Hims & Hers Faces FTC Claims Over Health Data Shared Through Advertising Pixels
The Federal Trade Commission has sued Hims & Hers in California federal court, alleging that pixel trackers from six named technology and advertising companies captured and shared patients’ health information. The complaint also challenges the telehealth provider’s billing and cancellation practices.
Why healthcare tracking creates exceptional risk
Hims & Hers prescribes medication for sexual wellness, mental health conditions, weight loss and other issues. Website activity can therefore reveal far more than ordinary browsing behavior, potentially connecting a person with a condition, treatment interest or prescription journey.
Advertising pixels are designed to report visits, clicks and other actions to external platforms. The FTC argues that Hims & Hers deployed this code despite privacy commitments to customers, exposing sensitive information without their knowledge. The dispute also parallels the disclosure of citizenship and race data by U.S. insurance exchanges, in which tracking technologies transmitted highly sensitive demographic details.
Platforms, billing and the company’s response
The complaint names trackers supplied by Meta, Snap, Microsoft, Pinterest, Reddit and X. It says the tools “captured and shared users’ health information,” while Meta technology also recorded clicks and other actions taken on the company’s website.
Hims & Hers said its privacy policy “makes clear” that users “may choose how their data is used,” adding that it is “confident” in its position.
The company did not directly deny the allegations and plans to defend itself. Separately, the FTC accused it of deceptive billing and cancellation policies that allegedly made subscriptions difficult to end. The agency has pursued similar cases involving Cerebral, Monument, GoodRx and BetterHelp.
The wider risk is not limited to healthcare. In 2024, pixel code used by the U.S. Postal Service sent logged-in users’ home addresses to Meta, LinkedIn and Snap before being removed. For businesses, the practical response is to audit every tracker, map each transmitted field, verify consent and make cancellation flows as clear as sign-up. A privacy policy cannot compensate for uncontrolled data collection.