SALT LAKE CITY (KUTV) — Utah has joined the Federal Trade Commission and California in a lawsuit accusing telehealth company Hims & Hers of sharing consumers’ sensitive health information with advertising platforms despite promising customers a private and secure experience.
Hims & Hers connects patients with online medical providers and pharmacies offering treatments for erectile dysfunction, hair loss, weight loss, anxiety, depression and other conditions.
According to the lawsuit, Hims advertised a “100% online, private and secure process” and told customers their medical records and sensitive information would only be accessed by the providers managing their care.
MORE | Lawsuits
The lawsuit alleges that, behind the scenes, Hims tracked users’ activity on its websites and shared behavioral and health information with third-party advertising platforms, including Meta, the parent company of Facebook, and Snap.
“Hims promised a free consult and private health care. What Utahns actually got was a subscription trap and their most personal health data shipped to advertisers,” Utah Attorney General Derek Brown said. “We’re not letting Hims profit off broken promises.”
The lawsuit says Hims used tracking technologies known as the Meta Pixel and Conversions API.
A pixel is a piece of code embedded on a website that tracks certain actions taken by visitors and sends that information to an advertising platform. The Conversions API allows information to be sent directly from a company’s computer systems to Meta.
The lawsuit alleges the tools automatically sent Meta information about certain actions users took on Hims’ websites. It also claims Hims shared lists of some customers with advertising platforms and used the information to help create highly specific groups for targeted advertising.
Greg Mayer, an expert in medically compliant advertising, said tracking technology is commonly used for online marketing. However, companies handling sensitive medical information must take additional precautions.
“You can collect that data. You can store that data,” Mayer said. “But the second you send it to a noncompliant platform like Meta, because they’re not signing business associate agreements, you are there for violating that patient’s privacy.”
Mayer said lawsuits involving health data highlight how much personal information is collected online and how its use can undermine consumers’ trust.
“It just feels like we’re being attacked on all fronts,” Mayer said. “So, when you see something as intimate and personal as health care, having that happen to you, I think erodes that trust further.”
Salt Lake Resident Justine Trombley said she was surprised by the allegations that a service marketed as private could share customer information with outside companies.
“They tell you it’s private, you know, and then it’s not,” Trombley said. “That’s wild.”
Another resident familiar with Hims said he accepts that data can be unsecure, but believes medical companies should hold themselves to a higher standard.
“With my medical information, I’d be outraged if I found out that they were out selling it or using it, and especially just to target more ads toward me,” he said.
Mayer advised consumers to pay attention to cookie banners and privacy settings on websites and to opt out of data sharing when that option is available.
“They’re there for a reason,” Mayer said. “Try to be mindful of where and who you’re giving your data to.”
The lawsuit also includes separate allegations involving Hims’ subscription model. It claims some customers were enrolled in recurring treatments or refills without clearly understanding what they had agreed to and then had difficulty canceling their subscriptions.
The complaint alleges some customers were charged shortly after completing an online intake form and before receiving the medical consultation they expected. It also claims customers were not always adequately warned about upcoming refills and had to navigate multiple steps to cancel.
In a statement, Hims & Hers denied the allegations, saying the lawsuit disregards evidence the company provided during the FTC’s nearly three-year investigation and does not reflect telehealth industry standards.
The company said its privacy policy allows customers to make choices about how their data is used and that information shared with health care providers is used only to provide care.
“We are confident in our position and will vigorously defend ourselves against these baseless claims,” the company said.
Utah, California and the FTC are asking the court to stop the alleged practices, return money to affected customers, impose civil penalties and require Hims to turn over profits allegedly obtained through unlawful practices.
Anyone who believes they were affected is encouraged to file a complaint with the Utah Division of Consumer Protection at consumerprotection.utah.gov.
_____