KLM-LOG Blog
The Hims & Hers Complaint, Read by a Media Buyer: What to Check in Every Telehealth Account
November 1, 2026 · Joe · 4 min read
Law firms have covered the legal theory of the FTC's case against Hims & Hers in detail. This post covers the ad account. If you run Meta campaigns for telehealth brands, the complaint is close to a checklist of things to look at, whether or not any of it holds up in court.
First, the facts as they stand.
What was filed, and what wasn't decided
On July 29, 2026, the FTC filed a complaint against Hims & Hers in federal court in the Northern District of California. Utah and California (through Los Angeles County Counsel) joined.
The complaint alleges that Hims told consumers their health information was private, then shared condition-related information with advertising platforms. It also includes counts about billing and cancellation practices under ROSCA, the federal law on online subscriptions.
Hims disputes the allegations and has said it will defend itself. Nothing has been proven. Treat everything below as what the government alleges, not as findings.
Two details matter most for anyone running ads:
It's not a HIPAA case. The theory is deception under the FTC Act: the company's privacy promises allegedly didn't match what its website and ad tools actually did. You don't need to be a HIPAA covered entity to have this problem. You need a privacy promise and a data flow that contradicts it.
It's not only about the pixel. According to the complaint, information reached ad platforms through the Meta Pixel, the Conversions API and customer-list uploads. Reporting on the complaint lists trackers from Meta, Snap, Microsoft, Pinterest, Reddit and X. Parts of the public complaint are redacted, including some of the specific fields and audience rules.
That second point is the one agencies should sit with. A lot of telehealth accounts moved to server-side tracking on the assumption that server-side is the safe version. The complaint treats CAPI as another route for the same data. Server-side gives you control over the payload. It doesn't decide what's in it.
What to check in every telehealth account
None of this needs a lawyer to look at. Some of what you find will need a lawyer to decide.
1. Make a complete tag inventory
List every tracker on the site, including the ones loaded through Google Tag Manager and the scripts those scripts load. The complaint describes a long list of tools used for attribution, audience matching, analytics, retargeting and customer engagement. Most brands can't name all of theirs from memory. Load the site in a private window with the network tab open and write down every third-party domain.
2. Find where condition information meets an identifier
Look at what each tracker receives on treatment pages, quizzes, intake steps and checkout. A request that combines a cookie or click ID with a URL or event that names a condition is the pattern regulators have focused on, from GoodRx and BetterHelp to Cerebral, Monument and now Hims.
Things to look for: condition names in URLs, product names in event parameters, quiz answers in custom data, and page titles sent along with page views.
3. Audit audience uploads
Customer-list uploads are named in the complaint alongside the pixel. Ask the client which lists get uploaded to Meta, how each one is built, and whether any list's membership itself implies a condition. "Everyone who bought weight-loss treatment" is a health fact about each person on the list, hashed or not.
4. Read the privacy policy against the network tab
Put the privacy policy and the site's privacy marketing ("private," "discreet," "shared only with your provider") next to what you found in steps 1 through 3. Where they disagree, you've found what this case is about.
5. Check the server-side payload, not just the setup
If the account uses CAPI, look at an actual outbound event payload. What's in custom_data? What's in the event source URL? Is anything condition-specific going out because the server just forwarded what the browser had?
6. Decide who signs off
Most telehealth brands have no one who owns the question "what are we sending to ad platforms?" The agency set up tracking, the developer installed tags, legal wrote the policy, and nobody compared them. Suggest that the client name an owner and review it every quarter.
Where this leaves agencies
I'm not going to speculate about agency liability. Ask your own counsel. The practical point is simpler. When a client's tracking turns out to be the problem, the agency that set it up is in the room, so it's worth being the agency that raised it first.
This is also a reason to offer a tracking review at the start of every telehealth engagement. It's useful to the client, it's a strong first-meeting deliverable, and it surfaces problems before you're the one scaling spend on top of them.
If you want a quick first pass, Kalman's free scanner shows which ad-platform trackers load on a public site and flags pages that look risky, in about a minute. Run it on each telehealth client before the next renewal conversation.
This post is general information, not legal advice. The allegations in the complaint have not been proven.