FTC Brings Data Privacy Enforcement Against Hims & Hers Health

The FTC is weighing in on data privacy enforcement with a new action targeting Hims & Hers Health, Inc. The regulator alleges that the company’s data-sharing practices make certain marketing statements deceptive. The FTC argues that the telehealth and wellness company publicly touted itself as “private” and “secure.” While these terms were thrown around on the homepage and in advertisements, the company’s privacy policy told a different story. In light of this development, a recent Venable memo discussing the case gives compliance takeaways for companies handling consumer health data:

• “Assess third-party data sharing. Determine whether health data may be shared with analytics or advertising vendors through pixels, SDKs, APIs, or other tracking technologies
• Audit privacy disclosures and choices. Confirm that privacy representations accurately describe third-party sharing practices and clearly identify relevant consumer choices across the entire user experience, including marketing materials, influencer statements, and product interfaces
• Align advertising practices with applicable state privacy requirements. Although not a focus of this action, to reduce enforcement risk, ensure that any choices related to advertising are conspicuously disclosed and otherwise meet state privacy requirements where applicable. Additionally, assess and meet any obligations under state law relating to sensitive data”

The FTC wasn’t alone in bringing this legal action. It was also joined by the attorney general of California and Utah’s Division of Consumer Protection. It is increasingly rare for the federal and state governments to align on policy priorities, particularly in the world of digital technology. The fact that the FTC and California are jointly bringing this case shows that data privacy enforcement enjoys bipartisan support. Companies handling data, particularly sensitive health data, should ensure that consumers are fully informed about any third-party data sharing.