Lawyers flag the Hims suit as the FTC's first tracking-pixel health case
A federal lawsuit against telehealth company Hims & Hers is the first case where the FTC has gone after tracking pixels and health-data sharing without relying on the usual breach-notification rule, lawyers say, which could make it easier to sue other digital health companies.
On July 29, 2026, the Federal Trade Commission, joined by California and Utah, filed a complaint against Hims & Hers Health, Inc. in federal court in San Francisco [1][2]. The government alleges the telehealth company told users their health information would stay "private" and be seen "only by medical providers," while actually sharing data about medical conditions with advertising platforms including Meta (Facebook) and Snap (Snapchat) [2].
According to the complaint, Hims & Hers used tracking pixels and other tools to send information tied to mental health, sexual health and prescriptions to these ad platforms, despite its privacy promises [2]. The complaint also alleges the company enrolled consumers in recurring prescription subscriptions and charged them before they had a chance to consult a medical provider, failed to clearly disclose subscription terms, and made cancellation difficult [1]. The FTC is seeking injunctive relief, monetary relief and civil penalties, and California and Utah are pursuing claims under their own consumer protection statutes [1].
Privacy lawyers say the case stands out because it is the current FTC's first enforcement action targeting tracking pixels and unauthorized sharing of health data with third-party ad platforms [1]. The agency is relying on Section 5 of the FTC Act and the Restore Online Shoppers' Confidence Act, along with California and Utah consumer-protection law, rather than the Health Breach Notification Rule that was used in earlier cases against companies like GoodRx and BetterHelp. That legal path does not require the government to prove a data breach occurred, which lawyers say lowers the bar for pursuing other digital health companies over similar tracking practices [2].
The Hims & Hers case is not the only recent action in this area. On August 5, 2026, a patient filed a proposed class action against University of Colorado Health (UCHealth) in Colorado federal court, alleging the health system's website used Meta's tracking pixel to send patients' symptom searches, doctor specialties and appointment information to Facebook without consent [2]. UCHealth serves nearly 3 million patients a year, according to the complaint [2]. Separately, a February 10, 2026 class action against Amazon in Washington federal court alleges the company harvested location data through advertising software embedded in mobile apps, in violation of Washington's My Health My Data Act [2].
Why it matters for patients
For people using Hims & Hers or similar telehealth platforms for GLP-1 prescriptions or other care, this case is about what happens to information entered on a health website, not about the safety or effectiveness of any medication. If regulators and courts accept the FTC's theory, companies could face liability for sharing health-related browsing or condition data with advertisers even when no data breach ever occurred, simply based on deceptive privacy claims or unfair practices [1][2]. Lawyers reviewing the case say this could expose more digital health companies, including other telehealth providers, hospital systems and retailers, to lawsuits over tracking pixels and vendor data-sharing arrangements [2]. States are also moving on their own: Washington's My Health My Data Act has already produced a private lawsuit against Amazon, and Nevada, Connecticut and New York are developing or have adopted related health-data privacy rules [2].
What happens next
The Hims & Hers case remains in litigation in the Northern District of California following the July 29, 2026 filing, with the FTC and the two states seeking penalties and injunctive relief [1]. The UCHealth class action, filed August 5, 2026, is proceeding separately in Colorado federal court [2]. No rulings or settlements in either case are noted in current reporting, so how courts will treat the FTC's non-breach theory is not yet known.
Sources
- https://www.hunton.com/privacy-and-cybersecurity-law-blog/ftc-california-and-utah-sue-telehealth-company-hims-hers-for-deceptive-and-unlawful-privacy-practices
- https://www.beneschlaw.com/insight/emerging-enforcement-trends-in-digital-health-data-privacy-lessons-from-washingtons-my-health-my-data-ftc-vs-hims-hers-and-uchealth-enforcement-actions/
Semaglutides.org is for information only and is not medical advice. Always talk to a licensed healthcare provider about your own care. Some links to telehealth services are affiliate links, labeled where they appear.