Hims & Hers Health, Inc. (NYSE: HIMS) is a publicly traded direct-to-consumer telehealth company selling ED, hair-loss, mental-health, and GLP-1/weight-loss treatments. Its own 10-K states the company does not consider itself a HIPAA covered entity or business associate for most of its platform, and separately discloses that it relies on cookies and other online tracking technologies for digital marketing, referencing Meta's 2025 restrictions on using health-related data for ad targeting. Apple's App Store privacy label self-declares that health, financial, and other sensitive information linked to a user's identity is used for Developer's Advertising or Marketing and Product Personalization. Andrew Dudum, the CEO, holds majority voting power, making Hims & Hers Health, Inc. a NYSE "controlled company" exempt from several independent-governance requirements. The FTC, joined by Utah and California, filed a still-pending federal lawsuit against Hims & Hers Health, Inc. on July 29, 2026, alleging the company shared consumers' sensitive health information about medical conditions with third-party advertising platforms while claiming to protect consumer privacy, and separately deceived users about billing/cancellation practices; a prior October 2023 FTC Civil Investigative Demand into the company's privacy, advertising, and cancellation practices remains referenced as unresolved in the same filing.
TRACK RECORD
1 ENFORCEMENT ACTION
[2026-07-29]
The FTC's case page for 'Hims & Hers' (Case Status: Pending) states the FTC, joined by Utah and California, filed suit on July 29, 2026 against Hims & Hers Health, Inc. in the Northern District of California, alleging the telehealth provider shared consumers' sensitive health information about medical conditions with third-party advertising platforms despite claiming to maintain consumer privacy, and separately deceived users about billing and cancellation practices. The case is pending and unresolved; this is an allegation, not a finding.
Apple's App Store product page for the Hims app self-declares, per the developer's own submission, that data linked to a user's identity - including Health & Fitness, Health, Financial Info, and Payment Info - is used for Developer's Advertising or Marketing purposes as well as core app functionality and product personalization.
Hims & Hers Health, Inc.'s FY2025 Form 10-K states the company believes that, because of its operating processes, it is not a HIPAA covered entity or business associate for its platform's customers or services, meaning the federal health-privacy floor most consumers associate with a telehealth provider does not, by the company's own assessment, generally apply.
Hims & Hers Health, Inc.'s 10-K confirms its Class A common stock trades on the NYSE under ticker HIMS, and separately discloses that because CEO Andrew Dudum controls more than a majority of total voting power, the company qualifies as a NYSE 'controlled company,' exempt from several independent board and committee requirements.
Hims & Hers Health, Inc.'s 10-K discloses that it uses vendors and other third-party service providers for important aspects of collecting, storing, transmitting, and verifying customer information, including confidential and sensitive information, meaning sensitive customer data routinely passes through outside parties.
Hims & Hers Health, Inc.'s 10-K states that in October 2023 the FTC issued the company a Civil Investigative Demand requesting information about its privacy, advertising, and cancellation practices as part of a non-public investigation, and that as of the filing date the FTC had not communicated any conclusions.
The FTC's case page for 'Hims & Hers' (Case Status: Pending) states the FTC, joined by Utah and California, filed suit on July 29, 2026 against Hims & Hers Health, Inc. in the Northern District of California, alleging the telehealth provider shared consumers' sensitive health information about medical conditions with third-party advertising platforms despite claiming to maintain consumer privacy, and separately deceived users about billing and cancellation practices. The case is pending and unresolved; this is an allegation, not a finding.
Hims & Hers Health, Inc.'s 10-K risk factors disclose that the company relies on cookies and other online tracking and advertising practices for the effectiveness of its digital marketing, and specifically notes that Meta restricted the use of health-related data for ad targeting in 2025 - a first-party acknowledgment of prior reliance on health-linked ad targeting.