If your site fires an advertising pixel, four things about every visitor leave your servers: the name your team gave the event, the URL of the page it fired on, whatever parameters you attached, and separately, any customer list you have uploaded for matching. On 29 July 2026 the FTC, Utah and California filed a complaint saying that combination amounted to sharing consumers' health information with Meta and Snap. Nothing in the alleged mechanism is exotic. You can inspect all four surfaces on your own site in about thirty minutes, and the fixes are renames and one flag, not a replatform.
What the complaint describes
The FTC's press release says Hims shared consumers' sensitive health information with advertising platforms in two ways: "by sharing lists of certain customers with those companies", and "via third-party tracking technologies that automatically shared certain 'Events', the actions of visitors on Hims' website, with those companies", while promising to protect patient privacy. The complaint also covers billing conduct, including a cancel button that the FTC says appeared only after a consumer chose "add/remove items from order" and clicked through several more steps before the word "cancel" was visible. The claims cite the FTC Act and the Restore Online Shoppers' Confidence Act, along with Utah and California consumer protection laws. The Commission voted 2-0 to authorise the filing in the Northern District of California, and as the FTC's own note says, the case will be decided by the court. These are allegations.
The reason it matters to a business with nothing to do with telehealth is the word "automatically". An Event is a variable someone on your team named for a dashboard. If the name, or the page it fires on, describes what the person is buying, and what they are buying implies something about their body, their finances or their beliefs, you have built a disclosure pipeline without deciding to.
The four surfaces
| Surface | What it transmits | How it goes wrong |
|---|---|---|
| Event name | The string you chose, on every fire | Custom events named for the funnel: QuizCompleted_Anxiety, TrialStart_Debt |
| Page URL | Full path and query string of the page the event fired on | Descriptive slugs: /treatments/hair-loss/checkout, /programs/bankruptcy/step-3 |
| Event parameters | Product names, categories, values you attach | content_name carrying the product title rather than a SKU |
| Uploaded audiences | Hashed contact details plus, implicitly, why they are on that list | A list called "purchasers, condition X" tells the platform what membership means |
The fourth is the one people forget, because it feels like your data. Membership in a list is itself the signal. Hashing an email address does not change what the list is about.
Renaming without losing the reporting
| Leaking | Replacement | Where the meaning goes |
|---|---|---|
| Event QuizCompleted_Anxiety | Event QuizCompleted, no category parameter | Your own analytics database, keyed by session |
| content_name "Hair Loss Treatment, 3 Month" | content_id "SKU-4471" | Your product table maps the SKU |
| /consult/erectile-dysfunction/checkout | /consult/c4/checkout | A slug map in your CMS, with a redirect from the old path |
| Audience "ED refill buyers" | Broad audience by recency and value only | Segment inside your ESP, which is not an ad platform |
You lose almost nothing in the ad account. Platform optimisation works on conversion counts and values, not on your naming taste. The category detail was always more useful to you than to the auction, and it belongs in the analytics you own, which is the same argument we make about owning your list rather than renting reach.
Thirty minutes, in order
- Open Meta Events Manager, choose your data source, and open Test Events. In a second tab, walk your own funnel from landing page to purchase. Read every event as it arrives and write down the name, the parameters and the page URL attached.
- Repeat for Google with Tag Assistant, walking the same path.
- Search your theme and templates for
fbq(andgtag(. Hand-placed calls added for one campaign three years ago are where the descriptive names usually live. - If you run server-side tracking through the Conversions API, read the payload your own code builds. Nobody reviews that file after it ships.
- List every custom audience you have ever uploaded, in both ad accounts, and ask of each: what does being on this list say about a person?
- Fix the names, add redirects for any path you change, and re-run step one to confirm.
- Read your privacy policy against what you just watched leave the browser. The FTC's theory in this case is a gap between the promise and the pipeline.
The switches the platforms actually give you
Meta documents one control, Limited Data Use, and it is a parameter rather than a checkbox. The names differ by surface: dataProcessingOptions in the pixel's JavaScript, data_processing_options in the Conversions API and App Events API, dpo for an image tag pixel, and setDataProcessingOptions in the mobile SDKs, with data_processing_options_country and data_processing_options_state (or dpoco and dpost) to say where the person is. Meta's own documentation warns that "businesses may notice an impact to campaign performance and effectiveness" when it is on, which is the honest trade.
Google's approach is a restriction rather than a flag. Its personalised advertising policy lists Health as a sensitive interest category, and advertisers in a sensitive category cannot use Customer Match, their own data segments, audience expansion or lookalike segments, because advertiser-curated audiences "may inadvertently contain sensitive user signals". Predefined Google audiences stay available: in-market, affinity, demographics, life events, location and custom segments. Users under 18 are not eligible for personalised advertising at all.
Read those two together and the pattern is clear. The platforms have decided that lists you build are the risky input. If your category is sensitive, the audience-building tactics are the first things to switch off, and broad targeting with good creative is what remains.
Are you in scope?
Two questions. First: could a reasonable person be embarrassed, denied something, or charged more if the fact that they visited this page became known to an employer or an insurer? Second: does the event name, the URL, or the audience title carry that fact on its own, without joining it to anything else? If both are yes, treat the funnel as sensitive, whether or not you think of yourself as a health, finance or legal business. A supplement store, a debt-advice site and a fertility tracker all clear that bar. A tool that sells calendar software does not.
The cheap version of this work is one afternoon of renaming. The expensive version is a complaint that quotes your own event names back at you. Between the two sits the fact that nothing in your ad account gets worse when you send a SKU instead of a product title, which is why this is the rare compliance job with no performance bill attached. Once the pipeline is clean, the more interesting question is how much of your traffic you can still measure at all, which we worked through in measuring your own AI search click loss, and where new demand comes from instead, covered in the free lead channel most local businesses leave empty.
Discussion
Sign in with Google or just a name. No email link, no password to remember.