Telehealth Giant Faces Federal Lawsuit Over Secret Patient Data Sharing with Meta and Snap

The Federal Trade Commission has launched a major enforcement action against Hims & Hers Health, Inc., alleging the San Francisco-based telehealth provider systematically shared sensitive patient health information with advertising platforms including Meta and Snap—despite explicit promises that medical data would remain confidential. The lawsuit, filed Wednesday in coordination with the states of Utah and California, represents one of the most significant regulatory challenges facing the direct-to-consumer digital health sector as regulators intensify scrutiny of how healthcare companies handle patient data in the age of targeted advertising.

Privacy Promises Versus Data Practices

According to the complaint, Hims & Hers marketed its services with assurances of a "100% online, private, and secure process" and explicitly stated that "medical records and sensitive information are only accessed by the medical providers managing your care." However, the FTC alleges the company engaged in two distinct methods of sharing patient information with third parties: directly providing customer lists to advertising platforms and embedding third-party tracking technologies on its website that disclosed visitor actions to external companies.

The allegations are particularly concerning given the sensitive nature of conditions treated through the platform, which include sexual health, mental health, and other private medical issues. The nearly three-year investigation that preceded the lawsuit suggests regulators conducted extensive evidence gathering before pursuing enforcement action.

Broader Implications for Digital Health

This case signals a critical inflection point for the telehealth industry, which has experienced explosive growth while operating in a regulatory gray zone between traditional HIPAA-covered entities and consumer technology companies. The FTC's willingness to pursue enforcement under the FTC Act's prohibitions on unfair and deceptive practices—rather than relying solely on healthcare-specific privacy laws—expands the regulatory landscape for digital health companies that may have believed their privacy policies provided adequate legal cover for data-sharing practices.

The involvement of multiple state attorneys general alongside federal regulators indicates coordinated enforcement that could establish precedent for how consumer health data is regulated when companies use advertising-driven growth models. Healthcare technology companies must now scrutinize their third-party tracking technologies, including pixels, cookies, and analytics tools, as well as any data-sharing agreements with advertising platforms.

Company Response and Additional Allegations

Hims & Hers has denied the allegations, stating the lawsuit "disregards substantial evidence" provided during the investigation and "contorts the law." The company maintains its privacy policy allows users to control how their information is handled. Beyond the privacy violations, the complaint also alleges the company made subscription cancellation unnecessarily difficult and engaged in deceptive billing practices, suggesting a pattern of consumer protection concerns.

The outcome could fundamentally reshape how digital health companies balance growth objectives with patient privacy obligations, potentially requiring significant operational changes across the sector. As regulatory enforcement intensifies, the case underscores the growing tension between advertising-driven business models and patient confidentiality expectations in digital healthcare.

Sources

1. FTC sues Hims & Hers for allegedly sharing patient information with third-party platforms — The Record