FTC and State Action Against Hims & Hers for Health Data Sharing

Historical analysis: this article examines information published by the source on July 29, 2026. Check the latest vendor guidance before acting.

What the agency reported

On July 29, 2026, the Federal Trade Commission (FTC), joined by the states of Utah and California, filed a complaint in the U.S. District Court for the Northern District of California against telehealth provider Hims & Hers. The action focuses on allegations of deceptive privacy practices regarding sensitive health information and unfair billing and subscription cancellation processes.

Allegations, findings, and outcome

The complaint alleges that Hims & Hers shared consumers’ sensitive health information with third-party advertising platforms, specifically naming Meta and Snap. According to the FTC, this data sharing occurred through two primary methods: the sharing of customer lists and the use of third-party tracking technologies that automatically transmitted “Events” (visitor actions on the website) to these platforms.

Additionally, the agencies allege that Hims & Hers engaged in deceptive billing by charging consumers for prescriptions almost immediately after they submitted intake forms, despite claims that consultations with medical providers would occur first. The complaint also alleges that the company intentionally made subscription cancellation difficult by hiding cancellation buttons or requiring contact via phone, email, or chat.

The legal basis for these claims includes the FTC Act and the Restore Online Shoppers’ Confidence Act, as well as consumer protection laws in Utah and California. As this is a filed complaint, the case remains to be decided by the court; no final judgment of liability has been reached.

Potential breach-prevention strategy

The reported entry path for the data exposure was the intentional or negligent configuration of third-party tracking pixels/SDKs and the manual sharing of customer lists. It remains unknown whether these tools were implemented by internal staff without security review or if they were default settings in a third-party platform.

Our conditional analysis suggests that similar exposures could have been reduced through the following prioritized actions:

1. Implementation of a Content Security Policy (CSP) and Tag Management Governance: To address the hypothetical scenario where tracking pixels automatically send data to unauthorized domains, organizations could implement a strict CSP.

   • Responsible Role: Web Administrator / Security Engineer.
   • Verification: Use browser developer tools or security scanners to verify that only authorized domains are permitted to receive data from the site.
   • Goal: Prevent initial unauthorized data transmission (Prevention).

2. Technical Audit of Third-Party SDKs and Pixels: To address the risk of “Events” being shared without consent, a technical audit could identify exactly what data fields are captured by tracking scripts on intake forms.

   • Responsible Role: Privacy Officer / Security Analyst.
   • Verification: Use a network proxy or browser intercept tool to inspect outgoing HTTP requests during the intake process to ensure no ePHI is included in payloads sent to advertising domains.
   • Goal: Prevent initial unauthorized data transmission (Prevention).

3. Data Export Approval Workflow: To address the sharing of customer lists, organizations could implement a formal approval process for any bulk export of user data intended for third parties.

   • Responsible Role: Data Custodian / Compliance Officer.
   • Verification: Review audit logs to ensure all bulk exports are tied to an approved business justification and legal review.
   • Goal: Limit damage by preventing unauthorized bulk transfers (Damage Limitation).

These controls would have been feasible prior to the alleged incident. However, residual risk remains if third-party scripts dynamically change their behavior or if internal overrides occur without detection.

Security and governance lessons

This case highlights a critical tension between marketing goals and healthcare privacy requirements. For HIPAA-covered entities and business associates, the use of “convenience” tools like Meta or Snap pixels on pages where patients provide health information can lead to the inadvertent transmission of ePHI. Governance must extend beyond internal servers to include the behavior of third-party scripts executing in the patient’s browser.

Practical response for organizations

Healthcare organizations should conduct a comprehensive inventory of all tracking technologies (pixels, SDKs, and cookies) currently active on their patient portals and intake pages. Organizations should verify whether these tools are configured to strip sensitive identifiers or health-related “Events” before they reach advertising platforms. This review should be coordinated with legal and compliance teams to ensure that data sharing aligns with the organization’s privacy notices and regulatory obligations.

Legal and factual limits

This analysis is based on allegations contained in a federal complaint; it does not constitute a finding of guilt or liability. The claims are brought under consumer protection laws (FTC Act, state laws) rather than HIPAA regulations specifically. This document does not provide legal advice or certify HIPAA compliance.

Source and editorial note

FTC and States Act Against Hims & Hers for Deceptive and Unlawful Privacy Practices · Source date: July 29, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: August 01, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 01, 2026 at 00:40 UTC.

Request a healthcare security assessment