FTC sues Hims & Hers for allegedly sharing patients’ medical data with advertisers Meta and Snap

The Federal Trade Commission is suing healthcare giant Hims & Hers for allegedly sharing its customers’ medical and healthcare information with advertisers and tech giants, like Meta and Snap, as well as for misleading consumers about its privacy practices.

The lawsuit is the federal consumer watchdog’s latest crackdown in recent years on healthcare companies that share sensitive information with outside companies without their customers’ knowledge. Hims & Hers, now a publicly traded company, provides prescription medication for sexual wellness, mental health conditions, weight loss, and other issues, and as such handles a large amount of sensitive patient data.

Companies typically try to learn more about their customers by installing code on their websites in order to share users’ information with advertisers, like Meta and Snap, which then use the data to provide information about who is visiting their websites and when. 

In its complaint filed in a California federal court, the FTC alleged that Hims & Hers placed pixel-sized trackers provided by Meta, Snap and other tech and advertising giants, including Microsoft, Pinterest, Reddit and X. These trackers, the FTC said, “captured and shared users’ health information,” contrary to Hims & Hers’ own privacy policy. The FCC alleges the company also used Meta’s tools to track users’ clicks and other actions that users took on its website.

The FTC also accused Hims & Hers of deceptive billing, and drawing up policies that allegedly made it difficult for customers to cancel, in violation of federal consumer protection laws.

Hims & Hers did not explicitly deny the FTC’ s claims in a statement on its website. The company claimed its privacy policy “makes clear” that users “may choose how their data is used,” and said it is “confident” in its position. Hims & Hers said it plans to defend against the FTC’s allegations.

The FTC has previously taken action against telehealth startup Cerebral, alcohol recovery provider Monument, as well as data giant GoodRx and therapy provider BetterHelp. These companies were similarly accused of sharing patients’ sensitive data through their websites to third-party tech giants and advertisers.

The use of pixel-sized trackers has previously revealed how people’s sensitive data gets shared with the companies who provide the code, highlighting how misconfigurations can result in unwanted data collection.

In 2024, TechCrunch found that the U.S. Postal Service was sharing logged-in users’ home addresses with Meta, LinkedIn and Snap by using their pixel tracking code. The USPS removed the code soon after.