FTC Targets Health Data Sharing and Privacy Claims

By Paul Rothermel

FTC Complaint Signals Continued Scrutiny of Consumer Health Data Practices

On July 29, 2026, the Federal Trade Commission (FTC), joined by California and Utah enforcement authorities, filed a complaint against Hims & Hers alleging that the company shared consumers’ sensitive health information with advertising platforms despite representations that patient information would remain private. The complaint also includes allegations regarding subscription enrollment, billing, and cancellation practices. The allegations have yet to be proven in court, but the complaint is instructive for medical products manufacturers, digital health companies, and other organizations collecting health-related information directly from consumers, highlighting a continued FTC emphasis on alleged misrepresentations about the privacy of consumers’ health data. 

Hims & Hers disputes the allegations and has stated that it intends to vigorously defend against the lawsuit.

Privacy Representations Remain a Key Enforcement Focus

According to the FTC, Hims & Hers promoted its services as private, secure, and discreet while simultaneously transmitting information to advertising platforms such as Meta and Snap through tracking technologies and other data-sharing practices. The FTC alleges that these disclosures enabled advertising audiences to be created based on sensitive health-related interests and conditions. 

The complaint continues a long-standing FTC enforcement trend: privacy representations are treated as promises to consumers. When a company represents that information will remain private, discreet, secure, or available only to healthcare professionals, regulators increasingly expect operational and technical practices to align with those statements. 

Influencer Marketing and Public Privacy Claims May Create Additional Risk

One notable aspect of the FTC’s complaint is its focus on how consumers may perceive Hims & Hers’ privacy commitments. Companies should remember that privacy representations are not limited to website privacy policies or terms of service. The government may determine that promises to keep information “100% online, private, and secure” are material representations about the company’s privacy practices and take action if these practices come to light.

(Screenshot from the Internet Archive Wayback Machine, Oct 2, 2023)

Statements made in advertisements, social media campaigns, influencer content, patient testimonials, FAQs, customer support materials, and marketing material may all be considered when regulators evaluate whether consumers were misled regarding the handling of personal information. A company that publicly emphasizes privacy protections while deploying advertising technologies that disclose sensitive data without appropriate consent may face increased regulatory scrutiny.

Organizations publishing privacy-related messaging, whether directly through influencers or by other marketing avenues, should consider evaluating these communications with rigor similar to product claims. 

What Are the Practical Privacy and Compliance Implications around Sharing Consumer Information?

Keep in mind that these principles may apply even to companies not subject to the Health Insurance Portability and Accountability Act (“HIPAA”) that handle health-related or other sensitive consumer information.

Key steps to manage compliance with the FTC Act with regard to direct to consumer engagement through websites, mobile applications, and marketing programs include:

• Inventorying website pixels, software development kits (SDKs), analytics tools, and advertising technologies;
• Confirming whether any data transmitted to third parties could reveal a medical condition, treatment interest, symptom, or diagnosis;
• Reviewing privacy statements, marketing materials, and influencer content for privacy-related claims;
• Reevaluating audience-building and retargeting activities involving health-related information; and
• Ensuring privacy, legal, marketing, and IT teams maintain consistent messaging and practices.

Key Takeaway

Along with a continued wave of litigation related to online tracking technologies in California, this recent enforcement action from the FTC reiterates a critical point: companies should assess and regularly monitor their privacy policies, data collection practices, consent management, and website tracking technologies. 

Paul Rothermel, Managing Attorney

How Gardner Law Can Help

Gardner Law regularly advises medical device, pharmaceutical, digital health, and life sciences companies regarding website tracking technologies, patient support programs, advertising practices, HIPAA compliance, state consumer privacy laws, and health data governance. This enforcement action also reinforces themes discussed in our prior alerts and presentations concerning pixel technologies, consumer health privacy laws, and evolving FTC privacy enforcement trends. If you would like assistance reviewing website analytics tools, advertising technologies, privacy notices, or other data privacy matters, please contact us.