FTC v. Hims & Hers: "private and secure" care, with customer lists sent to ad platforms

Hims advertised a "100% online, private, and secure process" for conditions such as erectile dysfunction and mental health. Regulators allege it shared customer lists and pixel events with Meta and Snap to build ad audiences.

FTC, Utah and California · FTC Act, ROSCA and state consumer law · Complaint filed 29 July 2026

Complaint filed; motion to dismiss due 22 October 2026; no ruling

Regulator or court: FTC, Utah Division of Consumer Protection and People of California (US District Court, N.D. California)
Jurisdiction: United States (federal)
Framework: FTC Act Section 5; ROSCA; Utah Consumer Sales Practices Act; California UCL and FAL
Complaint filed: 29 July 2026

Sensitive context in event data · Undisclosed data exchanges

The problem

The complaint alleges that "[d]espite promising privacy and discretion, Hims shared consumers' sensitive health information with third-party advertising companies and platforms" such as Meta and Snap, without clearly disclosing it (Complaint ¶ 66). It also alleges billing and cancellation violations under ROSCA (FTC press release).

Case record

Court: US District Court, N.D. California (Judge Vince Chhabria)
Case number: 3:26-cv-07871-VC
Parties: Federal Trade Commission, People of the State of California (Los Angeles County Counsel) and Utah Division of Consumer Protection v. Hims & Hers Health, Inc.
Laws: FTC Act Section 5; ROSCA; Utah Consumer Sales Practices Act; California UCL and FAL
Stage: Complaint filed 29 July 2026; motion to dismiss due 22 October 2026; hearing 7 January 2027
Commission vote: 2-0 to file
Amount: None; relief sought includes civil penalties
Source review: 20 October 2026

What the regulators alleged

The court has not ruled. The counts allege:

FTC v. Hims & Hers counts
Count	Law	Allegation
I	FTC Act Section 5	Deceptive privacy claims: that health information is only accessed by treating providers, and that the service is private and discreet
II	FTC Act Section 5	Failure to disclose sharing of health information with advertising platforms
III	FTC Act Section 5	Deceptive intake practices
IV to VI	ROSCA	Material terms not disclosed, no express informed consent to charges, no simple cancellation
VII, VIII	California FAL and UCL	Brought by the People of California
IX	Utah Consumer Sales Practices Act	Brought by the Utah Division of Consumer Protection

Promises cited include a homepage answer, until at least late August 2023, that "medical records and sensitive information are only accessed by the medical providers managing your care"; ads offering a "100% online, private, and secure process"; influencer posts calling the service "discreet"; and broadcast ads calling it "totally private" (Complaint ¶¶ 62-65).

Technical issue

Customer lists: Hims allegedly uploaded lists of customers to Meta and Snap to match them to their accounts (Complaint, heading B and ¶ 76). The Meta list details are redacted in the public complaint.
Pixel and server events: the Meta Pixel and Conversions API "automatically tracked and disclosed certain Events to Meta" (¶ 70).
Other platforms: pixels from Microsoft (Bing), Google Ads, Criteo, MediaBids, PartnerCentric, PebblePost, Pinterest, Podsights, Reddit, StackAdapt, TikTok, The Trade Desk and X (¶ 77).
Use: audiences built with a specificity the complaint says was possible only because Hims disregarded its privacy promises (¶ 74).

Inth’s technical interpretation: on a site that treats specific conditions, the page or product a visitor reaches already reveals health information. A standard purchase or sign-up event sent from a condition-specific flow tells the platform the condition. The browser pixel and the server-side Conversions API need the same review, because the server path does not appear in browser tools.

// Condition-specific funnel sends standard events with the product name
fbq('track', 'Purchase', { content_name: 'ED treatment', value: 30 });
// ...and the server repeats it through a conversions endpoint
postServerEvent({ event_name: 'Purchase', content_name: 'ED treatment', email_hash });

// Send no condition or product details to ad platforms
if (consent.has('marketing')) {
  fbq('track', 'Purchase', { value: 30, currency: 'USD' });
}

Illustrative pattern, not the defendant’s code. Generic consent API, not a specific c15t call.

Timeline

2017Hims launches telehealth service
Until at least late August 2023Homepage privacy answer cited in the complaint
29 July 2026Complaint filed (Dkt. 1); FTC announces action
17 August 2026Court denies motions to seal parts of the complaint and orders Hims to show cause (Dkt. 26)
18 August 2026Unredacted complaint filed (Dkt. 28)
24 August 2026Order to show cause lifted with a warning about overbroad sealing requests (Dkt. 32)
10 September 2026Schedule set: motion to dismiss due 22 October 2026, hearing 7 January 2027 (Dkt. 43)
30 October 2026Initial case management conference

Outcome

None yet. The plaintiffs seek a permanent injunction, monetary relief and civil penalties. Hims’s motion to dismiss is due 22 October 2026.

What it cost

FTC v. Hims & Hers costs
Item	Amount	Source
Penalties or redress	None; sought in the complaint	[FTC press release](https://www.ftc.gov/news-events/news/press-releases/2026/07/ftc-states-act-against-hims-hers-deceptive-unlawful-privacy-practices)
Defence costs	Not stated in the cited record

Why it matters

Ads and influencers are promises. The complaint relies on TV, podcast and influencer claims, not only the privacy policy.
Customer-list uploads count. The complaint treats uploading customer lists for account matching as a disclosure, alongside pixel sharing.
Federal and state together. Utah and California join the FTC, adding state-law claims to the federal ones. Compare BetterHelp and GoodRx.

How Inth catches this

Consent banner: holds pixels until their category is granted where the policy is opt-in. Consent does not make condition-specific events appropriate for an ad platform.
Website audit: records which vendors receive requests from condition-specific landing, intake and checkout pages, and the event names and parameters sent.
Evidence: consent records with choice, country and policy, and per-page runtime observations.

Limit: customer-list uploads and Conversions API calls happen server-side and are not visible from the browser. Review them with the teams that run them.

Checks for your own systems

In the repository

Search for Conversions API, offline conversions and audience-upload jobs, and list the fields they send.
Check event parameters such as content_name and content_category for product or condition names.

In the browser and network

Complete an intake and checkout with a test account and inspect every third-party request.
Compare vendors contacted on condition pages with the vendors your privacy notice names.

With the people responsible

Review ad copy and influencer briefs for privacy claims, and compare them with actual data flows.
Ask marketing which audiences are built from customer lists.

Sources and limits

FTC press release, 29 July 2026
Complaint, redacted version filed by Utah, 29 July 2026
Docket, reviewed 20 October 2026

The public complaint redacts the events and list details. The unredacted complaint (Dkt. 28) and the FTC-hosted complaint PDF were not reviewed. Billing and cancellation allegations are outside this library’s focus and are summarised only.

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit Hims & Hers' current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.