Hims & Hers Lawsuit: FTC and Two States Sue Over Website Tracking Pixels

“Private.” “Secure.” “Discreet.” That is how Hims & Hers described its telehealth services to millions of customers. According to the FTC and two states, the company’s website was telling advertisers a different story.

On July 29, 2026, the Federal Trade Commission, the Utah Attorney General, and Los Angeles County Counsel (for the State of California) filed a joint complaint against Hims & Hers Health, Inc. in the U.S. District Court for the Northern District of California. The direct-to-consumer telehealth company sells prescription treatments for sexual health, hair loss, mental health, skin conditions, and weight loss. The complaint alleges that tracking technologies embedded in its website sent sensitive health information to Meta, Snap, and other advertising platforms, while the company promised customers privacy.

Hims & Hers disputes the allegations and says its privacy policy makes clear that users can choose how their data is used. Nothing has been proven in court. But the complaint itself is the lesson. It shows exactly where regulators are looking, and it is the same place most organizations are not: the client side of their own websites.

What the complaint alleges

The lawsuit combines two sets of claims. The subscription claims allege that Hims & Hers charged customers immediately after they submitted intake forms, enrolled them in auto-renewing plans without clear consent, and buried the cancellation option behind multiple navigation steps.

The privacy claims are the ones that should concern anyone who runs a website that handles sensitive data. According to the complaint, Hims & Hers:

• Marketed its services as “private,” “secure,” and “discreet”
• Embedded third-party tracking technologies on its website that automatically transmitted visitor actions (“Events”) to advertising platforms
• Shared customer information with those platforms for audience matching
• Allowed data to flow from sensitive pages, including treatment, intake, and checkout pages that reveal the health conditions or medications a visitor is interested in

Reporting on the case names Meta and Snap as recipients, with trackers from Microsoft, Pinterest, Reddit, and X also allegedly present on the site.

The regulators assert nine counts in total: three deception claims under Section 5 of the FTC Act, three violations of the Restore Online Shoppers’ Confidence Act (ROSCA), claims under California’s False Advertising Law and Unfair Competition Law, and Utah claims for privacy misrepresentation and inadequate opt-out opportunity.

Why this case is different

The FTC has been here before. GoodRx, BetterHelp, Cerebral, and Monument all faced enforcement over health data flowing to advertisers through tracking technologies. Kaiser Permanente agreed to a $47.5 million settlement after pixels on logged-in patient pages sent data to Meta, Google, and Bing. The pattern is established.

Three things make the Hims & Hers case worth your attention.

States joined the complaint. This is not just federal enforcement anymore. California and Utah filed alongside the FTC, each bringing its own consumer protection statutes. Every state privacy law adds another regulator who can bring the same fact pattern to court. If your trackers leak data, you are not facing one enforcement action. You are facing several.

HIPAA is not the hook. Hims & Hers connects consumers with providers, and much of its business sits outside traditional HIPAA coverage. It did not matter. The FTC used Section 5 deception claims, and the states used false advertising and unfair competition laws. The theory is simple: you said “private,” your website did something else. Any company that makes privacy promises can be reached this way, covered entity or not.

The website itself is the evidence. Regulators did not need a breach, a hacker, or a leaked database. The alleged violation is the ordinary, day-to-day behavior of marketing pixels on sensitive pages. Your website is publicly observable. Regulators, plaintiffs’ attorneys, and researchers can inspect your tracker behavior from the outside at any time. Many do.

The uncomfortable question: do you know what your pixels send?

Most organizations cannot answer this with confidence, and the reason is structural. Marketing adds pixels to measure campaigns. Product adds tags to analyze funnels. Agencies add their own tools. Tag managers fire scripts based on rules nobody has reviewed in years. Forgotten pixels keep collecting data long after the campaign ends.

Meanwhile, security teams focus on servers, endpoints, and networks. The client side, the code that actually runs in your visitors’ browsers, sits in a governance gap. Nobody owns it, so nobody watches it.

The Morgan Lewis health law team drew the practical takeaways from the complaint: review where advertising trackers sit on sensitive pages, identify what URLs, events, identifiers, and parameters they transmit, determine whether recipients can tie that data to identifiable individuals, and align your privacy claims with what your site actually does. And keep records of tracker configurations over time, because when a dispute comes, you will need to prove what your website was doing and when.

Read that list again. It is a continuous monitoring requirement. A one-time audit tells you what your website did on the day of the audit. Pixels change behavior after updates, tags get added weekly, and a script that was safe in January can start collecting form data in March.

How Reflectiz closes the gap

Others tell you which trackers exist on your site. Reflectiz shows you what they actually do with your visitors’ data.

The Reflectiz Privacy Hub continuously monitors your website from the outside, exactly the way a regulator or researcher would look at it, and answers the questions the Hims & Hers complaint raises:

• Full tracker inventory. Every pixel, tag, and third-party script on every page, including the ones added through tag managers and fourth parties nobody approved.
• Data flow mapping. What each tracker collects and where it sends it, down to the URLs, events, and parameters. You see health-context data leaving a checkout page before the FTC does.
• Sensitive page coverage. Alerts when a tracker appears on pages where it should never run: intake forms, symptom checkers, checkout flows, patient portals.
• Consent validation. Whether trackers actually respect user choices, or fire before consent, which is where privacy-policy claims and reality drift apart.
• Evidence trail. A historical record of tracker configurations and changes, so you can document what ran on your site and when.

Because Reflectiz is agentless, there is no code to install and no impact on site performance. You get the outside-in view of your website that regulators already have, before they use it.

What to do this week

1. Inventory every tracking technology on your site, including everything loaded through tag managers.
2. Map your sensitive pages: anywhere a URL, button click, or form field reveals a health condition, a financial situation, or another sensitive fact about the visitor.
3. Check what fires on those pages and what it transmits.
4. Compare the result against your privacy policy and marketing claims. If your site says “private,” verify that the network traffic agrees.
5. Set up continuous monitoring and keep the records. Point-in-time audits do not survive contact with weekly tag changes.

The Hims & Hers case will take years to resolve. Your exposure will not wait that long. Book a demo to see what your website is telling advertisers about your visitors.