Regulatory bodies play a crucial role in overseeing and enforcing privacy laws.

In the United States, the Federal Trade Commission (FTC) is empowered to take action against companies that violate consumer privacy rights. Actions taken by the FTC can include fines, orders to cease certain practices, and requirements to delete illegally obtained data.

For health-related apps, the Health Insurance Portability and Accountability Act (HIPAA) in the United States provides additional layers of protection for personal health information. While not all mental health apps fall under HIPAA's jurisdiction, those that do must adhere to strict standards for protecting health information, with violations resulting in legal and financial penalties.

In Canada, privacy in the digital health space is governed by several key pieces of legislation, with the Personal Information Protection and Electronic Documents Act (PIPEDA) being paramount for private-sector organizations. PIPEDA sets the groundwork for how personal information must be handled by businesses, including mental health apps. It mandates obtaining an individual's consent for the collection, use, and disclosure of their personal information, ensuring that such data is protected and handled transparently.

In the European Union, the General Data Protection Regulation (GDPR) sets stringent guidelines for data protection and privacy. The GDPR is enforced by national data protection authorities, which can impose significant fines on companies that fail to comply with its provisions. This regulation emphasizes the importance of obtaining explicit consent from users before processing their personal data and mandates transparent data handling practices.