FTC sues Hims & Hers over alleged health-data sharing
The Federal Trade Commission and two state partners sued Hims & Hers on July 29, alleging that the telehealth company shared consumers’ sensitive health information with advertising platforms despite describing its services as private, secure and discreet.
The complaint was filed in the U.S. District Court for the Northern District of California by the FTC, the People of California acting through Los Angeles County Counsel and the Utah Division of Consumer Protection. The case is pending, and the complaint’s allegations have not been proven in court.
What the complaint alleges
According to the complaint, Hims shared information with advertising platforms through two principal mechanisms. First, the FTC says the company uploaded or matched lists of certain customers with platforms including Meta and Snap. That process can allow an advertiser to create or reach an audience based on information associated with customer accounts or activity.
Second, the complaint alleges that Hims used automated tracking technologies that sent certain website events to third parties. The filing specifically identifies Meta Pixel and Meta’s Conversions API. The FTC describes those tools as capturing actions on Hims websites and transmitting selected events to Meta.
The complaint also says Hims used pixels or similar tracking tools associated with other advertising platforms, including Google, Microsoft, Pinterest, TikTok, Reddit and X. The filing’s allegations concern customer lists, website events and tracking technologies. It does not establish that every Hims customer’s medical record was disclosed or that every health-related interaction was shared.
Why the privacy promises matter
The FTC says Hims marketed its process as “100% online, private, and secure” and represented that sensitive health information would be accessed only by medical providers. According to the complaint, those messages could lead consumers to believe that Hims would not disclose their health information to third parties without consent.
The agency alleges that Hims did not clearly and conspicuously disclose the extent to which advertising platforms could receive information through customer matching and tracking tools. Whether those representations were misleading, and whether the company’s disclosures were legally sufficient, will be contested in the case.
What Hims’ privacy policy says
Hims & Hers’ published privacy policy was last updated March 26, 2026. It describes the use of cookies, analytics and advertising technologies and says the company may provide personal information to marketing and advertising partners. The policy gives Facebook Audiences as an example of an advertising service and says advertising partners may receive information connected to activity on health-related pages.
The policy also says that some information disclosed to third parties may be considered a “sale” or “sharing” under California and other state privacy laws. It offers controls for targeted advertising and certain data sales or sharing through the company’s Privacy Center, “Your Privacy Choices” tools and, where recognized, Global Privacy Control.
Hims’ policy separately discusses health information and HIPAA. It says Hims & Hers is not itself a HIPAA covered entity, while a medical group, pharmacy or other partner may have a different status. The policy says HIPAA applicability can depend on the transaction, the company’s role and the information involved. It also distinguishes information protected under applicable law from information that may be used or disclosed under the privacy policy.
The policy further says that opting out does not necessarily remove information already sold or shared and does not stop all interest-based advertising. Those disclosures do not resolve the FTC’s allegations; the court will have to assess what Hims told consumers, what information was transmitted, how the disclosures occurred and whether the company’s controls were adequate.
Related billing allegations
The same lawsuit separately alleges that Hims charged some consumers for prescription treatments soon after they submitted medical intake forms, enrolled them in recurring subscription plans and made cancellation difficult. The FTC says consumers were not always clearly told when refill charges would occur and that some people faced additional hurdles when trying to stop recurring charges.
Those are related consumer-protection allegations, but they are separate from the privacy claims. The plaintiffs are seeking court-ordered relief, monetary remedies and other measures under federal and state laws.
What users can do now
Current Hims and Hers users can review the company’s Privacy Center and “Your Privacy Choices” controls. Where applicable, users can select options for targeted advertising and certain data sales or sharing. A compatible browser or extension can also send a Global Privacy Control signal.
These controls may apply only to particular categories of processing, devices or browsers. Hims’ policy says they do not necessarily erase information already collected or previously shared, and they do not stop all advertising.
Privacy choices are also separate from prescription or subscription cancellation. Users concerned about recurring charges should review account billing and subscription settings separately and confirm that any cancellation has taken effect.
What happens next
The federal case remains unresolved. The FTC’s complaint is a legal filing containing allegations, not a final enforcement order, settlement or judgment. Future court filings will determine how Hims & Hers responds and whether the court finds that the company violated federal or state consumer-protection laws.
Sources
Discover more from Interactive News
Subscribe to get the latest posts sent to your email.
