FTC Accuses Hims of Sharing Health Data With Meta, Snap

The U.S. Federal Trade Commission (FTC) has accused the telehealth company Hims & Hers of violating user privacy by sharing sensitive health information with advertising platforms, including Meta and Snap. The FTC's complaint, filed on June 26, 2024, asserts that Hims & Hers shared this data despite explicit promises to its users that their health information would be kept confidential. This alleged breach involves information related to users' sexual wellness, a particularly sensitive category of personal data.

According to the FTC's filing, Hims & Hers shared data that could reveal users' health conditions, treatments, and other personal health details. This information was reportedly used by Meta and Snap to target advertisements to users. The commission contends that this practice violates the FTC Act, which prohibits unfair or deceptive practices, and potentially the Health Insurance Portability and Accountability Act (HIPAA), though Hims & Hers is not a covered entity under HIPAA, the FTC can still enforce privacy standards under its general authority. The FTC is seeking to permanently prohibit Hims & Hers from further misrepresenting its data privacy practices and to require the company to implement a comprehensive privacy program.

Hims & Hers, which offers a range of telehealth services including prescriptions for conditions related to sexual health, hair loss, and mental wellness, had marketed itself as a secure and private platform for consumers. The company's privacy policy, as cited by the FTC, stated that it would not share protected health information without user consent. However, the FTC's investigation found that the company used tracking technologies and shared data with third-party advertising partners, including Meta, the parent company of Facebook and Instagram, and Snap, the parent company of Snapchat. This sharing allegedly occurred without adequate user consent or anonymization, allowing these advertising platforms to potentially identify individuals and their health concerns.

The FTC's action highlights ongoing concerns about how consumer health data is collected, used, and shared in the digital age, particularly by companies operating in the rapidly growing telehealth sector. The commission's complaint aims to hold Hims & Hers accountable for its alleged deceptive practices and to ensure that consumers can trust the privacy promises made by online health providers. The FTC is seeking remedies that include financial penalties and injunctive relief to prevent future violations. The outcome of this case could set a precedent for how health-related data is handled by direct-to-consumer telehealth services and their advertising partners.