There is a button on an imaging centre’s appointment page that says Schedule your mammogram. Somebody clicks it. Something on that page counts the click and tells somebody else. Ask the practice manager who, exactly, and you will get an honest shrug — the site was built in 2021 by an agency that no longer has the contract, and the tags on it were added by four different people, two of whom have left, none of whom ever met.
That shrug is the whole edition. Hold onto it.
On July 29 the F T C, joined by California and Utah, sued Hims & Hers in the Northern District of California. You saw the headline. It was mostly about subscriptions people could not cancel, and where it touched privacy it named two companies: Meta and Snap. That is accurate. It is also page twenty-six of a forty-eight-page document.
Here is what the government says the sharing actually was.
Contrary to its privacy representations, Hims shared its consumers’ health information with Advertising Platforms by sharing certain “Events”—the actions of website visitors on Hims’ website—with those Platforms.
An Event is a click. A page view. A form step. Not a diagnosis, not a chart note — an action on a website. The F T C’s position is that on a site where the pages are about medical conditions, the action is the health information, because knowing which page somebody was on is knowing what they came for.
Now the paragraph almost nobody quoted. It is paragraph seventy, and it is the one that should stop an agency mid-sentence.
Second, Hims shared consumers’ health information by way of two automated tracking technologies offered by Meta, specifically the Meta Pixel and Conversions API business tools, which Hims placed on the Hims Platforms to track consumers. … The Conversions API is another Meta tracking tool that serves the same purpose of allowing Meta to automatically track Events but operates differently to the extent it creates a direct connection between the advertiser’s server, website, app or other internal software and Meta’s systems. These two tools automatically tracked and disclosed certain Events to Meta.
Read that twice if you have ever sold a client the migration.
For three years the standard remediation in healthcare marketing has been: get off the browser pixel, move to server-side, run the Conversions API, because now you control what is sent. Plenty of that advice was given in good faith and some of it was mine. The complaint puts both tools in one sentence, gives them the same verb, and never distinguishes their liability. “Serves the same purpose.” Server-side is a description of the plumbing. It was never a description of the promise.
And then page twenty-nine, where the list stops being two.
In addition to Meta and Snap, Hims placed pixels from at least the following Advertising Platforms on its website: Microsoft (Bing Pixel and Bing Image Pixel); Google (Google Ads Pixel and Google Ads S2S Pixel); Criteo (Criteo Pixel); MediaBids.com (MediaBids Pixel); PartnerCentric (PartnerCentric Pixel); PebblePost.com (PebblePost Pixel); Pinterest (Pinterest Pixel); Podsights (now known as Spotify Ad Analytics — Podsights_iHeartMedia Pixel); Reddit (Reddit Pixel); StackAdapt (StackAdapt Pixel); TikTok (TikTok s2s Pixel); the Trade Desk (Trade Desk Pixel); and X (formerly known as Twitter — Twitter Pixel).
advertising platforms named in the coverage → advertising platforms named in the complaint → the government’s own hedge, sitting in front of the list
The arithmetic, so nobody has to take it on faith: thirteen companies beyond Meta and Snap, which is fifteen platforms, carrying fifteen separately named pixels — the counts match by coincidence, because Microsoft and Google each account for two. And the F T C had subpoena power, a civil investigative demand outstanding since October 2023, and thirty-three months to work. It still would not write “the following.” It wrote “at least the following.”
Look at the names. Criteo. PartnerCentric. MediaBids — which by its own description sells performance print advertising, paying newspapers and magazines per qualified call or lead. PebblePost, a company whose own site files its writing under Direct Mail. Podsights, for podcast attribution. StackAdapt. Nobody sat in a room and chose fifteen advertising platforms for a telehealth company.
They arrived. One campaign at a time, across years. A retargeting test in some quarter nobody remembers. A podcast buy that needed attribution. An affiliate network that asked for a tag as a condition of the deal. Each one was a reasonable yes on the day. Not one of them was ever a no, because removing a tag has no owner, no ticket and no upside — and the person who added it is at a different company now.
That is not a story about a reckless operator. It is a description of a normal, well-run, growing marketing stack. Which is precisely why I am sending it to you instead of filing it under someone else’s problem.
Paragraph 77 ends by saying that many of these pixels “captured and shared Users’ health information by way of similar pixel tracking events that captured” — and then the public version stops. What those events captured is blacked out. The same happens at paragraphs 68, 69 and 71 through 74, which in the filed copy are numbered and empty. So the single most useful fact for anyone auditing their own site — which Events, named exactly — is the fact the public cannot see. I am not going to guess at it. I am telling you the gap is there so that nobody hands you a confident list of “the events the F T C flagged” and you believe them.
Kept honest, and there is a fair amount to keep honest here. This is a complaint, not a finding. Nothing in it has been proven; the F T C files when it has “reason to believe,” and a court decides. Hims has not answered it yet and I have not seen a response. Every allegation above is an allegation, including all fifteen platforms. The word H I P A A does not appear anywhere in the forty-eight pages. I checked the full text, and I want to be careful about what that does and does not mean: it does not mean H I P A A is irrelevant to your clients — an imaging centre is a covered entity and Hims’ posture is different — it means this particular case did not need it. The counts are Section 5 deception and R O S C A, which reach anyone who made a promise, covered entity or not. I am not your lawyer and this is not a compliance opinion. It is a reading of a public court filing by somebody who has installed a lot of tags. The Conversions API point is mine, not the F T C’s. The complaint puts the pixel and the A P I in one sentence; it does not editorialise about server-side migrations. The inference that this undercuts the standard remediation is my read, and a lawyer could reasonably argue the consent architecture around a server-side implementation changes the analysis. I did not verify the pixels independently — I did not crawl the Hims site, and the complaint describes conduct over a period, not a snapshot of today. PebblePost and MediaBids I described from their own websites, fetched this morning; the complaint itself says nothing about what either company does.
Source, primary, fetched and extracted this morning, August 5, 2026: Complaint for Permanent Injunction, Monetary Judgment, Civil Penalty Judgment, and Other Relief, Federal Trade Commission; The People of the State of California, acting by and through Los Angeles County Counsel Dawyn R. Harrison; and Utah Division of Consumer Protection v. Hims & Hers Health, Inc., Case No. 3:26-cv-07871, United States District Court for the Northern District of California, filed July 29, 2026 — the public redacted copy on the F T C’s own case page, 48 pages, downloaded and text-extracted with pypdf. Source of every passage quoted verbatim above: paragraph 67 (Events shared with Advertising Platforms), paragraph 70 (the Meta Pixel and Conversions API, and the “serves the same purpose” language), and paragraph 77 in full (the thirteen additional companies and fifteen additional named pixels, introduced by “at least the following”). Also the source of: the October 2023 civil investigative demand (paragraph 78); the paragraph 79 bullets on failure to stop, including that any changes came “only after learning of the F T C’s investigation”; the homepage question “How does Hims ensure patient privacy?” and its answer that records and sensitive information “are only accessed by the medical providers managing your care” (paragraph 62); the “100% online, private, and secure process” advertising claim (paragraph 63); the influencer “discreet” claims Hims had final approval over (paragraph 64); the description of the conditions treated as “typically very private” (paragraph 61); the statutory basis, Section 5(a) of the F T C Act, 15 U.S.C. § 45(a), and Section 4 of the Restore Online Shoppers’ Confidence Act, 15 U.S.C. § 8403 (paragraph 1); and Counts I and II as the privacy counts. Case caption, filing date and case number read off the document’s own header stamp, “Case 3:26-cv-07871 Document 1 Filed 07/29/26”. Corroborating, same agency, same day: F T C press release, “F T C and States Act Against Hims & Hers for Deceptive and Unlawful Privacy Practices,” July 29, 2026, fetched with a browser user-agent — source of the 2-0 Commission vote and of the fact that the agency’s own announcement named Meta and Snap and no others. Supporting, each company’s own site, fetched this morning: MediaBids, which describes itself as selling “performance print advertising” paying publishers “for every qualified response (call, lead or sale) the ad generates”; and PebblePost, whose own site files its published content under a Direct Mail topic. Not verified, and flagged in the piece: the redacted passages at paragraphs 68, 69, 71–74 and the tail of 77, which withhold exactly which Events were captured. No trade press supplied any fact in this edition; coverage was not consulted for anything beyond confirming that the two-platform framing was the one in circulation.
There's a button on an imaging centre's appointment page that says "Schedule your mammogram." Someone clicks it. Something on that page counts the click and tells someone else. Ask the practice manager who, exactly, and you'll get an honest shrug. The site was built in 2021 by an agency that no longer has the contract, and the tags on it were added by four different people, two of whom have left, none of whom ever met. Hold onto that shrug. On July 29 the FTC, joined by California and Utah, sued Hims & Hers in the Northern District of California. You saw the headline. Mostly subscriptions people couldn't cancel — and where it touched privacy, it named two companies. Meta and Snap. That's accurate. It's also the top of page 24 of a 48-page document. Here's paragraph 67, verbatim: "Contrary to its privacy representations, Hims shared its consumers' health information with Advertising Platforms by sharing certain 'Events'—the actions of website visitors on Hims' website—with those Platforms." An Event is a click. A page view. A form step. Not a chart note — an action on a website. The FTC's position is that when the pages are about medical conditions, the action IS the health information. Knowing which page someone was on is knowing what they came for. Now paragraph 70, which almost nobody quoted, and which should stop an agency mid-sentence: "...two automated tracking technologies offered by Meta, specifically the Meta Pixel and Conversions API business tools... The Conversions API is another Meta tracking tool that serves the same purpose... These two tools automatically tracked and disclosed certain Events to Meta." Read that twice if you've ever sold a client the migration. For three years the standard remediation in healthcare marketing has been: get off the browser pixel, go server-side, run CAPI, because now YOU control what's sent. A lot of that advice was given in good faith and some of it was mine. The complaint puts both tools in one sentence, gives them the same verb, and never separates their liability. "Serves the same purpose." Server-side describes the plumbing. It was never a description of the promise. And then page 29, where the list stops being two. Paragraph 77, in full: "In addition to Meta and Snap, Hims placed pixels from at least the following Advertising Platforms on its website: Microsoft (Bing Pixel and Bing Image Pixel); Google (Google Ads Pixel and Google Ads S2S Pixel); Criteo (Criteo Pixel); MediaBids.com (MediaBids Pixel); PartnerCentric (PartnerCentric Pixel); PebblePost.com (PebblePost Pixel); Pinterest (Pinterest Pixel); Podsights (now known as Spotify Ad Analytics - Podsights_iHeartMedia Pixel); Reddit (Reddit Pixel); StackAdapt (StackAdapt Pixel); TikTok (TikTok s2s Pixel); the Trade Desk (Trade Desk Pixel); and X (formerly known as Twitter - Twitter Pixel)." Thirteen more companies. Fifteen more named pixels. Fifteen platforms in all, not two — and the two counts matching is a coincidence, because Microsoft and Google each brought two. Now look at the two words sitting in front of the list. Not "the following." AT LEAST the following. The FTC had subpoena power. It had a civil investigative demand outstanding since October 2023 and thirty-three months to work. It still wouldn't commit to having found them all. Now look at the names. Criteo. PartnerCentric. MediaBids, which by its own description sells performance PRINT advertising and pays newspapers per qualified call. PebblePost, whose own site files its writing under Direct Mail. Podsights, for podcast attribution. Nobody sat in a room and chose fifteen advertising platforms for a telehealth company. They arrived. One campaign at a time, over years. A retargeting test in a quarter nobody remembers. A podcast buy that needed attribution. An affiliate network that asked for a tag as a condition of the deal. Every one of them was a reasonable yes on the day. Not one was ever a no — because removing a tag has no owner, no ticket, and no upside, and the person who added it works somewhere else now. That's not a reckless operator. That's a description of a normal, well-run, growing marketing stack. Which is why I'm not filing this under someone else's problem. The transfer to your clients is uncomfortable and it's direct. Hims sells for ED, hair loss and mental health — the complaint calls those "typically very private medical conditions." A radiology group isn't selling those. But it has pages titled lung cancer screening, breast MRI, low-dose CT, and a scheduling form at the bottom of each one. Under this theory the page identifies the condition and the Event identifies the visitor. Nothing in that mechanism cares whether the client is a telehealth startup or a forty-year-old imaging practice. And here's the part I most want you to take away: what made it a violation wasn't the tags. It was the promise. Counts I and II are deception counts. The evidence is the company's own copy. Until late August 2023 the Hims homepage carried a question — "How does Hims ensure patient privacy?" — answered with the assurance that medical records and sensitive information "are only accessed by the medical providers managing your care." The complaint also lifts "100% online, private, and secure process" out of the ads, and the word "discreet" out of paid influencer posts the company had final approval over. Somebody wrote all of that to convert. It's an exhibit now. So the work this week isn't a legal review. It's an inventory. Every third-party tag firing on your client's condition pages and appointment forms, listed with a name beside each: who added it, for which campaign, and whether that campaign still runs. Tag Manager gives you most of it; the network tab gives you the rest, including the ones Tag Manager doesn't know about. You're not deciding anything yet. You're ending the shrug. One reason not to put it off. Paragraph 79 lists why the Commission believes Hims is violating or about to violate the law, and one bullet is that "to the extent Hims has changed or stopped any unlawful conduct, they did so only after learning of the FTC's investigation." Another is that it didn't stop when it learned of the investigation. Fixing this is worth the most on the day nobody has asked you about it. It only declines from there. And the sentence I'd actually bring to the client isn't "we need to talk about HIPAA." It's: the federal government just sued a healthcare company over the tracking on its website, the evidence was the answer on its own FAQ page, and I can't currently tell you how many trackers are on yours. That last clause is the true part. It's the part that gets budget. It's the part every agency is tempted to skip. Keeping myself honest, because this one deserves it: This is a complaint, not a finding. Nothing in it is proven. The FTC files when it has "reason to believe" and a court decides; Hims hasn't answered yet. All fifteen platforms are allegations. The word HIPAA does not appear anywhere in the 48 pages. I checked the full text. That doesn't mean HIPAA is irrelevant to your clients — an imaging centre is a covered entity and Hims' posture is different. It means this case didn't need it. The counts are Section 5 deception and ROSCA, which reach anyone who made a promise, covered or not. I'm not your lawyer and this isn't a compliance opinion. It's a reading of a public filing by someone who has installed a lot of tags. The Conversions API point is mine, not the FTC's. The complaint puts the pixel and the API in one sentence; it doesn't editorialise about server-side migrations. A lawyer could reasonably argue the consent architecture around a server-side build changes the analysis. And the most useful fact for anyone auditing their own site — which Events, named exactly — is redacted. Paragraph 77 ends mid-sentence in the public copy, and paragraphs 68, 69 and 71 through 74 are numbered and empty. I'm not going to guess at what's under the black. I'm telling you the gap is there so that when someone hands you a confident list of "the events the FTC flagged," you know they made it up.
A finished, narrated animation of this edition came with your email (MP4, 1080×1350 — sized for LinkedIn and Instagram). Post it as-is.
FIRST SOURCE · one verified original-source finding, composed for one reader · this edition: marketing — for the people who will be asked how many trackers are on the client's site, and would rather find out first