FTC sues Hims & Hers over health data sent to advertising platforms

The Federal Trade Commission, the Utah Division of Consumer Protection and Los Angeles County on behalf of California sued Hims & Hers Health on July 29, 2026, alleging the telehealth company shared customers' sensitive health information with advertising platforms while marketing its service as private, and separately billed people before they spoke with a provider ^[1][2]. Hims & Hers says the allegations are baseless and that it will defend itself ^[1][2].

Tracking code from at least fifteen advertising platforms was running on the Hims website, including Meta, Snap, TikTok, Google, Microsoft, X, Pinterest, Reddit, Criteo and The Trade Desk, according to a review of the complaint ^[1]. The FTC describes two ways information moved. Third-party pixels on the site fired as a visitor moved through a page and reported "Events" back to the platform, such as a page viewed, a form answered, an item added to cart or a purchase completed. Separately, Hims uploaded lists of certain customers to ad platforms, which match those lists against their own users ^[1]. The complaint specifically identifies the Meta Pixel and Meta's Conversions API, which sends data directly from a company's servers rather than from the visitor's browser, so browser privacy settings do not block it ^[2].

The complaint sets that conduct against marketing language promising a "100% online, private, and secure process" and saying health information is "only accessed by the medical providers managing your care," a claim the FTC says ran until at least late August 2023 ^[1].

The filing runs 48 pages and nine counts ^[1]. Three of the counts are Restore Online Shoppers' Confidence Act claims that have nothing to do with data: the FTC alleges Hims charged people before any provider consultation and buried the cancel button inside an "add/remove items from order" menu ^[1]. Cancellation required contacting customer service by phone, email or chat until an online option arrived in April 2023 ^[2]. "Hims promised a free consult and private health care. What Utahns actually got was a subscription trap and their most personal health data shipped to advertisers," Utah Attorney General Derek Brown said ^[2].

An earlier audit by STAT News and The Markup tested 50 direct-to-consumer telehealth sites in late 2022 and found 25 of them reported cart adds or checkouts to at least one large technology company, with Hims & Hers among them. Trackers on 13 of the 50 captured answers to medical intake questions, 35 sites sent names, emails or phone numbers to tech companies, and at least twelve advertised themselves as HIPAA-compliant ^[1].

The complaint does not charge a violation of the FTC's Health Breach Notification Rule, unlike the agency's earlier health-data cases against GoodRx, which paid a $1.5 million civil penalty in February 2023, and BetterHelp, ordered to pay $7.8 million that July, with refund notices going to about 800,000 people in May 2024 ^[1][2]. The Hims case instead runs on Section 5 of the FTC Act, ROSCA, and California and Utah statutes ^[1][2].

Hims & Hers has put a number on its exposure. Its quarterly filing on August 10 states that as of June 30, 2026, it had recorded a legal contingency accrual of about $60 million for the matter; three months earlier the figure it had disclosed was $15 million, per CNBC, and its table of accrued liabilities lists legal contingencies at $62.5 million, against $0 at the end of 2025 ^[1]. The same filing says settlement negotiations with the FTC were unsuccessful and discloses a follow-on class action, Doe v. Hims & Hers Health, Inc., brought under the federal wiretap statute and two California privacy laws ^[1]. Hims & Hers called the case "an effort to generate headlines at our expense" and said it will "vigorously defend" ^[1]. The plaintiffs are asking the court to permanently bar the conduct and to impose civil penalties of up to $2,500 per violation under two California statutes ^[1].

Why it matters for patients

Most direct-to-consumer telehealth companies are not covered by HIPAA in the part of the business where the checkout page lives. The affiliated medical groups and pharmacies are typically covered entities, while the consumer-facing platform may sit outside HIPAA depending on how it is structured, which is why the FTC rather than the health privacy regulator brought this case ^[2]. On those sites, "private" is marketing language rather than a federal privacy obligation ^[1].

The tracking tools described in the complaint are configured by the company rather than installed by an outside attacker ^[2]. Hashing customer email addresses before uploading a list does not protect identity, because advertising platforms hash their own user lists the same way in order to match them ^[2]. Removing a tracker going forward also does nothing about disclosures that already happened ^[2].

How many people had health information transmitted has not been disclosed, and the date range for the conduct is redacted in the public complaint, so it is not known when it started or whether it stopped ^[1].

What happens next

The case is pending in the US District Court for the Northern District of California, filed July 29, 2026 ^[1][2]. No trial date has been reported. Hims & Hers warns in its filing that the $60 million accrual "may decrease or increase materially in future periods," and the class action filed after the FTC suit is also unresolved ^[1]. The complaint was authorized by the Commission on a 2-0 vote, with two of five commissioner seats filled at the time ^[1].

Three weeks after the filing, the stock closed at $31.10 on August 19, above where it traded before the lawsuit, after falling about 15% to $25.00 on the day the case was announced ^[1].