GLP-1 and Weight Loss Advertising After the FTC's Hims and Hers Case

GLP-1 funnels are now the most heavily instrumented advertising in healthcare, and they sell against one of the most revealing categories of personal information a person has. That combination is why the July 2026 FTC complaint against Hims & Hers Health, Inc. should change how weight loss advertisers work, even though the complaint itself is not a GLP-1 case. Curve is a HIPAA-compliant conversion tracking platform that lets weight loss and metabolic health advertisers optimize paid campaigns without sending protected health information to ad platforms.

The suit was filed in the Northern District of California, Case No. 3:26-cv-7871, by the FTC alongside the People of the State of California acting through Los Angeles County Counsel Dawyn R. Harrison and the Utah Division of Consumer Protection. It alleges violations of Section 5(a) of the FTC Act, Section 4 of ROSCA, California's Unfair Competition Law and False Advertising Law, and the Utah Consumer Sales Practices Act, and seeks a permanent injunction, a monetary judgment, and civil penalties. Hims has denied the allegations, has said its privacy policy makes clear that users may choose how their data is used, and has said it intends to defend the case. Nothing has been proven.

We have covered the mechanics of GLP-1 advertising at length elsewhere, including GLP-1 telehealth marketing compliance and the late-2026 platform policy changes at Google and Meta. This article does not repeat that groundwork. It adds the layer that the complaint puts on top of it, which is what happens when a regulator reads your tracking configuration and your ad copy as a single document.

The Short Version

• The FTC and two state enforcers filed suit in July 2026 over alleged sharing of website visitor activity with advertising platforms and over subscription billing practices. The allegations are contested and unproven.
• Weight and metabolic status are among the most inferentially rich data points a person has, because they predict a long list of other conditions. A GLP-1 conversion event carries more downstream meaning than most advertisers assume.
• GLP-1 marketing already operates under tighter platform advertising rules than general healthcare, which pushes advertisers toward heavier first-party measurement and list-based targeting. Both are the vectors the complaint focuses on.
• Paragraph 70 of the complaint names the Conversions API alongside the Meta Pixel and describes server-side transport accurately. Paragraph 77 lists Google Ads S2S and TikTok s2s. Server-side is not a shield.
• The compounding thread is a separate regulatory exposure from the tracking thread, but it lands on the same marketing team and multiplies the scrutiny on the same ad copy.
• The fix is to keep the conversion signal and drop the condition signal, which for a single-category weight loss funnel means changing what leaves your servers, not just what your tags are named.

Why Weight Data Is More Revealing Than Advertisers Treat It

Marketing teams tend to sort health data into a mental hierarchy where mental health and infectious disease sit at the top and weight sits somewhere near fitness. That hierarchy does not match how the information actually behaves.

Body weight and metabolic status are predictive of type 2 diabetes, cardiovascular disease, sleep apnea, joint disease, fertility outcomes, and a range of other conditions. They correlate with income and with insurance status. They are also among the few health attributes that carry heavy social stigma while being partially visible, which is why the category converts on discretion in the first place. When an ad platform learns that a specific device belongs to someone who purchased a GLP-1 prescription, it has not learned one fact. It has learned a cluster.

That is the practical content of paragraph 74 of the complaint, which alleges that the company was able to build audiences with unusual specificity only because it departed from promises about treating conditions privately. The allegation is not that a stray parameter leaked. It is that the granularity of the targeting was itself the evidence of what had been shared. For a weight loss advertiser, that argument is easy to make and hard to rebut, because the audiences are exactly as specific as the complaint describes and they were built on purpose.

The Structural Problem With a Single-Category Funnel

A multi-specialty provider can argue that a conversion event is ambiguous. A dedicated weight loss funnel cannot. If every page on the domain sells one thing, then the fact of a purchase discloses the category with no parameters attached, no URL path detail, and no custom data fields. Sanitizing the event name accomplishes nothing, because the page context supplies the meaning that the event name was hiding.

This is the point most GLP-1 remediation projects get wrong. Teams rename glp1_program_purchase to purchase, strip query strings, remove a data layer variable, and consider the work complete. The referring URL, the domain itself, and the audience membership all still carry the disclosure. Independent clinics competing against the large DTC brands run into the same wall, which we covered in how independent clinics can compete on GLP-1 advertising.

How Curve Handles GLP-1 Conversion Data

Curve is built for exactly this shape of problem. Conversion events are captured first-party on your infrastructure, then sanitized on Curve's servers before anything is forwarded, so the payload that reaches Meta, Google, Microsoft, or another configured destination contains the click identifier and the conversion value but not the identifiers, form content, or page detail that would attach a condition to a person. Because destinations are configured individually, a weight loss advertiser can send a richer signal to a platform where the account structure already isolates the category and a leaner one to a programmatic partner, rather than accepting one global payload. Curve signs a Business Associate Agreement covering the data it processes on your behalf, which matters when the vendor in the middle is holding the event stream that this kind of complaint is about. What Curve cannot do is fix a claim in your ad copy that your operations do not support, and that remains a separate piece of work.

Platform Rules Already Push GLP-1 Advertisers Toward the Riskiest Tools

Weight loss has been a restricted advertising category on the major platforms for years, well before GLP-1 drugs existed. The specifics differ by platform and change often, so treat the current text of each policy as authoritative rather than anything written here, but the general shape has been consistent: age gating, limits on before-and-after imagery and body-image claims, restrictions on targeting people by weight-related interest, and in some cases outright prohibition of certain weight loss product categories. TikTok's restrictions in particular pushed a wave of advertisers to reallocate, which we mapped in what TikTok's GLP-1 ad ban means and where the spend went. Advertisers still running on the platform for adjacent messaging should read how to keep TikTok healthcare campaigns compliant.

Here is the part worth sitting with. When a platform closes off interest-based targeting for a category, advertisers do not stop targeting. They substitute. The substitutes are custom audiences built from customer lists, value-based lookalikes seeded from purchasers, and conversion-optimized campaigns fed by richer event data. Every one of those substitutes is a vector the complaint addresses directly. Paragraph 76 alleges customer list uploads to Snap for matching to Snapchat accounts. Paragraph 77 enumerates a long tail of additional pixels across search, social, programmatic, affiliate, direct mail, and podcast measurement.

So the category most restricted from ordinary targeting has the strongest incentive to lean on precisely the mechanisms now under enforcement scrutiny. That is not an accident of this one case. It is a standing dynamic, and it is the main reason to expect GLP-1 advertisers to be examined next.

The Compounding Thread, and Why It Compounds Your Marketing Risk

The complaint is about privacy and billing. It is not a compounding case, and it should not be described as one. But GLP-1 marketers cannot ignore that they operate under a second regulatory thread at the same time, and the two interact.

After the FDA removed the branded GLP-1 products from its drug shortage list in late 2024 and early 2025, the legal basis for large-scale compounding of those molecules narrowed considerably. Advertisers who had built acquisition around compounded alternatives had to change their offer, their pricing story, and in many cases their entire creative library, quickly. Rapid creative rewrites under commercial pressure are how substantiation problems get created.

The connection to the tracking issue is simple. Section 5 of the FTC Act covers deceptive claims, and a privacy promise is a claim like any other. A team already fielding scrutiny on efficacy claims, personalization claims, or pricing claims is a team whose entire published corpus is being read closely. Paragraph 66 of the complaint quotes marketing phrases including "100% online, private, and secure", treating conditions "privately", "totally private", and "discreet", and alleges they appeared in TV, radio and podcast advertising in addition to the website. If your compounding messaging is already under review, your privacy messaging is in the same file. Our earlier piece on FTC scrutiny of GLP-1 advertising claims covers the substantiation side in more depth.

What to Change This Quarter

A GLP-1 advertiser should be able to work through this list without a large engineering program.

1. Inventory what leaves, not what you installed. Record a real session from ad click to purchase confirmation and list every third-party host that receives a request. Do it on mobile web and in your app as well. Compare the result to paragraph 77's enumeration and check for affiliate, direct mail, and podcast measurement tags that no one on the current team remembers adding.
2. Pull every custom audience in every ad account. For each one, write down the query that built it. Any list whose membership implies a GLP-1 prescription, a weight range, a BMI threshold, or a program enrollment is a disclosure regardless of how the file was hashed.
3. Read the intake questions. Weight loss intake collects height, weight, BMI, comorbidities, and often prior medication history. Check every point where an answer changes a URL, fires a step event, or populates a data layer, and check what each tag does with it.
4. Capture an outbound server-side payload and read the fields. Not the documentation, the actual request body. Paragraph 70 describes the Conversions API accurately and pleads it anyway. If your server container forwards the same identifiers and the same page context, you moved the transport and kept the exposure.
5. Line up your privacy claims against the inventory. Homepage, checkout, app store listing, podcast scripts, influencer briefs, and the privacy policy. Where a claim is broader than the stack, narrow the claim or change the stack.
6. Check the billing half too. The complaint treats privacy and subscription billing as one pattern of conduct, alleging charges for prescription subscriptions before meaningful consent, unclear refill dates, and cancellation mechanisms that were difficult to use. GLP-1 programs are almost all subscriptions. Read your own cancellation flow as a customer.

Frequently Asked Questions

Is the FTC case against Hims and Hers a GLP-1 case?

No. The complaint concerns alleged sharing of website visitor activity with advertising platforms and alleged subscription billing practices. It is relevant to GLP-1 advertisers because the tracking patterns it describes are common in weight loss funnels, not because weight loss products are the subject of the claims. The allegations are unproven and are being contested.

Can we still run conversion campaigns for a weight loss offer?

Yes. Conversion optimization needs a click identifier, a conversion signal, and a value. It does not need the patient's identity, their intake answers, or a page path that names the treatment. Keeping the first set while removing the second is an engineering change to what your servers forward, and it preserves most of the optimization value.

We hash emails before uploading customer lists. Does that solve it?

Hashing addresses transmission, not disclosure. The entire purpose of an upload is to match the hash to a known account, so the platform ends up knowing that a specific user is on your list. If the list is defined by having purchased a weight loss prescription, the match communicates that fact. Paragraph 76 of the complaint alleges this pattern with Snap.

Why would GLP-1 advertisers be a likely next enforcement target?

Because the category combines high paid spend, restricted targeting options that push advertisers toward list uploads and conversion-based optimization, subscription billing models, and health data that supports broad inference. Those factors point at the same practices this complaint describes. That is an assessment of risk, not a prediction about any specific action.

Does a Business Associate Agreement with our tracking vendor make our GLP-1 tracking compliant?

A BAA governs the vendor's handling of the data you give it. It says nothing about what that vendor then forwards to an ad platform that has not signed one. Ask for a field-by-field description of what leaves for each destination, and treat any answer that stays at the level of adjectives as incomplete.

How much attribution accuracy do we lose?

Less than most teams expect, because the fields that carry the legal risk are rarely the fields driving bidding. Expect a short noisy period during the cutover while event naming and deduplication are rebuilt. Compare platform-reported conversions against backend orders daily during that window rather than making budget decisions on partial data.

This article reflects the public record as of July 2026 and describes allegations that have not been proven in court. Platform advertising policies change frequently, so verify the current policy text with each platform before relying on any description here.

If you are advertising a GLP-1 or weight loss program and want conversion data that optimizes campaigns without carrying the condition to the ad platform, see how Curve handles it at curvecompliance.com.