FTC Sues Hims & Hers Over Sharing 2.6M Users' Health Data with Meta and Snap

For cybersecurity professionals, this case is a stark reminder that not all data breaches involve hackers—sometimes it's the companies themselves selling out user privacy. The FTC's complaint exposes how Hims & Hers allegedly embedded tracking pixels that transmitted patients' health conditions to advertising giants without consent, undermining the fundamental tenets of data minimization and informed consent. With telehealth usage surging, the incident underscores the urgent need for companies to audit third-party data flows and enforce technical controls that prevent unauthorized sharing.

The U.S. Federal Trade Commission filed a bombshell lawsuit against telehealth giant Hims & Hers on July 29, 2026, alleging the company systematically shared patients' most intimate health information—covering conditions like erectile dysfunction, premature ejaculation, mental health disorders, and obesity—with advertising titans Meta and Snap, all while explicitly promising users their data would remain private. The complaint, filed jointly with Los Angeles County and Utah, unearthed a business model that not only betrayed consumer trust but also locked nearly 2.6 million subscribers into recurring charges before they ever consulted a medical professional, then erected barriers to cancellation. This legal action marks one of the most aggressive federal privacy enforcement moves against a direct-to-consumer digital health platform, and it reverberates far beyond one company's stock price.

“

(HIMS) plunged around 12% on the news, wiping out significant market capitalization.

The FTC's investigation, which began in 2023, uncovered a pattern of data transmission that contradicts Hims & Hers' public-facing privacy guarantees. When users filled out intake forms detailing their health concerns, that information—according to the agency—was siphoned to Meta and Snap for advertising targeting purposes, without adequate disclosure or consent. For a platform treating stigmatized conditions, the implications are severe: consumers who sought discrete medical care may have had their ED medication interests or mental health struggles fed into the social media advertising ecosystem. The lawsuit also alleges that billing practices were equally deceptive: users were charged immediately upon submitting an intake form, rather than after a promised consultation with a healthcare provider, and many were enrolled in subscription plans they could not easily escape. One aggrieved customer cited in the complaint reported being told they wouldn't be charged until speaking with a doctor, only to see their card debited instantly.

Hims & Hers, a San Francisco-based company founded in 2017, has grown into a dominant force in telehealth for stigmatized and lifestyle conditions, shipping prescriptions directly to consumers. As of March 2026, it boasted approximately 2.6 million subscribers, underscoring the scale of potential exposure. The company has staunchly denied all allegations, calling the suit “baseless” and “an effort to generate headlines at our expense,” and asserting that the FTC ignores established state laws and industry standards. However, the market reaction was swift and unforgiving: shares of Hims & Hers Health Inc. (HIMS) plunged around 12% on the news, wiping out significant market capitalization. This immediate punishment reflects investor fears of prolonged legal battles, potential fines, reputational damage, and a chilling effect on customer acquisition.

The industry context is critical. Telehealth companies operate in a regulatory gray zone when it comes to health privacy; unlike traditional healthcare providers, they are not always squarely under HIPAA’s patient data protections, relying instead on FTC consumer protection laws and state privacy statutes. The FTC’s action signals that the era of lax enforcement on digital health data sharing is ending. By bringing the case alongside state entities, the agency is constructing a multi-front legal assault that could set precedent for what constitutes deceptive privacy practices in the online health space. For companies like Meta and Snap, named as recipients of the data but not defendants, this lawsuit could intensify scrutiny on their data collection practices through third-party business tools, such as tracking pixels embedded in health apps.