The FTC Just Sued Hims & Hers Over Ad Pixels. Audit Your Site

On July 30, the Federal Trade Commission sued Hims & Hers, the publicly traded telehealth company, in California federal court. The complaint alleges the company shared customers' medical and health information with advertisers through pixel-sized trackers on its website. Meta and Snap got named. So did trackers from Microsoft, Pinterest, Reddit, and X.

The FTC says those pixels captured and shared health information in ways that contradicted the company's own privacy policy. Regulators added a second set of charges too: deceptive billing and cancellation policies that allegedly made it hard for customers to leave. Hims & Hers says it is confident in its position and plans to fight. The court will sort out who is right. But you do not need a verdict to pull the lesson that matters for your company.

A tracking pixel is a small piece of code an ad platform gives you to paste into your site. When someone visits, the pixel fires and tells the platform who showed up, what page they viewed, and what buttons they clicked. That data powers retargeting, lookalike audiences, and conversion reporting.

Here is the part founders miss. The pixel does not know which pages are sensitive. If a visitor lands on a checkout page for an anxiety medication, the pixel can pass along the URL, the page title, and the click, and suddenly a third party holds a health signal about a named user. The plumbing works exactly as designed. That is the problem.

And pixels rarely arrive alone. A typical early-stage site carries an ad pixel, an analytics script, a session recorder, and a chat widget, each installed by a different person in a different month, each with its own idea of what to collect. Nobody sits above them all with a complete picture. In the Hims & Hers complaint, the FTC says the company also used platform tools to track clicks and other user actions on its site, which is a reminder that these tools capture behavior, not just page views.

Dropping the Meta pixel on every page is step one of the default growth playbook. It ships with most site templates. Your first marketing hire will ask for it on day one.

And the FTC has been punishing exactly this default for years. GoodRx paid a penalty in 2023 for sharing health data with Facebook and Google. BetterHelp owed customers $7.8 million the same year over similar claims. Cerebral and Monument got hit too. In 2024, TechCrunch found the U.S. Postal Service accidentally sharing logged-in users' home addresses with Meta, LinkedIn, and Snap through pixel code. Nobody at USPS set out to do that. The pattern is always the same: a standard tool, installed everywhere, quietly collecting more than anyone intended.

Most first-time founders treat the privacy policy as a legal checkbox. Copy a template, link it in the footer, move on.

Read the FTC's theory in this case and you will see why that habit is dangerous. The government is not only arguing that sharing health data was wrong. It is arguing that Hims & Hers promised one thing in its policy and did another in its code. The gap between the two documents is the case. So the fix is not writing a stricter policy. It is making sure the policy and the actual data flows match. A boring, accurate policy beats an impressive one you cannot live up to.

The lawsuit also targets billing. The FTC alleges Hims & Hers made cancellation difficult and billed customers deceptively, in violation of consumer protection law.

Subscription friction is a growth tactic in a lot of playbooks. Hide the cancel button two menus deep, add a retention offer, require a phone call. Every one of those choices juices retention metrics this quarter and builds a regulatory file for later. If your churn number depends on customers failing to find the exit, you do not have retention. You have a trap, and traps are now a litigation category.

The practical standard is simple to state: cancellation should take roughly the same effort as signup. One or two clicks in, one or two clicks out. Companies that meet that standard also get cleaner data, because their retention numbers reflect actual satisfaction instead of trapped users waiting for a chance to escape and vent in reviews.

You can do this in an afternoon, and you should do it before your next marketing sprint.

1. Inventory every tag. Open your tag manager, or your site source, and list every third-party script: ad pixels, analytics, session recorders, chat widgets, heatmaps.

2. Map what each one sees. Which pages does it load on? Does it fire on checkout, account, or support pages? Does it capture URLs, form fields, or button text?

3. Flag sensitive surfaces. Anything touching health, money, kids, location, or identity gets special handling. Pixels come off those pages unless you have a reviewed reason.

4. Check your consent flow. Does your banner actually block tags until someone agrees, or does it just sit there while everything fires anyway?

5. Reconcile against your privacy policy. Every data flow you found should be described in plain language in the policy. If it is not, fix one or the other.

Write down what you found and what you changed, with dates. If a regulator, an acquirer, or an enterprise customer ever asks about your data practices, a documented audit trail is the difference between a quick answer and a scramble.

The cheapest time to handle data carefully is before you collect any of it. When you map out your go-to-market plan, add a short data-practices section right next to your channel list: what you will collect, which tools see it, and what you will never share. You can sketch this in a spreadsheet, in Notion, or in a planning tool like Foundra that keeps your marketing plan and your operating decisions in one workspace, so the privacy call gets made deliberately instead of by whoever pastes in the next snippet.

This is not compliance theater. Buyers ask about data handling earlier than they used to, and enterprise deals now stall on it. A clean answer is a sales asset.

If your product touches health, finances, or minors, the bar moves up sharply.

Keep ad pixels off logged-in experiences entirely. Send conversion events server-side, where you control exactly which fields leave your systems. Strip identifiers before anything reaches an ad platform. Ask every vendor how their tool behaves on sensitive pages, and get the answer in writing. And budget for a privacy review with an actual lawyer before launch, not after your first press mention. The FTC keeps choosing health companies for a reason. They collect the most sensitive data while running the most aggressive acquisition playbooks. If that describes your roadmap, treat this lawsuit as your free warning.

• The FTC sued Hims & Hers on July 30 over tracking pixels that allegedly shared health data with Meta, Snap, and other platforms.

• This is a pattern, not a one-off: GoodRx, BetterHelp, Cerebral, and Monument all faced similar actions.

• The legal exposure lives in the gap between what your privacy policy says and what your code does.

• Cancellation friction is no longer a clever retention tactic. It is a named charge in federal complaints.

• A one-afternoon audit of tags, data flows, and consent puts you ahead of most funded startups.

Do small startups really get FTC attention? Enforcement usually starts with bigger names, but state attorneys general and private class actions follow the same theories against companies of every size. Small also does not last. Your data practices at 1,000 users become your liability at 1 million.

Are tracking pixels illegal now? No. Pixels on generic marketing pages, disclosed properly, remain standard practice. The trouble starts when they sit on sensitive pages or contradict your stated policy.

What counts as sensitive data? Health conditions, prescriptions, precise location, financial details, anything about children, and identity documents. If a leak would embarrass or endanger a user, treat it as sensitive.

Is server-side tracking a full fix? It helps because you choose exactly what to send, but it is not automatic protection. Sending the same sensitive fields server-side recreates the same problem with extra steps.

We already installed everything. Too late? No. Regulators treat cleanup very differently than denial. Audit now, remove what you cannot justify, update the policy, and document the work.

1. FTC sues Hims & Hers for allegedly sharing patients' medical data with advertisers Meta and Snap (TechCrunch, Jul 30, 2026)
2. FTC press release: FTC, states act against Hims & Hers for deceptive, unlawful privacy practices
3. FTC slaps online pharmacy GoodRx for sharing users' health data with Facebook and Google (TechCrunch, 2023)
4. USPS shared customer postal addresses with Meta, LinkedIn and Snap (TechCrunch, 2024)
5. Hims & Hers responds to FTC lawsuit (investor statement)