The FTC Sued Hims, Not the Platforms Buying the Data

The FTC sued Hims & Hers Health on July 29, 2026, saying the telehealth firm sent customers’ health data to Meta and Snap. Utah and Los Angeles County joined the filing in San Francisco federal court, where the case remains pending.

The complaint names those ad platforms as places the data went. It does not name them as defendants.

The FTC Named Meta and Snap

Hims sells online visits and shipped drugs for sexual health, hair loss, mental health, and weight loss. The agency’s complaint, case 3:26-cv-7871, says the company told people they would connect with a medical provider to find a treatment that was “right for them,” then charged many of them as soon as an intake form landed. The Commission vote to file was 2-0.

Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection, put the two halves of the case in one line.

The FTC’s complaint lays out a troubling scenario-consumers unknowingly locked into recurring subscriptions and the disclosure to third parties of consumers’ most private health information without their consent.

Christopher Mufarrige, Director, FTC Bureau of Consumer Protection

The agency said Hims shared consumers’ health information with Meta and Snap after promising a private, secure visit. One customer complaint in the release said a card was charged that same day, before any talk with a clinician: “I never gave consent to apply charges before I spoke with a healthcare professional.”

Hims, which opened ForHims.com around November 2017 and added Hers a year later, called the claims baseless. In a July 29 statement the company said the suit ignored a nearly three-year investigation and was an effort to generate headlines at our expense. It said its privacy policy lets customers choose how data is used, and that information shared with its clinicians is used only to provide care.

That is the public fight. The quieter fact in the same papers is who got the file.

Customer Lists and Tracking Pixels Did the Work

The complaint describes two pipes, not a hack. Hims allegedly uploaded lists of certain customers, tagged by condition or treatment, so Meta and Snap could match those people to social accounts. It also placed tracking code that sent “Events,” the actions a visitor took on the site, straight into the ad systems.

For Meta, the tools named are the Meta Pixel and the Conversions API. The same filing says Hims placed pixels from Microsoft (Bing), Google, and Reddit, among others. Conditions in the ads and on the forms include erectile dysfunction, hair loss, and depression, the sort of facts a person would not type into a search bar if they thought the next stop was an ad account.

HOW THE DATA LEFT THE SITE

• Customer lists: Named groups of patients, sorted by health need, were uploaded so ad platforms could match them to existing profiles.
• Site events: Pixels fired on intake, product pages, and checkout, sending those actions to the same companies in real time.
• The privacy line: Marketing called the process “100% online, private, and secure” and said medical details would be seen by Hims clinicians.
• The cancel maze: Before 2023, most people had to call, email, or chat to quit; after an online button arrived, it sat behind “add/remove items from order.”

Meta’s own pixel docs warn advertisers not to send health data through that tool. The FTC still had to sue the clinic that installed it, because the clinic is the party that promised privacy to the patient. The platforms that ingested the events are the market on the other side of that promise.

Hims Closed June With 2.891 Million Subscribers

This is not a garage startup that outran its privacy policy. Hims’ quarterly filing for the period ended June 30, 2026, shows a scaled subscription machine that still spends heavily to find the next patient.

Q2 2026 AT HIMS

• Subscribers: 2.891 million at period end, up 19% from 2.439 million a year earlier.
• Revenue: $753.2 million in the quarter, up 38% from $544.8 million, with $92 in monthly revenue per average subscriber.
• Mix: U.S. sales were $621.8 million, up 16%; Hers was over 40% of U.S. revenue, led by weight loss and dermatology, while a majority of U.S. sales still came from non-GLP-1 products.
• Spend: Marketing was 34% of revenue. The company posted an $86.3 million net loss after $81 million in nonrecurring costs that included a legal contingency accrual, and it raised full-year 2026 revenue guidance to $3.1 billion to $3.3 billion.

A company that puts a third of sales into ads has a structural reason to keep pixels on a health funnel. The complaint says Hims chose that growth path over the privacy line it sold. Hims says customers already have the information they need, and that it has tightened systems as it grew. The court will have to pick between those two accounts. The ad platforms that received the lists do not have to.

Earlier Settlements Left the Ad Buyers Off the Docket

Hims is the largest name in this round, not the first. Since 2023 the FTC has used Section 5 of the FTC Act, and sometimes the Health Breach Notification Rule, against direct-to-consumer health firms that told users their data was private and then sent it to the same class of ad companies. The pattern is clinic as defendant, platform as destination.

FTC TELEHEALTH PRIVACY CASES

Those earlier orders told the clinics to stop using health data for ads and, in Cerebral’s case, to make cancellation simple. They did not put Meta, Snap, Google, or TikTok in the caption. Hims still allegedly ran lists and pixels into that same market years later. People who follow the stock already talk about the filing as a check the company writes and a tweak to intake screens, which is how this cycle has ended before.

Why HIPAA Still Misses These Apps

Patients treat a form about sex, mood, or weight as a medical record. The main federal health privacy statute often does not. HIPAA, passed in 1996, covers health plans, most clinics and hospitals that bill electronically, and the vendors those groups hire. A storefront that asks for symptoms, takes a card, and ships a drug can sit outside that map if it is not acting as a covered provider in a standard electronic transaction.

FTC business guidance is blunt about the split. The HIPAA Rules apply to covered entities and their business associates. The FTC Act still applies to a health app that is not under HIPAA, which is how the agency reaches a privacy promise that does not match the pixels. Andrew Crawford, an attorney at the Center for Democracy and Technology, has described “an entire universe of companies collecting huge amounts of consumer health data every day that aren’t covered by our current health sector-specific laws.” Justin Brookman, Consumer Reports’ director of technology policy, has said there is no clear federal statute that simply says not to do this, only a pile of FTC cases.

On April 26, 2024, the FTC finished updates to the Health Breach Notification Rule that were meant to pull more health apps into a duty to tell users when data is opened without authorization, including some kinds of sharing with ad tech. On September 9, 2026, six weeks after it sued Hims, the Commission rescinded a 2021 policy statement on health-app breaches, calling it obsolete because the 2024 rule already covers those products. The rule is still on the books. The extra statement is not. The Hims case is still a deception case under the FTC Act and the Restore Online Shoppers’ Confidence Act, not a HIPAA case, and not a case against the firms that bought the events.

California, Connecticut, Maryland, and other states have written health-data rules of their own. Enforcement against telehealth firms under those statutes has been thin, which is why the federal complaint still has to prove a broken promise rather than a banned transfer.

A Secret Shopper Got Weight-Loss Drugs in Minutes

The same intake-and-ship design that feeds a pixel is the design that made GLP-1 telehealth a volume business. Ashwin Chetty, then a Yale medical student, and Dr. Reshma Ramachandran led a secret shopper study of 49 websites selling GLP-1 receptor agonists, published in JAMA on July 6, 2026. A simulated patient who met standard eligibility rules tried to get a prescription from August through December 2025. Nearly 1 in 5 adults who take a GLP-1 drug already get that prescription online.

WHAT THE 49 SITES ASKED AND SKIPPED

• Yes, they prescribed: 45 sites (91.8%) issued a prescription; 34 (69.4%) mailed the drug.
• Thin screening: 98.0% asked about medical conditions and 93.9% about drugs or allergies, but only 55.1% asked about eating disorders, 53.1% about diet and activity, and 36.7% about values such as blood pressure or glucose.
• Almost no visit: About a quarter of sites required video; 6.1% required a phone call; about two-thirds required no clinician interaction; two sites issued a prescription in 5 minutes or less.
• Ship first: 75.6% of the prescribing sites charged and shipped without a confirmation step. The median price among filled orders was $230 a month.

Nine of the prescribing sites (20.0%) still wrote a script when the shopper sent only an upper-body photo after a full-body or scale photo had been required. Ramachandran told Pharmacy Times that clinicians should start asking whether patients are buying these drugs from nontraditional sources, because the compounded versions in the study are not FDA-approved. On March 3, 2026, the FDA sent 30 warning letters to telehealth companies for ads that treated compounded GLP-1 products as if they were the approved brands.

A form that shallow is easy to finish in a browser, which is the point of the business. It is also easy for a pixel to score. Eating-disorder history, sexual function, and a weight-loss cart are high-value targeting facts. The Yale paper measured the clinical gaps. The FTC complaint measured what happened to the file after the form was submitted. They are the same product, seen from two sides.

Judge Chhabria Set a January Hearing

Hims has not been found liable. The Commission’s own notice says it files when it has reason to believe the law is being broken, and that the court will decide the case. On the Northern District of California docket, Judge Vince Chhabria set a motion-to-dismiss deadline of October 22, 2026, with a hearing on January 7, 2027, at 10:00 a.m. in San Francisco. He wrote that he does not expect more extensions.

THE ENFORCEMENT CALENDAR

1. November 2017: Hims launches ForHims.com as an online men’s health clinic.
2. February 2023: The FTC’s GoodRx order bars sharing health data with advertisers and imposes a $1.5 million civil penalty.
3. March 2023: BetterHelp agrees to $7.8 million in redress for sending mental-health intake data to ad platforms.
4. April 2024: Cerebral’s $7 million order lands; the 2024 Health Breach Notification Rule update is finished the same month.
5. July 29, 2026: The FTC, Utah, and Los Angeles County sue Hims over billing, cancellation, and health data sent to Meta and Snap.
6. September 9, 2026: The FTC rescinds its 2021 health-app breach policy statement, saying the 2024 rule already covers those apps.
7. January 7, 2027: The first major argument in the Hims case is set before Judge Chhabria.

If prior cases are a guide, a settlement would bind Hims’ pixels, lists, and cancel button. It would not, on its own, stop Meta or Snap from accepting the next clinic’s health events. Until Congress puts those storefronts under a statute with the bite of HIPAA, the buyer of the pixel remains the party with no caption line.

The January hearing will test Hims’ billing screens and privacy claims. It will not put the ad platforms that received the lists at the defense table.

Disclaimer: This article is news reporting and analysis of a pending civil case, public filings, and published research. It is not legal advice, medical advice, or investment advice, and it is not a finding that Hims & Hers Health, Inc., or any other company named here has been found liable. Readers who have a dispute, a privacy concern, or a treatment question should speak with a licensed attorney, a clinician, or a qualified financial professional before acting. Figures, case status, and product claims come from the agency releases, court papers, company filings, and studies cited above and can change as the Hims case and other matters move.