The FTC put ad-platform data sharing back in the dock this week, and it brought company. The Commission, joined by Utah and California as plaintiffs, sued telehealth company Hims & Hers in the Northern District of California, on a 2-0 Commission vote, under the FTC Act and ROSCA — the Restore Online Shoppers’ Confidence Act.
The privacy half of the complaint alleges that Hims & Hers shared sensitive health information with Meta, Snap and other ad platforms, through two routes every operator will recognise: customer lists uploaded for ad targeting, and automated tracking running on its own site — all while promising users privacy protections. The commercial half alleges the subscription playbook regulators have been circling for two years: charging for prescriptions immediately after intake and obstructing cancellations.
Two structural details matter as much as the allegations. The unanimous vote signals that enforcement against health-data flows into ad platforms is not a partisan project that changes with the Commission’s composition. And the presence of two state attorneys general as co-plaintiffs confirms the pattern from recent actions: these cases now travel with state coalitions — and state coalitions do not wind down when Washington changes.
01Why a case against an advertiser lands on publisher desks
The regulatory exposure here sits with the advertiser — not with the platforms that received the data, and not with the publishers who carry the advertiser’s campaigns. But that clean allocation of liability survives only until discovery starts. Pixel-based data flows get mapped end to end in litigation like this: which tags fired, on which pages, carrying which parameters, to which endpoints. Publishers running health, wellness and pharma advertising are on that map, because the same tracking architecture named in the complaint — platform pixels observing user behaviour on commercial pages — runs on publisher sites too.
Consider what a platform pixel on a health-content section can see: URL paths that encode conditions (“/symptoms/,” “/treatment-options/”), article topics, search parameters, sometimes user inputs. A publisher whose diabetes vertical carries advertiser and platform tags is a conduit for data flows of exactly the type this complaint describes — not the defendant, but part of the pipe, and pipes get subpoenaed. “We didn’t know what the tag did” was always a weak answer; in 2026, with the FTC’s health-data enforcement pattern well established, it is closer to an admission than a defence.
The ROSCA half deserves separate attention because publishers increasingly run subscription businesses of their own. Obstructed cancellations drew the same federal complaint as the data sharing did. A publisher whose subscription flow makes cancelling meaningfully harder than signing up carries a version of the exposure its advertisers do — and the FTC has shown it will attach dark-pattern claims to privacy actions rather than filing them separately.
02Why this matters for publishers
| Discovery does not respect liability boundaries | The advertiser is the defendant, but the data flows get mapped end to end, and publisher pages carrying the relevant tags are part of the map. Proximity to a case is expensive even when culpability never attaches. |
|---|---|
| Health-adjacent content is a sensitivity zone, not just a vertical | Enforcement treats data describing conditions, treatments and medications as sensitive regardless of where it was collected. Publisher health sections generate such signals continuously through URLs and context alone. |
| The bipartisan, multi-state structure is the durable part | A 2-0 vote plus two state AGs means this enforcement pattern persists across administrations and multiplies across jurisdictions. Pricing it as a passing political mood would be a mistake. |
| Your own subscription mechanics are in scope | ROSCA claims travelled alongside the privacy claims here. Registration walls and subscription flows with buried cancel paths are the same fact pattern in a different industry. |
The comfortable reading of this case — advertiser's problem, not ours — is accurate about liability and wrong about exposure.
03What publishers should do
04The bottom line
The comfortable reading of this case — advertiser’s problem, not ours — is accurate about liability and wrong about exposure. Health-data enforcement now arrives bipartisan, state-reinforced and built on mapping exactly the pixel infrastructure that runs across commercial publishing. Publishers who carry health and pharma budgets are in the supply chain of these data flows whether they acknowledge it or not, and the difference between the ones who shrug this off and the ones who audit, document and clean up is the difference between reading about the next complaint and appearing in its exhibits.