The Federal Trade Commission has charged Hims & Hers with illegally sharing sensitive health data with Meta, Snap, and other advertising platforms. The telehealth company violated its own privacy promises by transmitting information about customer purchases of sexual wellness products and other medications to these tech giants, the FTC alleges.
Hims marketed itself as protecting user privacy while operating its online pharmacy and prescription services. In reality, the company deployed Meta's Pixel tracking code and Snap's tracking technology on its website. These tools collected detailed customer data including purchase history, prescription information, and health details tied to individual users. That data flowed directly to Meta and Snap for ad targeting and measurement purposes.
The FTC's complaint centers on Hims' deceptive practices. The company promised confidentiality around sexual health and other sensitive medical information. Users believed their prescription data remained private. Instead, Hims enabled Meta and Snap to build detailed customer profiles based on health purchases, which these platforms then used for targeted advertising campaigns.
This case reflects broader FTC enforcement against companies that claim privacy protections while monetizing user data. The agency has grown increasingly aggressive toward tech platforms and their partners that mishandle health information, a category protected under HIPAA and other privacy laws.
Hims' conduct violated the FTC Act's prohibition on unfair and deceptive practices. The company failed to implement reasonable safeguards and misrepresented its privacy commitments to consumers. The implications extend beyond Hims. Many telehealth and e-commerce companies use similar tracking technologies without fully disclosing data flows to advertising networks.
The FTC's action signals that companies cannot hide behind vague privacy policies while systematically sharing customer health data with advertisers. The regulator is drawing clear lines around what constitutes deceptive health data handling, particularly when companies explicitly promise confidentiality.