FTC Sues Hims & Hers Over Alleged Sharing of Patient Data With Advertisers

The Federal Trade Commission has sued Hims & Hers, alleging that the telehealth company shared sensitive patient information with advertising platforms including Meta and Snap. The case focuses on tracking technologies used across digital health services and whether customers understood that their interactions could be used for marketing.

Telehealth platforms collect information about medical conditions, treatments, prescriptions and personal identity. When advertising pixels or software kits receive events from those pages, the data can reveal more than an ordinary retail purchase. Even if a platform does not transmit a complete medical record, a URL, form response or treatment category may expose a health concern.

The FTC's action reflects wider enforcement against health companies that use consumer data outside the context in which it was provided. The agency has previously argued that privacy policies cannot rely on vague language when the information is sensitive and the sharing supports targeted advertising.

Hims & Hers will have an opportunity to contest the allegations, and the complaint does not by itself establish liability. The company should disclose which tools were installed, what fields they received, how long information was retained and whether data could be linked to identifiable advertising profiles.

Advertising platforms also have responsibilities when they receive sensitive events. Meta and Snap can identify common health-related URL patterns and should reject data that customers are not permitted to send. Contract language placing all responsibility on the advertiser does not eliminate the platform's ability to detect and profit from information that appears obviously inappropriate.

Health companies often install ordinary analytics code without treating every event as medical information. That distinction becomes dangerous when a URL, form field or purchase describes a condition or treatment. Hims & Hers should document exactly what it transmitted, which vendors received it and whether deletion is possible. Platforms should not wait for a lawsuit to identify sensitive patterns. The case could set a broader expectation that both the advertiser and the recipient inspect data flows before activation. Consent language must also be specific enough that a patient understands what leaves the health service.

Digital health companies often present convenience and discretion as central product benefits. Those promises are undermined when marketing systems receive patient-related signals by default. The case may push the industry toward stricter separation between care data and advertising infrastructure, with consent that is specific enough for a patient to understand before information leaves the service.