FTC and three states sue Hims & Hers for sharing patients' health data with Meta and Snap despite privacy promises

Hims & Hers Promised Privacy. The FTC Says It Fed Patient Data to Meta and Snap.

On July 29, the Federal Trade Commission, joined by Utah and California through Los Angeles County Counsel, sued Hims & Hers, alleging the telehealth provider shared consumers' sensitive health information with Meta, Snap, and other advertising platforms despite promising to protect patient privacy 1. The complaint, filed in federal court, also charges the company with deceptive billing practices and making subscription cancellations difficult 1.

The lawsuit escalates the FTC's health-data enforcement from targeted actions against smaller digital health platforms to a coordinated federal-state case against one of the largest telehealth companies in the market.

San Francisco-based Hims provides telehealth services and direct-to-consumer prescription medications for conditions including erectile dysfunction, hair loss, mental health, and weight loss 1. According to the complaint, Hims told interested consumers they could connect with a medical provider. Instead, most customers were charged for prescriptions almost immediately after submitting an intake form, without receiving a consultation with a provider. Consumers were asked for billing information during intake despite assurances they would not be charged until medications were prescribed 1.

Hims called the claims "baseless" in a post on the social media platform X, describing the lawsuit as "an effort to generate headlines at our expense" 2. The company's stock dropped approximately 12% after the news 2.

The FTC has been pursuing health-data-to-ad-tech pipelines for years. In July 2023, the FTC and the U.S. Department of Health and Human Services jointly warned approximately 130 hospital systems and telehealth providers about the privacy risks of online tracking technologies, naming the Meta Pixel and Google Analytics specifically as tools that can track users' activities and gather identifiable information, usually without their knowledge 3. Since then, the agency has brought enforcement actions against GoodRx, BetterHelp, Premom, and Cerebral for sharing health data with advertising platforms through tracking pixels and software development kits 4. GoodRx paid a $1.5 million civil penalty; BetterHelp provided $7.8 million in consumer refunds 4.

The Hims complaint differs from those prior cases in three ways. Hims operates at significant scale as one of the largest telehealth platforms in the weight-loss drug market, according to Reuters 2. Utah and Los Angeles County joined as co-plaintiffs, turning a federal agency action into a coordinated federal-state case. And the complaint bundles the data-sharing allegation with deceptive billing and cancellation practices, framing the company's conduct as a pattern across the entire customer relationship 1.

The underlying mechanism regulators are targeting is straightforward. A patient fills out an intake form on a health platform. Tracking technologies embedded in the site capture those interactions and relay data to ad networks. Those signals, combined with other identifiers, let advertisers build targeted audiences based on medical conditions 4. The FTC's position, established through the GoodRx and Cerebral actions, is that sharing health information this way without informed consent is an unfair and deceptive practice under the FTC Act, regardless of whether the company is formally covered by HIPAA 4.

Christopher Mufarrige, Director of the FTC's Bureau of Consumer Protection, said the agency "will not hesitate to act on behalf of consumers deprived of their ability to choose which products they want and whether to keep their most sensitive health information private" 1.

For builders, investors, and users: the tracking technology that powered customer acquisition for digital health companies is now the centerpiece of a federal lawsuit. The pipeline from health-data intake to ad-network targeting, once a routine growth-marketing tactic across telehealth and wellness, is a documented legal liability. The FTC has a consistent enforcement record, state partners, and a high-profile company in its sights. Every platform touching sensitive health data should treat ad-platform data sharing as existential legal risk, not a quiet competitive advantage.