The FTC Says Hims & Hers Sent Sensitive Health Data to Ad Platforms

A person fills out an online health intake form because they want to talk to a medical professional. Behind that form, tracking tools may be watching the same clicks, conditions, and treatment interests that the person assumes are part of a private medical interaction. On July 29, 2026, the Federal Trade Commission, joined by Utah and California partners, sued telehealth provider Hims & Hers. The complaint alleges that the company shared consumers’ sensitive health information with Meta, Snap, and other third parties while also using billing and cancellation flows that consumers could misunderstand. The allegations still have to be tested in court. But the case is a sharp reminder that a privacy promise can be undermined by the ordinary analytics stack around a healthcare website. What the complaint alleges The FTC says Hims collected health information through its online intake process and shared information with advertising platforms through customer lists and third-party tracking technologies. The release describes “Events” generated by visitors’ actions on the site and says the complaint alleges that health information was shared despite promises to protect patient privacy. The case also challenges the company’s subscription and billing practices. According to the complaint, consumers were asked for billing information during intake and, in many cases, were charged and enrolled in recurring prescription plans shortly after submitting the form, without first having the consultation they expected. The FTC further alleges that cancellation was made difficult, including through a hidden or multi-step online path. The complaint invokes the Restore Online Shoppers’ Confidence Act, a federal law governing certain internet billing and subscription practices. Why tracking pixels are not “just analytics” A tracking pixel is technically small, but the information around the request can be revealing. A page URL, event name, campaign identifier, browser data, and account or form context can let an advertising platform infer what a person is researching. On a general retail site, that may expose an interest in a product. On a telehealth site, the same pattern can point toward a medical condition, prescription category, or treatment decision. The user does not need to type a diagnosis into an ad field for the surrounding event stream to become sensitive. The privacy question is therefore not only whether a company sends a field labeled “health data.” It is whether an outside platform can use the combination of events and identifiers to learn something sensitive about a person. What the case does not prove yet The FTC’s release describes allegations in a complaint. It does not establish that every allegation is true, that every user was affected in the same way, or that a final court order has been entered. That distinction is important. Privacy reporting should not turn a complaint into a verdict. It is also important not to use uncertainty as an excuse to ignore the design pattern the complaint describes: sensitive services can quietly inherit advertising infrastructure built for ordinary consumer websites. What patients can do When using an online health service, people can reduce unnecessary exposure by: Looking for the service’s privacy and tracking disclosures before submitting an intake form. Using a browser’s built-in tracker protection or a reputable content blocker where appropriate. Avoiding health searches while signed into advertising-heavy accounts when a private alternative is practical. Saving screenshots of pricing, cancellation, and consent screens before completing a subscription. Contacting the provider through a known official channel if an unexpected ad or message appears to reveal a health-related interest. The larger lesson is architectural. A health service does not become private merely because its medical records are protected. The forms, pixels, event streams, and ad integrations around those records deserve the same scrutiny.