Privacy Policies and Practices: Hims & Hers Enforcement
Most people are familiar with the idea of a privacy policy – the long document we often agree to when signing up for a service or purchasing goods. But what does a privacy policy actually do? In short, it outlines how a business collects, uses and shares personal information. The contents of a privacy policy may depend on the size and function of the business, the sector in which the business operates, and the jurisdictions in which the business is located or does business.
Drafting and publishing the policy is only part of the job though. Businesses also need to also confirm that their actual practices, including the technology operating behind their website, match the promises that they make to their consumers in these policies.
The Federal Trade Commission (FTC) has long warned businesses that if they make privacy representations, they must honor them. The FTC specifically advises companies to review their privacy policies and ensure that their actual practices are consistent with those representations. As the recent FTC lawsuit against Hims & Hers demonstrates, it is imperative that consumers are adequately informed about business practices in a clear and conspicuous manner.
What are the risks of misalignment between business practices and consumer representations?
In the United States, the FTC has the power to enforce the terms of privacy practices via the authority in Section 5 of the FTC Act, which prohibits unfair or deceptive advertising practices. The Commission’s landmark 1999 consent order with the web host GeoCities was the FTC’s first public settlement in the area of internet privacy, and as of 2023, the FTC has brought at least 97 internet privacy cases.
Most recently, in July 2026, the FTC was joined by California and Utah authorities in a lawsuit against the telehealth company Hims & Hers for deceptive and unlawful privacy practices. This lawsuit alleged that the company shared customers’ sensitive health data, including medical conditions, with advertising platforms, despite implying that they keep health information private on their privacy policy.
According to the FTC, some information was shared to third-party advertising platforms through customer lists, while other information was transmitted through third-party tracking technologies; the consumers’ health information was allegedly shared with Meta, Snap and other third parties. In its complaint, the FTC states that Hims & Hers also fails to disclose its billing practices adequately and makes it difficult for consumers to cancel their subscriptions. Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection claims this creates a scenario where “consumers [are] unknowingly locked into recurring subscriptions and the disclosure to third parties of consumers’ most private health information without their consent.”
This case remains pending and the allegations have not been adjudicated. Still, the lesson here is clear: a business’s sharing and selling practices must be accurately disclosed to the consumer via their privacy policy.
This does not mean that businesses need to abandon tracking, analytics, or subscription services. Rather, this case – and many of the other enforcement actions highlighted by the FTC – emphasize an organization’s need to understand what these technologies do before describing their privacy practices to consumers and ensure that privacy policies accurately disclose these practices.
Key Takeaways:
Privacy policies should accurately disclose the business’s privacy practices to the consumer in a clear and conspicuous way. By reviewing both their privacy representations and the technologies behind them, an organization can take steps to ensure their privacy practices are accurate and up to date. Some of these compliance review measures may include:
- Inventorying pixels, cookies, analytical tools, chat-bot features, and other third-party technologies.
- Identifying what personal information each tool may collect or transmit, and who receives it.
- Paying particular attention to sensitive information and data entered into forms, portals and chat features.
- Reviewing vendor configurations and contractual terms governing data use.
- Comparing actual data flows against the company’s privacy policy and other consumer-facing statements.
- Requiring reviews before changing internal business practices that impact personal privacy.
Drafting and publishing a privacy policy may be required under certain state laws. However, this policy – like most privacy and compliance efforts – should not be treated as a one-time task. Websites, vendors and business practices change, and privacy policies should stay in alignment with these changing practices.
