FTC sues Hims & Hers over health data sent to Meta, Snap

The Federal Trade Commission sued Hims & Hers on Wednesday, and the striking thing about the complaint is that it does not describe a breach. It describes normal advertising plumbing working exactly as designed. According to the FTC, the telehealth company ran third-party tracking code on pages whose own URLs named the condition a visitor was reading about, so Meta, Snap, Microsoft, Pinterest, Reddit and X received signals tied to people looking at erectile dysfunction, hair loss, anxiety and weight-loss treatments, while the site's privacy policy assured those same people their health information stayed private.

Utah and California joined as co-plaintiffs, California through the Los Angeles County Counsel. The complaint was filed July 29 in the Northern District of California, and it pairs the privacy claims with a second, arguably more expensive set of allegations about subscription billing. HIMS closed down roughly 10 percent on the news, having fallen more than 15 percent intraday, its worst intraday move since May 12.

RelatedThe Teen Suing Meta Over Addiction Just Dropped the Case

• Two data paths, not one. The FTC says Hims both fired browser-side tracking events to ad platforms and uploaded lists of specific customers to those same platforms.
• The deception theory is the privacy policy. This is a Section 5 case: what the site promised versus what the tags actually sent.
• Billing is the other half. The complaint alleges consumers were charged for prescriptions almost immediately after submitting an intake form, before the clinician consultation they were told would decide their treatment.
• The FTC is litigating, not settling. Its previous health-pixel actions all landed as consent orders. This one went to federal court, and Hims says it will fight.

What does a tracking pixel actually send?

A pixel is not an image any more. It is a few lines of vendor JavaScript that you paste into a page template, and once it is there it reports back on its own schedule. The standard vocabulary is a short list of event names: PageView, ViewContent, InitiateCheckout, Purchase, Lead. Along with the event name the script forwards the full page URL, the referrer, and whatever identifier it can attach the visit to, usually a first-party cookie the platform set earlier plus a hashed email if the site passes one through advanced matching.

On a shoe retailer none of that is sensitive. ViewContent with a URL of /running-shoes/mens is a shoe. The FTC's whole point is that the same payload becomes a medical disclosure the moment the URL path, the page title or the product name is the diagnosis. Nobody has to send a field called "condition" for the condition to arrive. It arrives inside the URL, which every pixel forwards by default, in every install, unless someone deliberately strips it.

The second path in the complaint is more deliberate. The FTC alleges Hims shared lists of certain customers directly with advertising platforms, the mechanism marketers call a Custom Audience. You upload hashed emails, the platform matches them against its own accounts, and now a segment exists that is defined by having bought a specific treatment. That is not a default behavior. Someone builds that segment on purpose.

Why is this an FTC case rather than a HIPAA case?

Because HIPAA mostly does not reach here, which surprises people. HIPAA binds covered entities and their business associates. Meta and Snap are neither, and a direct-to-consumer telehealth funnel sits at an awkward angle to the rule in the first place. So the FTC uses what it does have: Section 5 of the FTC Act, which makes deceptive practices unlawful. The theory is simple and it does not require proving anyone was harmed. The privacy policy said one thing, the network tab said another.

This has been coming for three years. In July 2023 the FTC and HHS jointly sent letters to roughly 130 hospital systems and telehealth providers warning that third-party tracking on health pages was a legal problem. Then came the settlements. That warning has now become litigation against a company with 2.6 million subscribers.

1. Feb 2023GoodRx settles over prescription data sent to Meta and Google $1.5M civil penalty
2. Mar 2023BetterHelp settles over intake answers shared with Facebook, Snapchat, Criteo, Pinterest $7.8M
3. Jul 2023FTC and HHS warn about 130 hospital systems and telehealth providers about pixels joint letter
4. Apr 2024Cerebral and Monument settle; Monument banned from disclosing health data to advertisers $7M+ and $2.5M suspended
5. Jul 2024Hims & Hers confirms it is voluntarily cooperating with an FTC inquiry disclosed publicly
6. Aug 2025Reports surface that the FTC is probing Hims ads and cancellation flows investigation widens
7. Jul 29 2026FTC, Utah and California file in the Northern District of California Commission vote 2-0
8. NextHims answers the complaint; discovery over what the tags actually transmitted company says it will defend

How does this compare to the earlier health-pixel cases?

The pattern is nearly identical each time, which is the part worth sitting with. Four companies, four different products, one shared root cause: an advertising SDK installed as shipped on a page where the content itself was the sensitive fact.

What does the billing half of the complaint allege?

Roughly half the complaint has nothing to do with pixels. The FTC alleges Hims failed to clearly disclose that it charges for a prescription almost immediately after a customer submits an intake form, despite telling that customer they would consult a medical provider to find a treatment that is right for them. It further alleges the subscriptions were made hard to cancel. Those claims run under the Restore Online Shoppers' Confidence Act, and ROSCA is where the money is: it carries civil penalties per violation in a way that a pure Section 5 deception count does not.

Hims rejects all of it. In a statement filed with investors on July 29, the company said the agency disregarded substantial evidence provided during a nearly three-year investigation, called the suit "an effort to generate headlines at our expense," and said it will vigorously defend against what it described as baseless claims. It also said its privacy policy makes clear that customers may choose how their data is used.

RelatedWarner Bros. Sues Amazon Over an HBO Max Exec's Term Contract

What it means for HIMS stock

Hims reported $608 million in first-quarter 2026 revenue, up 4 percent year over year, on 2.6 million subscribers, up 9 percent. Against that, the largest precedent penalty in this line of cases is $7.8 million. The fine is not the risk. The risk is injunctive relief, because this business runs on paid acquisition and a low-friction subscription funnel, and the remedies the FTC has sought in comparable cases go directly at both: restrictions on sharing health data with advertising platforms, and mandated cancellation flows.

The signal for investors is that a settlement constraining conversion tracking would raise customer acquisition cost and a cancellation remedy would raise churn, at the same time, in a business already growing revenue at only 4 percent. Watch the docket in the Northern District of California, watch whether Hims actually litigates to judgment rather than settling as GoodRx, BetterHelp, Cerebral and Monument all did, and watch the next quarterly filing for any change in marketing spend efficiency. None of this is investment advice.

What should other companies check this week?

If you run anything where the page itself reveals something sensitive, and that covers far more sites than health, the practical fixes are unglamorous and mostly boring:

• Read the network tab, not the vendor doc. Load a condition page and look at what actually leaves the browser. The default payload is almost always broader than the team assumes.
• Stop putting the diagnosis in the URL. If the path segment is the sensitive fact, every tag on the page inherits it. Neutral slugs and stripped referrers cost nothing.
• Move conversions server-side with an explicit allowlist. A server event you construct field by field sends what you chose. A browser pixel sends what the vendor chose.
• Audit list uploads separately. Custom Audience uploads are a marketing-team decision that never appears in a code review.
• Verify consent actually gates tag firing. Plenty of banners record a preference and load the tag anyway.

Our take

The uncomfortable reading of this complaint is that Hims probably did not do anything unusual. It installed the same marketing stack every consumer subscription company installs, on pages where that stack's default behavior happens to be a disclosure of medical interest. Four enforcement actions in three years, all with the same shape, is not four bad actors. It is an industry-standard toolchain whose defaults are incompatible with an entire category of websites, and a privacy-policy paragraph nobody reconciled against the tag manager.

What is genuinely new here is the FTC's choice to litigate. Consent orders let a company pay, promise, and move on without a factual record. A contested case in the Northern District of California means discovery into what those pixels actually sent, entered into the docket. For everyone else running tags on sensitive pages, that record will be far more instructive than another settlement press release.

Original analysis by GenZTech. Reporting on the filing via TechCrunch.