Meta Receives Sensitive Health Data from Hims & Hers for Advertising Purposes
What Happened — Federal and state regulators allege that Meta (Facebook, Instagram) obtained users’ sensitive health information—including data about erectile‑dysfunction medication searches—directly from the tele‑health platform Hims & Hers via the latter’s customer‑data‑sharing and automated tracking mechanisms. The FTC, Utah, and California have filed a lawsuit claiming the data were passed to Meta and Snapchat for targeted advertising without a legally valid basis. Hims & Hers argues that users consented through its terms of service, which explicitly permit sharing “sensitive information such as health data or information about your sex life” with advertising partners. Regulators contend that the company’s marketing claims of a “100 % online, private and secure” experience are misleading.
Why It Matters for Trust & Control Assurance — The case spotlights the need for robust consent‑management and privacy‑by‑design controls that can be demonstrated to auditors and regulators.
Who Is Affected — Tele‑health providers, digital advertising platforms, and any organization that processes sensitive health data for marketing.
Recommended Actions
- Review and tighten data‑sharing agreements with third‑party advertisers.
- Implement granular, opt‑in consent mechanisms and retain verifiable consent records.
- Conduct a privacy impact assessment (PIA) focused on health‑data handling.
- Map consent and data‑minimization practices to your audit‑ready control framework.
Source: DataBreachToday
Technical Notes
- Data flow: Hims & Hers → Meta/Snapchat via embedded tracking pixels and API calls.
- No specific vulnerability disclosed; the issue is the lawful basis for sharing.
- Affected data: browsing activity related to erectile‑dysfunction medication, other health‑related queries.