[Enforcement library](/enforcement)

# FTC v. Hims & Hers: "private and secure" care, with customer lists sent to ad platforms

The FTC, Utah and Los Angeles County Counsel for California allege Hims & Hers promised private care but shared health information with Meta, Snap and other ad platforms through customer lists, pixels and Conversions API. These are allegations; the court has not ruled.

## Key facts

- **Regulator or court:** FTC, Utah Division of Consumer Protection and People of California (US District Court, N.D. California)
- **Jurisdiction:** United States (federal)
- **Framework:** FTC Act Section 5; ROSCA; Utah Consumer Sales Practices Act; California UCL and FAL
- **Record date:** 2026-07-29
- **Procedural status:** Complaint filed; motion to dismiss due 22 October 2026; no ruling

Hims advertised a "100% online, private, and secure process" for conditions such as erectile dysfunction and mental health. Regulators allege it shared customer lists and pixel events with Meta and Snap to build ad audiences.

FTC, Utah and California · FTC Act, ROSCA and state consumer law · Complaint filed 29 July 2026

- The problem
- Case record
- What the regulators alleged
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## The problem

The complaint alleges that "\[d\]espite promising privacy and discretion, Hims shared consumers' sensitive health information with third-party advertising companies and platforms" such as Meta and Snap, without clearly disclosing it ([Complaint ¶ 66](https://attorneygeneral.utah.gov/wp-content/uploads/2026/07/2026-07-29-Hims-Complaint-Redacted-E-Filed.pdf)). It also alleges billing and cancellation violations under ROSCA ([FTC press release](https://www.ftc.gov/news-events/news/press-releases/2026/07/ftc-states-act-against-hims-hers-deceptive-unlawful-privacy-practices)).

## Case record

| Field | Record |
| --- | --- |
| Court | US District Court, N.D. California (Judge Vince Chhabria) |
| Case number | 3:26-cv-07871-VC |
| Parties | Federal Trade Commission, People of the State of California (Los Angeles County Counsel) and Utah Division of Consumer Protection v. Hims & Hers Health, Inc. |
| Laws | FTC Act Section 5; ROSCA; Utah Consumer Sales Practices Act; California UCL and FAL |
| Stage | Complaint filed 29 July 2026; motion to dismiss due 22 October 2026; hearing 7 January 2027 |
| Commission vote | 2-0 to file |
| Amount | None; relief sought includes civil penalties |
| Source review | 20 October 2026 |

## What the regulators alleged

The court has not ruled. The counts allege:

| Count | Law | Allegation |
| --- | --- | --- |
| I | FTC Act Section 5 | Deceptive privacy claims: that health information is only accessed by treating providers, and that the service is private and discreet |
| II | FTC Act Section 5 | Failure to disclose sharing of health information with advertising platforms |
| III | FTC Act Section 5 | Deceptive intake practices |
| IV to VI | ROSCA | Material terms not disclosed, no express informed consent to charges, no simple cancellation |
| VII, VIII | California FAL and UCL | Brought by the People of California |
| IX | Utah Consumer Sales Practices Act | Brought by the Utah Division of Consumer Protection |

Promises cited include a homepage answer, until at least late August 2023, that "medical records and sensitive information are only accessed by the medical providers managing your care"; ads offering a "100% online, private, and secure process"; influencer posts calling the service "discreet"; and broadcast ads calling it "totally private" ([Complaint ¶¶ 62-65](https://attorneygeneral.utah.gov/wp-content/uploads/2026/07/2026-07-29-Hims-Complaint-Redacted-E-Filed.pdf)).

## Technical issue

- **Customer lists:** Hims allegedly uploaded lists of customers to Meta and Snap to match them to their accounts ([Complaint, heading B and ¶ 76](https://attorneygeneral.utah.gov/wp-content/uploads/2026/07/2026-07-29-Hims-Complaint-Redacted-E-Filed.pdf)). The Meta list details are redacted in the public complaint.
- **Pixel and server events:** the Meta Pixel and Conversions API "automatically tracked and disclosed certain Events to Meta" ([¶ 70](https://attorneygeneral.utah.gov/wp-content/uploads/2026/07/2026-07-29-Hims-Complaint-Redacted-E-Filed.pdf)).
- **Other platforms:** pixels from Microsoft (Bing), Google Ads, Criteo, MediaBids, PartnerCentric, PebblePost, Pinterest, Podsights, Reddit, StackAdapt, TikTok, The Trade Desk and X ([¶ 77](https://attorneygeneral.utah.gov/wp-content/uploads/2026/07/2026-07-29-Hims-Complaint-Redacted-E-Filed.pdf)).
- **Use:** audiences built with a specificity the complaint says was possible only because Hims disregarded its privacy promises ([¶ 74](https://attorneygeneral.utah.gov/wp-content/uploads/2026/07/2026-07-29-Hims-Complaint-Redacted-E-Filed.pdf)).

**Inth's technical interpretation:** on a site that treats specific conditions, the page or product a visitor reaches already reveals health information. A standard purchase or sign-up event sent from a condition-specific flow tells the platform the condition. The browser pixel and the server-side Conversions API need the same review, because the server path does not appear in browser tools.

```javascript
// Condition-specific funnel sends standard events with the product name
fbq('track', 'Purchase', { content_name: 'ED treatment', value: 30 });
// ...and the server repeats it through a conversions endpoint
postServerEvent({ event_name: 'Purchase', content_name: 'ED treatment', email_hash });

// Send no condition or product details to ad platforms
if (consent.has('marketing')) {
  fbq('track', 'Purchase', { value: 30, currency: 'USD' });
}
```

Illustrative pattern, not the defendant's code. Generic consent API, not a specific c15t call.

## Timeline

| Date | Event |
| --- | --- |
| 2017 | Hims launches telehealth service |
| Until at least late August 2023 | Homepage privacy answer cited in the complaint |
| 29 July 2026 | Complaint filed (Dkt. 1); FTC announces action |
| 17 August 2026 | Court denies motions to seal parts of the complaint and orders Hims to show cause (Dkt. 26) |
| 18 August 2026 | Unredacted complaint filed (Dkt. 28) |
| 24 August 2026 | Order to show cause lifted with a warning about overbroad sealing requests (Dkt. 32) |
| 10 September 2026 | Schedule set: motion to dismiss due 22 October 2026, hearing 7 January 2027 (Dkt. 43) |
| 30 October 2026 | Initial case management conference |

## Outcome

None yet. The plaintiffs seek a permanent injunction, monetary relief and civil penalties. Hims's motion to dismiss is due 22 October 2026.

## What it cost

| Item | Amount | Source |
| --- | --- | --- |
| Penalties or redress | None; sought in the complaint | \[FTC press release\](https://www.ftc.gov/news-events/news/press-releases/2026/07/ftc-states-act-against-hims-hers-deceptive-unlawful-privacy-practices) |
| Defence costs | Not stated in the cited record |  |

## Why it matters

- **Ads and influencers are promises.** The complaint relies on TV, podcast and influencer claims, not only the privacy policy.
- **Customer-list uploads count.** The complaint treats uploading customer lists for account matching as a disclosure, alongside pixel sharing.
- **Federal and state together.** Utah and California join the FTC, adding state-law claims to the federal ones. Compare [BetterHelp](/enforcement/betterhelp) and [GoodRx](/enforcement/goodrx).

Related pages: [FTC Act and HBNR](/enforcement/laws/ftc-act-and-hbnr), [Sensitive context in event data](/enforcement/issues/sensitive-context-in-event-data), [Undisclosed data exchanges](/enforcement/issues/undisclosed-data-exchanges).

## How Inth catches this

- **Consent banner:** holds pixels until their category is granted where the policy is opt-in. Consent does not make condition-specific events appropriate for an ad platform.
- **Website audit:** records which vendors receive requests from condition-specific landing, intake and checkout pages, and the event names and parameters sent.
- **Evidence:** consent records with choice, country and policy, and per-page runtime observations.

Limit: customer-list uploads and Conversions API calls happen server-side and are not visible from the browser. Review them with the teams that run them.

## Checks for your own systems

### In the repository

- Search for Conversions API, offline conversions and audience-upload jobs, and list the fields they send.
- Check event parameters such as content\_name and content\_category for product or condition names.

### In the browser and network

- Complete an intake and checkout with a test account and inspect every third-party request.
- Compare vendors contacted on condition pages with the vendors your privacy notice names.

### With the people responsible

- Review ad copy and influencer briefs for privacy claims, and compare them with actual data flows.
- Ask marketing which audiences are built from customer lists.

## Sources and limits

- [FTC press release](https://www.ftc.gov/news-events/news/press-releases/2026/07/ftc-states-act-against-hims-hers-deceptive-unlawful-privacy-practices), 29 July 2026
- [Complaint, redacted version filed by Utah](https://attorneygeneral.utah.gov/wp-content/uploads/2026/07/2026-07-29-Hims-Complaint-Redacted-E-Filed.pdf), 29 July 2026
- [Docket](https://dockets.justia.com/docket/california/candce/3:2026cv07871/475189), reviewed 20 October 2026

The public complaint redacts the events and list details. The unredacted complaint (Dkt. 28) and the FTC-hosted complaint PDF were not reviewed. Billing and cancellation allegations are outside this library's focus and are summarised only.

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit Hims & Hers' current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [BetterHelp](/enforcement/betterhelp), [GoodRx](/enforcement/goodrx), [Sensitive context in event data](/enforcement/issues/sensitive-context-in-event-data).