FTC Targets Hims & Hers in Major Privacy Lawsuit Over Sensitive Medical Data Sharing

The Federal Trade Commission (FTC) has launched a lawsuit against healthcare giant Hims & Hers, alleging the company shared sensitive medical and healthcare information with advertising behemoths, including Meta and Snap, while misleading consumers regarding its privacy practices.

The Pixel-Sized Data Leak

In a complaint filed in a California federal court, the FTC alleges that Hims & Hers utilized pixel-sized trackers to capture and share users’ health information, directly contradicting the company's own privacy policies. The lawsuit highlights the use of tracking tools from several tech giants, including:

■Meta and Snap

■Microsoft

■Pinterest

■Reddit

■X

These trackers reportedly allowed these companies to monitor user clicks and other specific actions taken on the Hims & Hers platform, turning sensitive medical interactions into actionable advertising data.

A Growing Regulatory Crackdown on Telehealth

The legal action marks the latest in a series of enforcement moves targeting telehealth startups that monetize patient data. The FTC has previously taken decisive action against several industry players, including:

■Cerebral (Telehealth startup)

■Monument (Alcohol recovery provider)

■GoodRx (Data giant)

■BetterHelp (Therapy provider)

Deceptive Billing and Consumer Protection

Beyond the data privacy concerns, the FTC has accused Hims & Hers of violating federal consumer protection laws through:

■Deceptive billing practices,

■Implementing policies designed to make it difficult for customers to cancel subscriptions.

In response, Hims & Hers stated that its privacy policy "makes clear" how data is used and expressed confidence in its position, confirming its intention to defend itself against the allegations.

From a venture capital perspective, this litigation serves as a stark warning for the HealthTech ecosystem. Data-driven growth models face a massive valuation risk when they collide with regulatory walls. We are seeing a shift where 'growth at all costs' is being replaced by a mandatory requirement for 'privacy-by-design.' For founders, compliance is no longer a legal footnote; it is a core component of long-term enterprise value and exit viability.