FTC sues Hims & Hers over allegedly sharing health data

The Federal Trade Commission has sued Hims & Hers, the publicly traded telehealth company that sells prescription medication for sexual wellness, mental health conditions, weight loss, and other issues, accusing it of sharing patients’ medical and healthcare information with advertisers and tech giants — including Meta and Snap — without customers’ knowledge, and of misleading consumers about its privacy practices. The complaint, filed in a California federal court, targets a company that the FTC says handles a large amount of sensitive patient data.

Companies typically install tracking code on their websites to share user information with advertisers such as Meta and Snap, which use the data to see who is visiting a site and when. According to the FTC, Hims & Hers placed pixel-sized trackers supplied by Meta, Snap, and other tech and advertising giants, including Microsoft, Pinterest, Reddit, and X. The agency alleges these trackers “captured and shared users’ health information,” contrary to Hims & Hers’ own privacy policy. The FTC also alleges the company used Meta’s tools to track users’ clicks and other actions on its website.

Beyond the data-sharing claims, the FTC accused Hims & Hers of deceptive billing and of drawing up policies that allegedly made it difficult for customers to cancel, in violation of federal consumer protection laws. Hims & Hers did not explicitly deny the FTC’s claims in a statement on its website. The company said its privacy policy clearly lets users choose how their data is used and said it is confident in its position, adding that it plans to defend against the FTC’s allegations.

The lawsuit extends a pattern: the FTC has previously brought similar actions against telehealth startup Cerebral, alcohol-recovery provider Monument, data giant GoodRx, and therapy provider BetterHelp, all accused of sharing patients’ sensitive information with third-party tech and advertising companies through their websites. Pixel-tracking code has repeatedly exposed how such data reaches the platforms that provide it — in 2024, TechCrunch found the U.S. Postal Service was sharing logged-in users’ home addresses with Meta, LinkedIn, and Snap through the same kind of tracking code; USPS removed it soon after.

Why it matters

The case signals the FTC will keep treating pixel-tracking on healthcare sites as a core enforcement target regardless of a company’s privacy-policy language — a compliance risk any platform handling sensitive user data now has to price in.