Hims & Hers FTC Lawsuit Over Health Data Sharing: Privacy and Compliance Lessons for Telehealth Providers

Hims & Hers Health, the San Francisco-based telehealth and direct-to-consumer subscription pharmacy platform, has filed a motion to dismiss a lawsuit brought by the Federal Trade Commission — joined by the states of Utah and California — alleging deceptive business practices and privacy violations tied to the company's handling of consumer health data. While the litigation will play out in court, the allegations themselves should be treated as an operational warning shot for every healthcare organization, telehealth provider, and digital health platform running web properties that touch protected or sensitive health information.

This is not a vulnerability disclosure or an active intrusion campaign. There is no CVE here. The threat is structural: the intersection of ad-tech tracking infrastructure (pixels, SDKs, third-party analytics) with healthcare conversion funnels, compounded by allegedly deceptive subscription and cancellation flows. The FTC has been building this enforcement pattern for years — GoodRx, BetterHelp, Cerebral, and Premom all faced actions over exactly this class of conduct: sharing health-related signals with advertising platforms without valid consent. The Hims & Hers case signals that the agency is now moving against one of the largest players in consumer telehealth, and the compliance bar it sets will apply to the entire sector.

For defenders — CISOs, privacy officers, and SOC teams supporting healthcare organizations — the lesson is immediate: your marketing stack is now a regulatory attack surface. If you cannot inventory, control, and document every third-party data flow on patient-facing properties, you are carrying unquantified legal and breach-notification risk.

What the Lawsuit Alleges

Based on the reporting, the complaint from the FTC and the two state attorneys general centers on two overlapping themes:

1. Privacy violations through third-party data sharing. The allegations follow the now-familiar pattern seen in prior FTC health-privacy actions: health-related signals collected on consumer-facing web properties — symptom selections, condition pages visited, quiz and intake responses, prescription interests — were allegedly disclosed to third parties, including advertising and analytics platforms, without the disclosures and consent required under the FTC Act's prohibition on unfair or deceptive practices and applicable state law. Notably, companies like Hims & Hers that operate as direct-to-consumer platforms frequently fall outside HIPAA's traditional covered-entity framework in parts of their business, which is precisely why the FTC has asserted jurisdiction using its Section 5 authority and its Health Breach Notification Rule for health-adjacent data held by non-HIPAA entities.

2. Deceptive subscription practices. The complaint also reportedly targets the company's subscription model — allegations consistent with the FTC's enforcement of the Restore Online Shoppers' Confidence Act (ROSCA) and its click-to-cancel rulemaking: unclear recurring-billing disclosures, friction-heavy cancellation flows, and marketing representations that allegedly misled consumers.

Hims & Hers disputes the allegations and has moved to dismiss. The legal outcome is uncertain — but the compliance precedent is not. Every prior FTC health-data-sharing action has ended in consent decrees with 20-year audit obligations, mandated deletion of improperly shared data, bans on disclosing health information for advertising, and civil penalties.

Why This Matters to Security and Privacy Defenders

From a practitioner's seat, three realities stand out:

Ad-tech is unmonitored egress. Most SOC programs monitor network egress for malware C2 and data exfiltration — but almost none monitor browser-side egress from their own web properties. A Meta Pixel, TikTok Pixel, or analytics SDK firing on a mental-health intake page is an authorized-looking HTTPS connection to a legitimate domain. It will never trip your detections. Yet it is, functionally, unauthorized disclosure of health information.

Consent management is a security control. Regulators now treat consent failures as deceptive practices. A consent-management platform (CMP) that loads trackers before the user opts in — the default behavior of most tag managers — is a compliance violation embedded in your production codebase.

Shadow marketing IT is your exposure. Tracking tags are usually deployed by growth and marketing teams through Google Tag Manager without security review. Your data-flow inventory almost certainly does not match what is actually executing in patients' browsers.

Executive Takeaways

Because this is a regulatory and data-governance threat rather than an exploitable vulnerability, the response is organizational and architectural rather than signature-based. Six actions, in priority order:

Inventory every tracker on health-adjacent pages — now. Crawl your production properties (especially intake forms, condition pages, and post-authentication portals) and enumerate every third-party request. Anything transmitting to ad platforms (Meta, Google Ads, TikTok, Snap, X, Criteo) from a page where a user reveals health intent is a finding, not a feature.
Re-architect consent to be prior, not retroactive. No advertising or analytics tag may execute before affirmative opt-in. Audit your tag manager's firing rules — the default configuration of GTM and most CMPs loads scripts before consent resolution on many page types.
Segment marketing tech from health contexts. Pages carrying health signals should run a reduced tag set or a server-side proxying model with field-level stripping, so nothing identifiable or health-related can leave to a third party even by misconfiguration.
Map your regulatory posture honestly. Determine, per business line and data flow, whether you are a HIPAA covered entity/business associate, or whether you fall under the FTC Act, the FTC Health Breach Notification Rule, state health-privacy statutes (e.g., Washington My Health My Data, California's CMIA/CCPA), or several at once. DTC telehealth hybrids routinely get this wrong.
Review subscription and cancellation flows against ROSCA and the FTC's negative-option rules. If cancellation requires more steps than signup, expect it to be characterized as deceptive. Fix it before a regulator asks.
Bring privacy telemetry into the SOC. Web-property data-flow audits should be a recurring, evidenced control — logged, reviewed, and reported to the same governance cadence as vulnerability management, because regulators will treat it with the same seriousness.

Practical Audit: Enumerating Third-Party Trackers on Your Properties

A quick first-pass audit does not require commercial tooling. The following script fetches your key pages and flags references to common advertising and analytics endpoints — use it as a smoke test before engaging a full privacy audit:

Bash / Shell

#!/bin/bash
# tracker-audit.sh — flag ad/analytics references on healthcare web pages
# Usage: ./tracker-audit.sh urls.txt

PATTERNS='connect.facebook.net|facebook.com/tr|googletagmanager.com|google-analytics.com|analytics.tiktok.com|snap.licdn.com|ads.twitter.com|bat.bing.com|hotjar.com|fullstory.com|segment.io|doubleclick.net|criteo'

while read -r url; do
  echo "=== $url ==="
  curl -sL -A 'Mozilla/5.0 (PrivacyAudit)' "$url" \
    | grep -oiE "(https?:)?//[a-z0-9.-]*(${PATTERNS})[a-z0-9./?=_-]*" \
    | sort -u
  echo
done < "$1"

Caveats from experience: static HTML scraping undercounts tags loaded via tag managers and post-consent execution. For a defensible audit, run a headless browser (Playwright/Puppeteer) against each page, capture the full HAR file of outbound requests, and review what fires before consent is granted. That before-consent traffic is where regulators will look first.

Remediation and Governance Actions

Immediate (30 days): Complete the tracker inventory; remove or gate all ad-platform tags on pages involving health conditions, intake, or authenticated patient areas; suspend any lookalike-audience or custom-audience uploads built from health-interested user lists.
Near-term (90 days): Deploy or correct a CMP with true prior-consent blocking; document a data-flow map covering every third party receiving user data; execute or review DPAs and BAAs against actual flows, not assumed ones.
Structural (2 quarters): Stand up a change-control gate requiring security/privacy sign-off for any new tag, SDK, or pixel; add quarterly authenticated web-property privacy audits to the compliance calendar; brief the board on FTC health-privacy enforcement exposure as a named risk.
Legal readiness: If historical data was shared with ad platforms, engage counsel on deletion demands, the FTC Health Breach Notification Rule's notification obligations, and state AG exposure — the Hims & Hers complaint being joined by Utah and California is the template for multi-state follow-on actions.

The FTC's enforcement trajectory is unambiguous: health data disclosed to ad-tech is treated as a deceptive-practices violation regardless of what your privacy policy's fine print says. Organizations that get ahead of this now convert an existential regulatory risk into a documented, auditable control.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub