Telehealth advertising after the Hims & Hers complaint: the pixel is the exposure

What the FTC alleges in the Hims & Hers case#

The fox does not fear the hedgerow; it fears the snare tucked inside it. For telehealth advertising, the snare is a few lines of tracking code that nobody on the marketing team wrote and everybody on the marketing team relies on.

On 29 July 2026 the Federal Trade Commission, joined by Utah and by California through Los Angeles County Counsel, filed a complaint against Hims & Hers in the US District Court for the Northern District of California, according to the FTC press release of 29 July 2026. The Commission vote to authorise staff to file was 2-0. Everything below is an allegation. The FTC itself notes that it files when it has "reason to believe" a law is being broken, and that the court will decide the case.

Three things are alleged. First, the FTC alleges that Hims does not clearly disclose that it charges consumers for prescriptions almost immediately after they submit an intake form, despite telling them they can consult a medical provider to find a treatment that is right for them.

Second, the FTC alleges the company made cancelling hard, including a cancellation button that appeared only after consumers chose an option to add or remove items from an order.

Third, and the strand that matters to anyone who buys media, the FTC alleges that Hims shared consumers' health information with Meta, Snap and other third parties, both by sharing lists of certain customers and through third-party tracking technologies that passed website "Events" to those companies.

The detail on the tracking strand comes from press coverage of the complaint. TechCrunch reported that the FTC alleges the company placed pixel-sized trackers from Meta, Snap and other platforms, including Microsoft, Pinterest, Reddit and X, and that those trackers "captured and shared users' health information" contrary to the company's own privacy policy. Read that as the FTC's account, not a settled fact.

What the company says#

Hims disputes the case. The Associated Press report of 19 September 2026 reports that the company called the claims "an effort to generate headlines at our expense". TechCrunch reported that a statement on the company's website said its privacy policy makes clear that users may choose how their data is used, that it is confident in its position, and that it plans to defend against the allegations.

The company's quarterly filing adds the paper trail. The Hims & Hers Form 10-Q for the quarter ended 30 June 2026 says the FTC issued a civil investigative demand in October 2023 about the company's privacy, advertising, subscription and cancellation practices, that settlement talks were unsuccessful, and that the company had recorded a legal contingency accrual of approximately $60 million for the matter at 30 June 2026. The filing also says that amount may move materially as the litigation progresses, and that the outcome of litigation is inherently uncertain. An accrual is an accounting provision. It is not a finding.

For a healthcare marketer the moonlit truth is quieter than the headline. Nobody has to decide whether these particular allegations are right for the underlying lesson to bite: the telehealth advertising stack is a data-sharing arrangement, and regulators now read it as one. That is the working brief of healthcare marketing in 2026.

The rulebook: which rules bite on telehealth advertising#

Telehealth advertising sits under four layers at once: the FTC Act, a breach rule, HIPAA where it applies, and platform policy. Each answers a different question, and confusing them is how good teams end up compliant on paper and exposed on the wire.

The FTC Act: promises and consent#

The FTC business guidance on consumer health information says the FTC Act applies to companies that collect, use or share health information whether or not they fall under HIPAA. It adds that the BetterHelp, GoodRx and Premom cases make clear that disclosing consumers' health information for advertising without their affirmative express consent may be an unfair practice. In plain terms: what your privacy policy promises and what your tags transmit have to match.

The Health Breach Notification Rule, 16 CFR Part 318#

The FTC announcement of the amended Health Breach Notification Rule explains that the rule requires vendors of personal health records and related entities not covered by HIPAA to notify individuals and the FTC of a breach of unsecured health data. The 2024 update clarified that a breach of security includes an unauthorised disclosure, not only a hack, and that for breaches involving 500 or more people the FTC must be told at the same time as individuals, no later than 60 calendar days after discovery.

The rule moved again this month. On 9 September 2026 the FTC notice of 9 September 2026 said the Commission had rescinded its 2021 policy statement on breaches by health apps and connected devices, describing it as unnecessary because the 2024 update already covers health apps. That is the withdrawal of a guidance document, and the FTC's notice does not describe any change to the rule text. Whether a given telehealth brand counts as a covered vendor is a legal judgement worth paying for.

Meta pixel HIPAA: what a Texas court left standing#

The HIPAA layer is where the Meta pixel HIPAA question lives, and it applies only to covered entities and their business associates. The HHS Office for Civil Rights tracking technologies bulletin told regulated entities that tracking code on logged-in pages, such as a patient portal or a telehealth platform, generally has access to protected health information. It also said that IP addresses paired with visits to public pages about health conditions could trigger HIPAA.

That second point did not survive. On 20 June 2024, in American Hospital Association v. Becerra, the Northern District of Texas vacated the part of the bulletin covering that situation, and the American Hospital Association reported that HHS withdrew its notice of appeal on 29 August 2024. The HHS page, as read on 20 September 2026, still notes the vacatur and says HHS is evaluating its next steps. The practical reading: the logged-in side of the bulletin remains HHS guidance to regulated entities, the anonymous-page side is gone, and none of it protects a non-HIPAA brand from the FTC. HIPAA marketing rules bind the covered; the FTC Act binds everyone.

States add a layer. The Washington Attorney General on the My Health My Data Act describes the first US privacy law aimed at consumer health data outside HIPAA, enforceable through the state's consumer protection act and by private action. The AP notes that California, Connecticut and Maryland have passed laws protecting health information too, though it reports little enforcement so far.

Platform policy: Meta, Google and where certification sits#

The Meta Business Help Centre says advertisers may not use Meta Business Tools to share information about people that is not allowed under its terms, and lists information about diseases, medical conditions, medical treatments and prescription medication among the examples. It says this must not appear in URL parameters, custom event names or custom audiences, that the advertiser is ultimately responsible for what it shares, and that Meta's systems are not a substitute for the advertiser's own compliance.

On Google, the Google Ads prescription drug services policy says telemedicine providers fall under its rules on prescription drug services, that advertisers must be certified by Google to serve those ads, and that for some certifications a third-party accreditation from bodies such as LegitScript, NABP or G2 may be needed first. The LegitScript healthcare certification page says its certification is recognised by Google, Facebook, Microsoft, LinkedIn and Nextdoor, and its standards require applicants to comply with the laws on protected health information. Our own note on Google Ads healthcare policy and telemedicine covers how certification gates telehealth advertising in more detail.

The wider trail behind telehealth advertising data sharing#

In telehealth advertising, one case is a footprint; a set of them is a trail. The Associated Press report of 19 September 2026 reports that FTC officials have filed similar cases against more than a half-dozen telehealth companies in recent years, naming online therapy provider BetterHelp and pharmacy discount service GoodRx, and that in both regulators said the companies shared users' health data with platforms such as Meta and Google without permission.

The FTC's own announcements carry the numbers. In February 2023 the FTC GoodRx announcement described a proposed order under which GoodRx would pay a $1.5 million civil penalty, the first action under the Health Breach Notification Rule. In March 2023 the FTC BetterHelp announcement described a proposed order requiring $7.8 million to be paid to consumers, and a ban on sharing health data for advertising. Both were proposed orders resolving FTC allegations, and the numbers describe those resolutions, not the Hims matter.

Why does the pattern keep repeating? The AP puts part of the answer in the law. It reports that HIPAA generally applies to medical offices, hospitals and insurers rather than to telehealth companies selling prescriptions, counselling or DNA tests, and quotes a Consumer Reports technology policy director saying there is no clear federal law saying not to do this, just soft law and settled FTC cases many companies may not know about. Whether HIPAA reaches a particular brand depends on facts, so that is a question for counsel, not for a blog.

The same AP piece cites a Yale-led analysis of nearly 50 telehealth companies selling GLP-1 drugs, which found that fewer than a third required a real-time video or audio consultation. That is about clinical process, not advertising, but it shows why regulators study the intake form: sales flow, medical questionnaire and tracking code all meet there.

Two measured pictures of the tracker thicket#

Two dated studies show how normal telehealth advertising tracking was before the current case. They describe the web at the time they were done, not any company today, and neither is about the Hims allegations.

The first is peer-reviewed. A census of US non-federal acute care hospital websites in Health Affairs census of hospital websites (Friedman et al., April 2023) found third-party tracking on 98.6 percent of them, including transfers to large technology companies, social media companies, advertising firms and data brokers.

The second speaks to telehealth directly. In December 2022 The Markup and STAT investigation of December 2022 audited 50 direct-to-consumer telehealth websites. On 13 of the 50 they documented at least one tracker that collected patients' answers to medical intake questions, and trackers on 25 sites told a large platform that a user had added an item such as a prescription to a cart or checked out with a subscription. On 35 sites, trackers sent individually identifying information such as names, email addresses and phone numbers.

The 49 comes from the investigation's own headline. The narrower counts are the ones a media buyer should study, because they map onto the funnel: page view, sign-up, cart, intake. The deeper the tag sits, the more it knows.

Certification is table stakes; the pixel is the exposure#

Here is the folkfox view, and it is an opinion, not a legal one. Certification with LegitScript or Google decides whether your ad account is allowed into the wood. It says nothing about what your tags whisper once you are inside. Every certified telehealth brand can run the same pixel, so in telehealth advertising certification cannot be a moat. It is the price of the ticket.

The exposure lives in the plumbing, and the plumbing belongs to marketing. In the complaint as the FTC describes it, health information travelled through two channels: customer lists shared with ad platforms, and website events sent by tracking technologies. Both are things a growth team sets up in an afternoon and forgets for years. So in telehealth advertising the audience upload is as much in the frame as the pixel, and any custom audience built from a condition or a prescription belongs on the audit list.

There is a real trade-off in telehealth advertising, and we will not pretend otherwise. Ad platforms optimise on the signals they receive, so a leaner data feed can mean weaker optimisation and a pricier prowl for new patients. We cannot put a number on that cost for your account. What we can say is that the alternative cost, a regulator reading your data flows the way the FTC has read this company's, is uncapped and public.

That is why our position on telehealth advertising is a growth model, not a retreat. First-party data you own, server-side collection you control, consent captured before any tag fires, and a hard minimum on what each vendor receives. Brands that build this well will outfox rivals still hiding behind a certificate, because their measurement will survive the next complaint, the next browser change and the next platform policy tweak. The wider shape of this argument, that regulated health brands win on proof rather than reach, runs through our pieces on the CMS ACCESS model and on telehealth rulings from the UK advertising regulator.

What you can still measure, and how#

A healthy telehealth advertising programme keeps a great deal of signal without sending a diagnosis anywhere. The trick is to decide what each system needs to know and to stop there. Nothing in this section is legal advice; take the plan to counsel before you change tags.

Server-side collection is a control point, not a loophole. The Google Tag Manager server-side documentation says a server container runs on a server you control, that only you have access to the data there until you choose to send it elsewhere, and that you decide how the data is shaped and where it is routed. That control is the point: what you forward from the server is still what you disclose.

So what stays measurable? Almost everything a media plan needs. Sessions and sign-ups by channel and campaign, recorded in your own analytics on your own domain. Cost per lead by campaign, with the click identifier stored in your CRM rather than shipped to a platform. Subscription retention, refill rates and support contacts, analysed in your own warehouse. Incrementality through holdout regions or paused audiences, which needs volume totals rather than personal data. If you still send a conversion signal back to a platform, keep it coarse, something like a lead event with no condition, no product, no URL path, and get counsel's sign-off on the payload.

If you run paid search or paid social for a telehealth brand, the practical first move is an audit. Our PPC and paid social teams treat the tag inventory as step one of every healthcare account, before creative, before bids. Comparing your current telehealth advertising stack against the table above is a two-hour job that can save a two-year problem. If you want a second pair of eyes on the trail, start the conversation.

Frequently asked questions#