What Happened
The Federal Trade Commission (FTC) has filed a lawsuit against telehealth provider Hims & Hers, alleging the company shared sensitive health information with third-party advertising platforms like Snap and Meta. This action contradicts the company's explicit privacy promises to consumers seeking treatment for sexual health, mental health, and other sensitive conditions.
The FTC claims Hims & Hers violated Section 5 of the FTC Act, which prohibits unfair and deceptive practices. Utah and California have joined the federal action, indicating a coordinated enforcement effort across jurisdictions.
Hims & Hers requires patients to complete online intake forms reviewed by medical providers before treatment. According to the FTC, the company shared customer lists with advertising platforms and used third-party tracking technologies that disclosed website visitors' actions and health-related information.
Timeline
The FTC's investigation lasted nearly three years before the lawsuit was filed. While the complaint doesn't specify exact dates of the alleged sharing, it references the company's marketing materials that promised a "100% online, private, and secure process" and assured that "medical records and sensitive information are only accessed by the medical providers managing your care."
The extended investigation suggests a sustained pattern, not a one-time error. This indicates the FTC examined multiple data flows, technology implementations, and business practices before taking action.
Which Controls Failed or Were Missing
The alleged failures span several control domains:
Privacy Notice Accuracy and Consent Management
The complaint highlights a disconnect between the company's promises and its actions. If your privacy notice states that health information stays between patient and provider, but your website uses tracking codes that capture form submissions or page visits, you're not adhering to your stated data processing purposes.
This isn't a technical glitch; it's a governance failure. Someone approved both the privacy language and the marketing technology stack without aligning them.
Data Flow Mapping and Third-Party Risk Management
The FTC alleges Hims & Hers shared customer lists with advertising platforms and used tracking technologies that disclosed user actions. These actions require deliberate implementation. You don't accidentally upload a customer list to Meta's Custom Audiences tool or install conversion tracking pixels across a telehealth intake workflow.
This points to missing or ineffective data flow documentation. If your organization can't map every system that touches health data and every external party that receives it, you can't enforce boundary controls.
Data Minimisation and Purpose Limitation
Sharing health condition information with advertising platforms serves marketing optimization, not care delivery. The FTC's complaint suggests Hims & Hers prioritized growing the company over honoring privacy commitments.
From a controls perspective, this indicates missing purpose limitation enforcement. Your data governance program should include controls that prevent health information from flowing to systems outside the documented care delivery purpose.
Vendor Management and Technology Vetting
Third-party tracking pixels send data from the user's browser to the vendor's servers. If your telehealth intake forms include tracking code, you're creating a data flow to that vendor.
This suggests inadequate vendor risk assessment. When you integrate advertising technology into a healthcare workflow, you're creating a business associate relationship under HIPAA (if applicable) or triggering similar obligations under state health privacy laws. The FTC's complaint indicates this analysis either didn't happen or was ignored.
What the Relevant Standards Require
FTC Act Section 5
The FTC Act prohibits unfair or deceptive acts or practices. A practice is deceptive if it involves a material misrepresentation or omission likely to mislead consumers. The FTC's complaint alleges Hims & Hers represented that health information would remain private while sharing it with advertising platforms.
For your organization, this means your privacy notice isn't just a legal document. It's an enforceable promise. If you state that data won't be shared with third parties, your technical controls must prevent that sharing.
HIPAA Privacy Rule (if applicable)
While the FTC complaint doesn't cite HIPAA, telehealth providers handling protected health information must comply with the Privacy Rule's minimum necessary standard and prohibition on using or disclosing PHI without authorization except for treatment, payment, or healthcare operations.
Sharing patient lists or health conditions with advertising platforms doesn't fit these permitted uses. If you're a covered entity or business associate, this type of disclosure requires explicit patient authorization that clearly describes the purpose and recipient.
State Health Privacy Laws
California and Utah joined the FTC's action, and both states have enacted health privacy protections beyond HIPAA. Your compliance program must account for the strictest applicable standard, not just federal baseline requirements.
Lessons and Action Items for Your Team
Audit Your Marketing Technology Stack
Compile a list of every tracking pixel, tag manager, analytics tool, and advertising integration on your customer-facing properties. For each one, document:
- What data it collects
- Where that data goes
- Whether you have a data processing agreement in place
- Whether your privacy notice discloses this collection
If you find tracking technologies on intake forms, symptom checkers, or treatment selection pages, you're creating the same risk the FTC alleged against Hims & Hers.
Reconcile Privacy Promises with Technical Reality
Your privacy notice and your data flows must match. Assign someone outside the marketing team to verify this. Don't rely on vendor assurances that their pixel "doesn't collect PII." If the pixel fires on a page titled "erectile-dysfunction-treatment" or captures a form field labeled "symptoms," you're sharing health information regardless of whether it includes a name.
Implement Purpose-Based Access Controls
Health data should never reach marketing systems by default. Your data architecture should enforce purpose limitation through technical controls, not just policy. If your customer data platform or marketing automation tool can access health conditions or treatment types, you've failed to implement proper segmentation.
Document Your Data Sharing Decisions
Create a written record of every decision to share customer data with external parties. Include the business justification, legal basis, privacy impact assessment, and approval chain. When the FTC investigates, you'll need to show that sharing decisions went through deliberate governance, not just marketing optimization.
Train Your Marketing Team on Health Data Constraints
Marketing teams optimize for conversion and engagement. That's their job. But if you're handling health information, they need to understand the constraints. Run scenario-based training: "Can we retarget users who visited the hair loss page? Can we upload our subscriber list to Facebook for lookalike modeling?"
The answer depends on what you promised in your privacy notice and what your compliance obligations require. Make sure your marketing team knows how to get those answers before implementing new campaigns.
The Hims & Hers case demonstrates that privacy compliance isn't just about having a policy. It's about ensuring your technical implementation, vendor relationships, and business practices align with what you told your customers. If they don't, you're building FTC Act liability with every page view.
