FTC sues Hims & Hers over health data sharing; stock drops 8.7%

For legal and compliance professionals, the FTC’s lawsuit against Hims & Hers signals an aggressive new front in regulating digital health privacy. The case underscores the risks of tracking pixels and deceptive cancellation practices under Section 5 of the FTC Act, with potential penalties reaching millions.

The Federal Trade Commission has filed a civil lawsuit against telehealth company Hims & Hers, alleging the company systematically shared sensitive health information with advertising giants Meta and Snap despite explicit privacy promises to users. The suit, filed in federal court in late July 2026, accuses the San Francisco-based startup—known for connecting patients with providers for conditions ranging from sexual health to mental wellness—of embedding tracking pixels that transmitted data about users’ health-related browsing behavior, product selections, and even purchase histories to social media platforms. FTC Director of the Bureau of Consumer Protection Christopher Mufarrige stated the agency “will not hesitate to act on behalf of consumers deprived of their ability to choose... whether to keep their most sensitive health information private,” signaling a muscular new phase in digital health privacy enforcement.

“

This approach mirrors recent FTC actions against GoodRx ($1.5 million civil penalty in 2023 for sharing health data with Meta and Google) and BetterHelp ($7.8 million settlement in 2023 for similar pixel-based data leaks).

The FTC’s complaint also targets Hims & Hers’ billing and cancellation practices, alleging the company made it unreasonably difficult for consumers to cancel subscriptions and charged them without proper authorization. These allegations fall squarely under Section 5 of the FTC Act, which prohibits unfair or deceptive acts. Because Hims & Hers is not a HIPAA-covered entity (the platform acts as a technology intermediary rather than a healthcare provider billing insurance), the FTC cannot directly enforce HIPAA; instead, it uses its broad consumer protection mandate to punish deceptive privacy representations. This approach mirrors recent FTC actions against GoodRx ($1.5 million civil penalty in 2023 for sharing health data with Meta and Google) and BetterHelp ($7.8 million settlement in 2023 for similar pixel-based data leaks). The current suit suggests the FTC is prepared to escalate penalties and pursue injunctive relief that could reshape data practices across the entire telehealth sector.