Web-Tracking Healthcare Data: Regulation and Enforcement Beyond the Scope of HIPAA

In July 2026, the Federal Trade Commission (FTC), joined by the state of Utah and, through the Los Angeles County Counsel, the people of the state of California, initiated legal action against the telehealth and wellness platform Hims & Hers (“Hims”), alleging that the company unlawfully disclosed sensitive consumer health information to third-party advertising companies. The data included web-tracking data that is automatically shared by the Hims website. The FTC contended that these disclosures were inconsistent with the company’s representations regarding privacy and were made without consumers’ meaningful knowledge or informed consent. Thus, the FTC asserted that the disclosure of such data by Hims was a deceptive act or practice in violation of Section 5 of the FTC Act.

The Legal Backdrop

The FTC’s action against Hims is best understood against the backdrop of a much broader regulatory reckoning over the use of pixels, cookies, session replay tools, and other web-tracking technologies in the healthcare sector. Over the past few years, agencies have increasingly signaled that information collected through seemingly routine digital marketing infrastructure can become legally significant when the underlying web page activity reveals something about a person’s health, treatment, or intent to seek healthcare.

In 2022, the U.S. Department of Health and Human Services issued guidance warning that such technologies could violate the Health Insurance Portability and Accountability Act of 1996 (HIPAA), taking the position that web-tracking data for even unauthenticated users constituted protected health information (PHI). In June 2024, after a wave of related lawsuits, a Texas federal judge ruled that this portion of the guidance, as applied to unauthenticated users, was unlawful, concluding that such data for unauthenticated users did not necessarily “relate to” the “individual’s past, present, or future physical or mental health condition” without further indication of the website visitor’s intent for entering the web page. Now, in the absence of HIPAA-applicability, the FTC and states are filling the gaps.

California, for example, has used the California Consumer Privacy Act and related privacy statutes to scrutinize the collection and disclosure of consumer information that is not protected by HIPAA, while the California Invasion of Privacy Act, an older wiretapping statute, has become a vehicle for modern litigation involving pixels and other technologies that allegedly intercept communications or transmit information to third parties. Washington state’s My Health My Data Act takes an even more direct approach by regulating “consumer health data” outside the traditional HIPAA framework. The statute expressly recognizes the gap created by HIPAA’s limited applicability and regulates the collection, sharing, and sale of health-related information that is not protected by HIPAA by a much broader universe of entities. In August 2026, the Washington State Office of the Attorney General published its first Data Privacy Report, which discusses the risk of secondary uses of such data. More than 20 other states similarly restrict businesses from sharing consumer health data — including, in some cases, health inferences — with third-party advertising partners.

Lessons for Health and Wellness Companies

The key takeaway from the Hims action and other recent enforcement activity is that health and wellness companies should closely examine what their advertising integrations may reveal about consumers — not just whether the data shared is facially health-related. According to the complaint, Hims allegedly uploaded hashed customer email addresses (i.e., cryptographic representations of the addresses) to advertising platforms; shared pixel and server-side events tied to registrations and purchases; and created audience segments associated with particular health conditions. Regulators alleged that these practices could reveal sensitive health information, even if no single data point was sensitive on its own, when it revealed that consumers were likely to seek treatment for specific conditions. The complaint also underscores that pseudonyms, abbreviations, or seemingly generic event names may not prevent advertising partners from inferring the underlying health condition.

Although the allegations remain untested, the complaint provides a useful compliance roadmap. Health and wellness companies should review where tracking technologies are deployed, including condition-specific pages, registration flows, intake forms, checkout pages, and confirmation pages; examine both client- and server-side settings to ensure that events do not transmit condition-, treatment-, or product-related information; and scrutinize naming conventions for events, parameters, audiences, and campaigns. Where health-related data is shared with advertising partners, companies should assess whether clear, affirmative opt-in consent is required and confirm that consumer-facing disclosures accurately describe their practices, recognizing that some state laws may impose additional restrictions even with consent. Because tracking configurations change over time, companies should also periodically conduct technical scans and audits to confirm that their practices remain consistent with their disclosures and legal obligations.

The Big Picture

Together, these developments suggest that (1) web-tracking data will be a focus of enforcement and litigation going forward and (2) the future of healthcare privacy regulation may be less about determining whether a particular piece of information qualifies as PHI under HIPAA and more about asking whether the collection or disclosure of that information is permissible under a patchwork of consumer-protection, wiretapping, health data, and comprehensive privacy laws.

The practical implication is significant: Compliance must now account not only for what information is legally classified as PHI but also for what consumers reasonably understand to be private and how third parties may use it. Healthcare companies can no longer view HIPAA as the sole measure of compliance when collecting and sharing information through digital platforms.

* * *

The Goodwin Healthcare team will continue to monitor regulatory and enforcement developments and evolving pathways to compliance in this area. For more information on the issues discussed in this alert, please contact the authors, reach out to Goodwin’s Healthcare Regulatory and Compliance or Digital Health teams, or contact the Goodwin lawyer whom you typically consult.

Explore more coverage of emerging topics of interest to the healthcare industry on our Health Headlines page.