Hims & Hers: When the FTC Sues Over Tracking Pixels

The Hims & Hers case is the one that should worry you even if you've never heard of a CIPA demand letter. Every other case on the tracker is a private lawsuit — a plaintiff or a class seeking damages. This one is a government enforcement action: the Federal Trade Commission, joined by the State of Utah and Los Angeles County, sued the telehealth company in July 2026. The core allegation is familiar — tracking pixels shared sensitive user information with advertising platforms without proper consent — but the identity of the plaintiff changes everything. When regulators enforce the same pre-consent tracking that private plaintiffs sue over, and the data in question is health data, the exposure stops being a settlement line item and becomes an existential compliance problem.

What the case is about

Filed July 29, 2026 in the Northern District of California, the complaint alleges that Hims & Hers — a telehealth company offering treatment for sensitive conditions — disclosed consumers' health information to third-party advertising platforms. According to the FTC, this happened through two mechanisms: tracking pixels embedded in the site that captured and transmitted user activity, and customer-list uploads sent to ad platforms for audience matching.

The data at issue is unusually sensitive. The complaint describes information touching sexual wellness, mental health, weight loss, and other conditions being shared with platforms including Meta, Snap, Microsoft, Pinterest, Reddit, and X. For a company whose entire value proposition is discretion around personal health, the allegation is that the discretion didn't extend to the ad stack. The FTC and its co-plaintiffs seek a permanent injunction and monetary relief.

The customer-list upload allegation deserves particular attention, because it's the half most businesses overlook. Everyone now knows a pixel on the page can leak data. Fewer think about the other direction: deliberately exporting a list of customers — emails, phone numbers, the fact that they're your customers — and uploading it to an ad platform to build a "lookalike" audience or retarget them. That's a server-side data transfer, invisible to anyone inspecting the website, and it carries the implicit signal "these people use a telehealth service." The complaint treats both mechanisms as part of the same disclosure failure. For any business, it's a reminder that the pixel on the page is only the visible half of the data-sharing picture; the marketing team's audience-matching uploads are the half that doesn't show up in a browser.

The detail that makes it matter

Two things separate this from the private pixel cases. First, the enforcer. A private class action ends, at worst, in a settlement fund. An FTC action can end in a consent order that dictates how a company must operate for years — mandated privacy programs, audits, deletion requirements, and penalties for non-compliance. The leverage is different in kind, not just degree.

Second, the data. This isn't IP addresses or click events; it's information a reasonable person would consider among the most private they have. The complaint's framing — that a company promised discretion and then routed health signals to advertisers — is the kind of consumer-deception narrative the FTC is built to pursue. It also lands against a 2026 backdrop where the aggressive reading of HHS's HIPAA tracking guidance had been scaled back in court, yet enforcement over health-data tracking continued anyway, because the FTC Act and state consumer-protection law don't depend on HIPAA at all. (We cover that dynamic in the healthcare pixel settlement roundup.)

The legal theory — beyond CIPA

This case is on our CIPA tracker, but it's important to be precise: it is not a CIPA case. No §631, no §638.51. It runs on a different, arguably broader set of tools:

Why include a non-CIPA case on a CIPA tracker? Because the conduct is the same conduct CIPA plaintiffs target — trackers sharing data before consent — and the case proves that conduct is actionable through many doors, not one. A business that has carefully armored itself against §631 claims but ignored the FTC Act has only locked one of several. The tracker exists to show the full threat surface, and Hims & Hers is the clearest example that the surface extends well past California's wiretap statute.

The second front: deceptive subscriptions

The complaint isn't only about pixels. It also targets Hims & Hers' billing practices — and this half is worth understanding even if you're not in health. The FTC alleges the company advertised "free" consultations and "Pay $0 today," then enrolled patients in recurring subscriptions "as soon as a provider wrote a prescription," without a clear chance to review or decline. It further alleges charges were processed roughly ten days earlier than consumers would reasonably expect, with cancellation required two days before that early date.

That's a ROSCA theory: the problem isn't charging for a subscription, it's the gap between what the checkout said and what actually happened to the customer's card. If that sounds familiar, it should — it's the same disclosure-versus-reality mismatch at the heart of the tracking claims. Whether the subject is data or dollars, the FTC's complaint tells one consistent story: the company's representations didn't match its conduct. Any business running "free trial" funnels or auto-renewing plans should read the ROSCA half as a direct warning.

It's worth pausing on why the FTC bundled these two complaints together, because the pairing is strategic. Dark patterns in a checkout and silent data-sharing in the page's background are, to a regulator, the same species of problem: a business shaping what the customer can see and understand so that the customer's apparent "agreement" isn't really informed. Framed that way, a hidden auto-renewal and a pre-consent pixel are two expressions of one failure — consent that looks obtained but wasn't. That framing is portable. It means a regulator who finds one kind of mismatch on your site has a ready-made reason to look for the other, and it means cleaning up only your trackers while leaving a misleading checkout (or vice versa) leaves the underlying theory intact.

How it fits the 2026 landscape

Hims & Hers extends the pattern seen across the tracker into a new enforcement lane.

What this means for your site

You don't have to be a telehealth company to take the lesson. The conduct — trackers transmitting sensitive or intent-revealing data before consent — is common across industries, and the FTC's authority reaches far beyond health.

Frequently asked questions