The FTC Sued a Telehealth Brand Over Its Trackers. Every Femtech Funnel Runs the Same Tags.

TLDR: The Federal Trade Commission’s Hims & Hers complaint traces health signals to ordinary funnel events and a list of ad platforms, so femtech teams must audit what every tag sends after an intake answer.

The complaint reads like an export of a tag manager

On 29 July 2026 the Federal Trade Commission (FTC), joined by Utah and the People of California, sued telehealth provider Hims & Hers on a 2-0 Commission vote¹. The case, FTC et al. v. Hims & Hers Health, Inc., No. 3:26-cv-07871-VC in the Northern District of California, is contested and listed by the FTC as pending². Everything below is an allegation the court has yet to test. For femtech data privacy teams it is also the most detailed public map yet of how health signals reach ad platforms.

The complaint pleads nine counts: three under Section 5 of the FTC Act, three under the Restore Online Shoppers’ Confidence Act (ROSCA), two under California’s False Advertising Law and Unfair Competition Law, and one under Utah’s Consumer Sales Practices Act. The privacy counts rest on promises. Hims advertised treatment handled “privately”, and the plaintiffs allege that it shared consumers’ sensitive health information with Meta and Snap “through at least May 2024”³ without clearly disclosing it.

What makes the filing useful to a marketing team is its level of detail. It names the events, the parameters inside them, the audience labels, the upload volumes and the vendors. Paragraph 77 lists pixels from at least 13 further advertising platforms on the site, among them Microsoft (Bing), Google Ads including its server-to-server (S2S) pixel, Criteo, Pinterest, Reddit, StackAdapt, TikTok’s s2s pixel, The Trade Desk and X. Meta and Snap are recipients in the story and are not defendants. Read as a document type, it is a tag inventory with a legal theory attached.

Hims rejects the case. Its statement says the company is confident in its position and “will vigorously defend ourselves against these baseless claims”⁴, adds that its Privacy Policy lets patients choose how their data is used, and says the suit disregards evidence supplied during a nearly three-year investigation.

Two standard events carried the signal, and one of them fired on intake submit

The complaint describes two routes to Meta, and both start with events every direct-to-consumer health funnel already fires.

The first route is a list. Hims compiled the email addresses of people who created an account to seek a specific treatment, which it tracked as a “Complete Registration” event, and of people who submitted a medical intake, tracked as “Purchase”. Between September 2020 and June 2023 it uploaded about 14 million emails to Meta, and Meta matched about 10 million³ to Meta user identifiers (¶69). Between March 2020 and September 2023 it built 90 Lookalike Audiences. The audience names stated the treatment outright: “All Time Hims ED Purchasers” (ED being erectile dysfunction), “Hers Apollo Signups”. Snap received customer lists the same way, and five of those lists held over a million email addresses³ between them (¶76).

The second route is the pixel and its server-side twin. The complaint says the Meta Pixel and the Conversions API (Meta’s server-side application programming interface) sent the two events “approximately 8 million times”³ (¶71). Each carried identifiers such as email and Internet Protocol (IP) address, plus a custom parameter naming the treatment sought. The Purchase event, by the complaint’s account, triggered whenever a consumer submitted an intake flow (¶73), so the moment a patient finished answering health questions was also the moment an advertising event left the site, carrying parameters called “product_bucket” and “product_type”.

The Conversions API detail matters most for operations. The complaint describes it as a direct connection between the advertiser’s server and Meta’s systems (¶70). A browser consent banner governs what loads in the browser. A server-to-server call leaves from the company’s own infrastructure, so it respects consent only when the server itself checks for it. A team that moves tracking server-side to recover signal lost in the browser can also move it out of reach of the consent control it relies on.

Codewords left the conditions readable. Some audiences used “Apollo”, “Atlas” and “Zeus”, and internal Meta communications cited in ¶69 glossed them as “Apollo (MH),” “Atlas (PEJ),” and “Zeus (ED)”³: mental health, premature ejaculation, erectile dysfunction. The same code names sat in a custom parameter of the Complete Registration event, which the complaint says Meta understood as specific health conditions (¶72).

Femtech funnels carry the sharpest version of the same stack

A limit first. The complaint’s Hers examples concern mental health: a Meta audience called “Hers – Complete Registration – MH – 30d” (¶74) and a Snap list called “All_Time_Hers_Psych_Signups” (¶76). It names no cycle, fertility, pregnancy or menopause data. What follows is Kainjoo’s reading of what the case means for women’s-health companies.

That reading starts from the funnel shape. A cycle, fertility or menopause product asks its most sensitive questions at onboarding, because personalisation depends on them: trying to conceive, cycle irregularity, symptoms, treatment history. The account-creation event and the first paid conversion sit directly after those answers. Those are the Complete Registration and Purchase positions in the Hims complaint. Any femtech funnel whose events carry the onboarding path, the plan chosen or the product line in a parameter carries the same signal the plaintiffs describe, and in a more sensitive category.

A hypothetical fertility onboarding shows how little configuration that takes. Screen three asks what brings the user in, with answers such as trying to conceive, tracking a cycle or perimenopause symptoms. Screen four creates the account, and, in Kainjoo’s reading of Meta’s standard event set, a standard Meta Pixel configuration fires the CompleteRegistration event at that step. If the tag manager passes the page path, say /onboarding/ttc/create-account, or fills the standard content_category parameter with “ttc”, the event leaves with the user’s hashed email and IP address attached. That is the identifier-plus-treatment pairing ¶72 describes. Screen seven sells the paid plan and fires Purchase with content_name set to the plan, so a plan named for conception support tells the platform what the user is trying to do. If the same events also travel through the Conversions API for match quality, they reach the platform a second time, from the server. Every element of that flow comes from standard events, standard parameters and a page-address structure built for analytics. That is why Kainjoo reads the Hims complaint as a femtech document: the configuration it describes is the standard one.

The FTC has already applied its tools to this category twice. In 2021 it finalised an order against Flo Health, whose period and ovulation tracker shared sensitive health data from millions of users with firms including Facebook and Google⁵. In 2023 it moved against Easy Healthcare, maker of the ovulation-tracking app Premom, which it said violated the Health Breach Notification Rule⁶ by sharing health data through embedded software development kits (SDKs).

The rule itself widened in 2024. The amendments, effective 29 July 2024⁷, cover vendors of personal health records outside the Health Insurance Portability and Accountability Act (HIPAA), and define health care services to include any website or app that tracks “fertility, sexual health, sleep, mental health” among other conditions (§318.2(e)). A breach of security now includes an unauthorised disclosure, which reaches a pixel as readily as a hack. The Hims complaint contains no Health Breach Notification Rule count. A cycle or fertility app that qualifies as a personal health record vendor gives a regulator one more instrument than this case used.

Five years of FTC health-data cases trace the same data path

Read side by side, the FTC’s health-data actions describe one route: identifiers plus a health signal, carried by tracking code or uploaded lists, to advertising and analytics platforms. Exhibit 1 lists them.

Two rows explain the rest. GoodRx paid a $1.5 million civil penalty⁸ in the first action under the Health Breach Notification Rule. BetterHelp’s $7.8 million order⁹ concerned email addresses, IP addresses and health questionnaire answers, the same identifier-plus-signal pairing the Hims complaint alleges. Monument gave custom events descriptive titles such as “Paid: Weekly Therapy”¹⁰: the event title named the treatment itself. Cerebral, the FTC said, provided sensitive information of nearly 3.2 million consumers to third parties¹¹, and agreed to pay nearly $5.1 million for partial refunds. Across seven cases, the volume and the vendor list change; in every row, identifiers left the company with a health signal attached.

Read the tag manager the way a regulator would: a seven-point event audit

An earlier Kainjoo .life analysis covered what consent law removes from health marketing measurement. This audit sits one layer down, at the event, and it needs marketing operations and compliance in the same room, because each point needs one side to read the configuration and the other to judge it.

1. Inventory every container and every server-side destination. Browser tags are half the estate. List each Conversions API, S2S pixel, server container and customer-data-platform destination, with the vendor and the owner. Paragraph 77 shows how a regulator counts.
2. Map each event to its parameters after every intake question. For each screen that asks about cycle, fertility, pregnancy, symptoms or treatment, record which events fire next and every parameter they carry, including page path, plan name and product line. Paragraph 71 examines the payload behind the standard event name.
3. Treat customer-list uploads as disclosures. A list built from a health-funnel cohort tells the platform what everyone on it shares. Record each list, its source cohort, its name and its match rate.
4. Read codewords as plain text. Internal names for conditions, product buckets and audiences count as the condition itself once anyone outside the company holds the key. Rename to neutral identifiers, and keep the mapping internal.
5. Gate consent on the server. Every server-side call checks the user’s recorded consent before it sends. A banner governs only the browser. Verify it with a test account: decline consent, complete the intake, then search each destination’s test-event log for anything that arrived from that account. One arrival means the gate is open.
6. Name who signs a new tag. A tag, a new parameter or a new destination goes live with a named marketing owner and a named compliance approver, the way a promotional claim does.
7. Keep a retention and deletion log. For every destination, record what was sent, for how long the vendor holds it, and the date of each deletion request. The Flo order required the company to instruct recipients to destroy data; a log shows that step can be done.

The audit’s output is one register, kept in the same format a regulator’s complaint uses. Each row names a destination, the event, the parameters it carries, the intake screen it follows, the consent check that governs it, the approver and the retention period. Paragraphs 69 to 77 of the Hims complaint read like such a register written from the outside, assembled from the company’s own audience names and event payloads. A team that writes its own register first knows what that outside version would contain, and can remove a parameter, rename an audience or close a destination before the question is asked. Marketing operations owns the facts in each row; compliance owns the judgement on whether the row may stay live. The register also gives the board a single document to review each quarter.

Monday: three actions before the next campaign ships

Export every tag-manager container and every server-side destination, and put both lists in front of compliance this week. Map which events fire after a health intake answer and what each one sends, parameter by parameter. Pause customer-list uploads built from health-funnel cohorts until compliance signs each list off.

The Hims & Hers case will be decided in court, and the company’s defence deserves its hearing. The femtech lesson already stands: the events a regulator reads are standard events that intake funnels commonly fire, and the team that audits them first controls the account of what they sent. Kainjoo .life works with women’s-health brands on the marketing stack this audit examines; talk to Kainjoo .life about an event-level review.

This article has been reviewed by Haider Alleg, Managing Partner at Kainjoo SA.

References

1. Federal Trade Commission. FTC and States Act Against Hims & Hers for Deceptive and Unlawful Privacy Practices. 29 July 2026. https://www.ftc.gov/news-events/news/press-releases/2026/07/ftc-states-act-against-hims-hers-deceptive-unlawful-privacy-practices
2. Federal Trade Commission. Hims & Hers, case page (status: pending). https://www.ftc.gov/legal-library/browse/cases-proceedings/hims-hers
3. FTC, People of the State of California and Utah Division of Consumer Protection v. Hims & Hers Health, Inc., No. 3:26-cv-07871-VC (N.D. Cal.), Complaint, Doc. 28, filed 18 August 2026, ¶¶66–77. https://www.ftc.gov/system/files/ftc_gov/pdf/Hims-Complaint.pdf
4. Hims & Hers Health, Inc. Hims & Hers Responds to FTC Lawsuit. 29 July 2026. https://investors.hims.com/news/news-details/2026/Hims–Hers-Responds-to-FTC-Lawsuit/default.aspx
5. Federal Trade Commission. FTC Finalizes Order with Flo Health, a Fertility-Tracking App that Shared Sensitive Health Data with Facebook, Google, and Others. 22 June 2021. https://www.ftc.gov/news-events/news/press-releases/2021/06/ftc-finalizes-order-flo-health-fertility-tracking-app-shared-sensitive-health-data-facebook-google
6. Federal Trade Commission. Ovulation Tracking App Premom Will be Barred from Sharing Health Data for Advertising Under Proposed FTC Order. 17 May 2023. https://www.ftc.gov/news-events/news/press-releases/2023/05/ovulation-tracking-app-premom-will-be-barred-sharing-health-data-advertising-under-proposed-ftc
7. Federal Trade Commission. Health Breach Notification Rule, Final Rule. 89 FR 47028, 30 May 2024. https://www.federalregister.gov/documents/2024/05/30/2024-10855/health-breach-notification-rule
8. Federal Trade Commission. FTC Enforcement Action to Bar GoodRx from Sharing Consumers’ Sensitive Health Info for Advertising. 1 February 2023. https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising
9. Federal Trade Commission. FTC Gives Final Approval to Order Banning BetterHelp from Sharing Sensitive Health Data for Advertising, Requiring It to Pay $7.8 Million. 14 July 2023. https://www.ftc.gov/news-events/news/press-releases/2023/07/ftc-gives-final-approval-order-banning-betterhelp-sharing-sensitive-health-data-advertising
10. Federal Trade Commission. Alcohol Addiction Treatment Firm will be Banned from Disclosing Health Data for Advertising to Settle FTC Charges that It Shared Data Without Consent. 11 April 2024. https://www.ftc.gov/news-events/news/press-releases/2024/04/alcohol-addiction-treatment-firm-will-be-banned-disclosing-health-data-advertising-settle-ftc
11. Federal Trade Commission. Proposed FTC Order will Prohibit Telehealth Firm Cerebral from Using or Disclosing Sensitive Data for Advertising Purposes, and Require it to Pay $7 Million. 15 April 2024. https://www.ftc.gov/news-events/news/press-releases/2024/04/proposed-ftc-order-will-prohibit-telehealth-firm-cerebral-using-or-disclosing-sensitive-data