On July 29, 2026, the U.S. Federal Trade Commission (FTC), together with agencies from California and Utah, sued Hims & Hers in the U.S. District Court for the Northern District of California.

Hims & Hers provides telehealth services through its website and app, including services for mental health, sexual health, hair loss, and weight loss. When seeking treatment, users must provide medical histories, treatment needs, and other personal information through an online consultation process. Before deciding whether to continue, consumers need to understand who will have access to that information and whether it will be used for advertising.

According to the complaint, Hims & Hers stated on its website and in online and offline advertising that consumers could use its services privately and that medical records and sensitive information would be accessible only to the healthcare providers responsible for treatment. The FTC alleges, however, that Hims & Hers provided consumers’ health information to advertising platforms including Meta and Snap through customer lists, Meta Pixel, Conversions API, and other advertising tracking tools.

The FTC alleges that Hims & Hers’ privacy statements were inconsistent with its actual data practices and that the company did not clearly explain that it would provide sensitive health information to advertising platforms. On that basis, the FTC brought two privacy claims under Section 5 of the FTC Act: first, that statements about privacy protection were deceptive; and second, that the company failed to adequately disclose its sharing of health information with third parties.

The case is at the complaint stage, and the relevant facts and legal liability remain subject to the court’s determination. Parts of the public complaint concerning the sharing of health information have been redacted. This article analyzes only the information currently available in the complaint.

1. How Hims & Hers Described the Use of User Information

In paragraphs 60 through 65, the FTC summarizes Hims & Hers’ privacy statements on its website, in online advertising, through influencer promotions, and in offline advertising. Both privacy claims rely on these statements.

Hims & Hers offers services involving mental health, erectile dysfunction, premature ejaculation, hair loss, and weight loss. The FTC’s position is that the way the platform describes privacy protection affects whether consumers are willing to seek treatment through the platform and submit related information.

The Hims & Hers homepage previously included an explanation under the heading “How do you ensure patient privacy?” stating that medical records and sensitive information were accessible only to the healthcare providers responsible for treatment. Online advertising described the service as a “100% online, private and secure” process. Some paid influencers described the service as “discreet,” while television, radio, and podcast advertisements stated that the medical conditions at issue could be handled privately through the platform. Consumers could understand these statements to mean that sensitive health information would be accessible only to treatment providers, that they could use the services privately, and that the platform would not disclose their medical matters to unrelated third parties.

The FTC’s review was not limited to the privacy policy. The homepage, consultation entry points, advertising copy, influencer materials, and other public-facing communications could all affect how consumers understand the scope of access to their information and its sharing with third parties. Terms such as “private” and “discreet” are general, but in the context of specific medical services they may still create a definite expectation about how information will be handled.

2. Two Forms of Health Information Sharing Described in the Complaint

Paragraphs 66 through 77 describe the data-sharing practices alleged by the FTC. They include providing advertising platforms with selected customer lists and automatically sending website Events through advertising technologies embedded in the website or connected to company servers. Some list categories and event names have been redacted, but the two forms of processing and the main recipients can be identified from the public text.

(1) Uploading Customer Lists to Meta and Snap

According to the complaint, Hims & Hers provided selected customer lists to Meta, which matched consumers on those lists to their Facebook or Instagram accounts and used the matches to create advertising audiences. Hims & Hers is also alleged to have uploaded lists to Snap in a similar way, matching consumers to their Snapchat accounts.

Advertising platforms typically use email addresses, telephone numbers, or other identifiers to locate corresponding accounts. Determining whether a list contains health information requires examining how the list was selected and what its members have in common. If a list is generated by treatment category, consultation status, prescription relationship, or another health-related condition, the list itself may convey corresponding health information even if the uploaded fields do not expressly name a disease.

Paragraph 74 also alleges that Hims & Hers used the information to create narrowly segmented advertising audiences. Because parts of that paragraph are redacted, the public text does not fully explain how each audience was selected. The available text indicates that the FTC considered how the lists were generated, whether the individuals could be matched to personal accounts, and how the matched audience was used for advertising.

(2) Sending Website Events Through Meta Pixel and Conversions API

The complaint also addresses Meta Pixel and Conversions API. It defines Events as actions taken by visitors on the Hims & Hers website. Meta Pixel is code embedded in a website through which Meta can collect and track those events. Conversions API connects an advertiser’s servers, website, app, or other internal software directly to Meta’s systems to send the relevant events.

The two tools involve browser-side and server-side data transfers. If a particular Pixel request does not appear in the website front end, the same event may still be sent through Conversions API. Whether a cookie banner, browser-side tag management, and blocking rules also control server-side transfers must be verified against the actual configuration and network traffic.

In addition to Meta and Snap, the complaint identifies other advertising technologies used on the Hims & Hers website, including pixels or server-side tools from Microsoft, Google, Criteo, MediaBids, PartnerCentric, PebblePost, Pinterest, Spotify Ad Analytics, Reddit, StackAdapt, TikTok, The Trade Desk, and X. The FTC alleges that several of these tools obtained users’ health information through similar event-tracking methods. Because the public complaint does not fully disclose the events and parameters associated with each tool, it does not establish that every tool sent the same information on every page.

Whether a website event involves health information depends on the page where the event occurred, the user’s action, the transmitted parameters, identity-matching information, and the recipient’s use of the data.

Page views, form submissions, and button clicks are ordinary website analytics events. When those actions occur on a particular treatment page, during a consultation, or at the prescription stage, and can be associated with an individual or advertising-platform account, the recipient may learn about the user’s health condition or treatment needs.

3. The FTC’s Two Privacy Claims Under Section 5

The FTC’s two privacy causes of action under Section 5 rely on the same data-sharing facts, but address statements the company made and information it allegedly failed to disclose.

The first claim concerns Hims & Hers’ privacy statements. The FTC alleges that Hims & Hers expressly or implicitly represented that sensitive health information supplied by users would be accessible only to treatment personnel and that users could obtain services privately, while the information was in fact provided to third-party advertising platforms. The FTC contends that these representations affected consumer choice and therefore constituted deceptive practices prohibited by Section 5 of the FTC Act.

The second claim concerns Hims & Hers’ alleged failure to adequately disclose that health information would be provided to advertising platforms. According to the FTC, consumers might have reconsidered whether to register for and use Hims & Hers if they had known that the information would be transmitted to third-party advertising platforms. Because the company emphasized the private nature of its services without clearly explaining that sharing, the FTC pleaded it as a separate deceptive practice.

The FTC’s review of privacy promises was not confined to the privacy policy. The complaint cites the website homepage, online advertising, influencer promotions, and television, radio, and podcast advertising because those materials collectively shape consumers’ understanding of the service.

If a company prominently states that medical records are accessible only to treatment personnel, a general reference in the privacy policy to “advertising partners” or “analytics providers” may not dispel the impression created by the earlier statement. Whether disclosure is adequate also depends on where it appears, what it says, when it is shown, and whether consumers can see it before submitting consultation information.

The two claims address distinct issues. The first asks whether the company’s privacy promises were consistent with its actual practices. The second asks whether the company omitted sharing facts that could affect consumer choice.

Under this theory, adding a broad category of third parties to a privacy policy does not by itself resolve a conflict between a specific promise and actual data flows. Removing terms such as “private” or statements that information is accessible “only to treatment personnel” also does not replace a clear explanation of the recipients of health information and the advertising purposes for which it is used.

The FTC also connects disclosure to the timing of consumer decisions. Hims & Hers users first encounter privacy statements on the website or in advertising, then enter the consultation process and submit medical information. If information about sharing appears only in a location users are unlikely to notice, or only after they have submitted their information, it may not establish that consumers understood the actual practice when deciding whether to use the service. Other allegations in the complaint concerning charges, renewals, and cancellation follow a similar approach by considering the location and timing of information when assessing whether consumers received adequate notice before making a decision.

The FTC’s two privacy claims arise under Section 5 of the FTC Act, and the complaint does not treat HIPAA applicability as a prerequisite for those claims.

For digital health products, whether a company is directly subject to HIPAA does not replace the consumer-protection analysis. Privacy promises, material practices that were not explained to users, and actual uses of health information may still be reviewed under the FTC Act and state consumer-protection rules.

4. Suggested Review Scope for Health Websites and Apps

The analysis above involves three groups of facts that must be compared: what the company told consumers, the context in which users submitted information, and what the website or app actually sent to third parties. The two claims likewise require companies to examine whether their statements are accurate and whether their disclosures are adequate. A review of advertising technologies and third-party sharing by a health website or app should therefore cover the following areas.

(1) Compile all materials that may create privacy promises.

The review should cover the privacy policy, homepage, consultation pages, app interfaces, advertising copy, influencer materials, customer-service scripts, and other marketing communications. It should identify how each item describes privacy, security, the scope of information access, and third-party sharing.

(2) Record actual data transfers by user scenario.

Browser-side pixels, mobile SDKs, server-side APIs, and customer-list uploads should be examined separately for treatment-page visits, the start of a consultation, questionnaire submission, recommendations, payment, and subscription entry. Testing should also distinguish between logged-out and logged-in states, before and after consent, and after consent is refused or withdrawn.

(3) Evaluate events and lists in their business context.

Review records should identify the page and action that generated an event, the transmitted parameters, the method of identity matching, the receiving platform, and the advertising purpose. Searching only for field names such as “health” or “diagnosis” may miss health information conveyed by the combined effect of a treatment page, consultation status, and account matching.

(4) Compare actual data flows against public statements, user choices, and vendor arrangements.

Depending on the cause of any discrepancy, remediation may include stopping unnecessary event transfers, isolating sensitive pages, adjusting server-side interfaces, restricting list use, changing advertising-platform configurations, or improving disclosures and choice mechanisms. Test records, version information, and approval grounds should be retained to confirm that later product or marketing changes do not reintroduce the same processing.

The Hims & Hers case has not resulted in a court judgment, but the complaint shows the main issues the FTC examines when reviewing digital health services. Statements about privacy protection should remain consistent with data transfers and third-party sharing in specific treatment contexts. Companies should also determine whether consumers can clearly understand those practices before submitting health information. Reviewing only the privacy policy, or checking only one pixel or SDK, cannot provide a complete assessment of whether actual practices match public representations.

References

FTC press release: FTC and States Act Against Hims & Hers for Deceptive and Unlawful Privacy Practices; Complaint for Permanent Injunction, Monetary Judgment, Civil Penalty Judgment, and Other Relief.