more personal identifiable information submitted and thus more privacy risk and thus more privacy liability,” said Christopher Robertson, a health law and policy professor at Boston University.
One problem may be that marketing teams don’t fully understand privacy regulations, and legal teams don’t have a handle on how the marketing tools work.
Sara Juster, privacy officer for the weight-loss telehealth company Calibrate, wrote in an email that the company doesn’t “send any health information collected in our eligibility flow back to platforms.” But a Meta Pixel on its site sent data including height, weight, BMI, and other diagnoses, like diabetes, to Facebook. Juster then clarified the pixel was a duplicate that should have been removed in a tracking audit earlier this year.
However, as of Dec. 7, a Meta Pixel was still present on the site and sharing hashed identifiers and checkout events with Facebook. The pixel appeared to have been reconfigured, though, to send less information than it had during our original testing.
Without updated laws and regulations, experts said patients are left to the whims of rapidly evolving telehealth companies and tech platforms, who may choose to change their privacy policies or alter their trackers at any time.
“It doesn’t make any sense that right now, we only have protections for sensitive health information generated in certain settings,” said McCoy, “but not what can be equally sensitive health information generated in your navigation of a website, or your filling out of a very detailed form about your history and your prescription use.”
This article was co-reported with The Markup, a nonprofit newsroom that investigates how powerful institutions are using technology to change our society. Sign up for its newsletters here.
