Men's Health and Sexual Wellness Marketing: The Sensitivity Problem the FTC Highlighted

In most of healthcare, a conversion event and a diagnosis are separate things. In men's health and sexual wellness, they are frequently the same thing. When a company sells one category of treatment, a purchase event on that company's site discloses the underlying condition by itself, with no parameters attached and no personal identifiers in the payload. That equivalence is the sensitivity problem, and it sits at the center of the FTC's July 2026 complaint against Hims & Hers Health, Inc. Curve is a HIPAA-compliant conversion tracking platform that lets advertisers in sensitive condition categories measure paid campaigns without sending protected health information to ad platforms.

The case was filed in the U.S. District Court for the Northern District of California, Case No. 3:26-cv-7871, by the FTC together with the People of the State of California acting through Los Angeles County Counsel Dawyn R. Harrison and the Utah Division of Consumer Protection. It pleads counts under Section 5(a) of the FTC Act, Section 4 of ROSCA, California's Unfair Competition Law and False Advertising Law, and the Utah Consumer Sales Practices Act. Hims has denied the allegations, has said its privacy policy makes clear that users may choose how their data is used, and has said it intends to defend the case. Nothing described here has been proven.

This article is about the category problem rather than the company. Erectile dysfunction, hair loss, low testosterone, sexually transmitted infection testing and treatment, mental health, and fertility all share the same structural property, and marketers in those categories need a specific answer to it.

The Short Version

• In a single-condition funnel, the conversion event is the diagnosis. Removing parameters does not remove the disclosure, because the page and the domain supply the meaning.
• Paragraph 74 of the complaint alleges that audiences could be built with unusual specificity only because promises about treating conditions privately were not kept. Specificity is the evidence.
• Paragraph 66 quotes marketing language including "100% online, private, and secure", "totally private", and "discreet", and alleges those promises ran through TV, radio and podcast advertising as well as the website.
• Discretion is the selling proposition in these categories. That makes privacy claims commercially necessary and legally load-bearing at the same time.
• The remedy is not vaguer event names. It is changing what leaves your servers, so the ad platform receives a click identifier and a value without receiving the context that names the condition.
• Enforcement in adjacent sensitive categories, notably mental health, has already established the pattern this complaint extends.

Why the Product Being the Diagnosis Changes Everything

Consider two sites. The first belongs to a multi-specialty clinic. Someone books an appointment, a conversion fires, and an ad platform learns that a person scheduled healthcare of some unspecified kind. That is real information, and it deserves care, but it is not specific.

The second site sells one thing. Every page, every ad, and every landing experience exists to move a visitor toward a single category of treatment. A conversion on that site tells an ad platform that this person is being treated for that condition. The event can be named purchase. The URL can be scrubbed to a bare slash. The data layer can be empty. The disclosure still happens, because the identity of the sender carries it. An advertiser cannot anonymize a fact that the domain itself communicates.

This is why standard pixel hygiene advice underperforms in these categories. Stripping query strings and renaming events is genuinely useful on a multi-service site, where it collapses a specific signal into a general one. On a single-condition site there is no general signal to collapse into. The only variable left is whether the ad platform learns that this particular person converted at all, which means the work has to happen at the level of what identifies the person, not at the level of what describes the event. Our guide to tracking Meta Pixel events safely in healthcare covers the event-level techniques, and they remain worth doing. They are simply not sufficient here on their own.

What the Complaint Says About Audience Specificity

The complaint defines "Events" at paragraph 67 as "the actions of website visitors on Hims' website" and alleges those Events were shared with third-party advertising platforms. Paragraph 70 names both the Meta Pixel and the Conversions API, describing the latter as operating differently to the extent it creates a direct connection between the advertiser's server, website, app or other internal software and Meta's systems. Paragraph 76 alleges customer list uploads to Snap in order to match users to Snapchat accounts. Paragraph 77 lists an extensive set of additional pixels allegedly placed on the platform, spanning search, social, programmatic, affiliate, direct mail, and podcast measurement, including two further server-side vectors.

The sentence that matters most for this category is paragraph 74, which alleges that the company was only able to create audiences with such specificity because it flouted the promises it made to its users about treating their medical conditions privately or keeping their health information private. Read that as a method of proof rather than as rhetoric. The regulator is pointing at the granularity of the targeting and reasoning backward to what must have been shared to produce it. In a sensitive-condition category, that inference is short and easy to draw, because the audiences a performance team builds to hit efficiency targets are exactly as narrow as the argument requires.

How Curve Handles Sensitive Condition Categories

Curve treats the disclosure as a payload problem rather than a naming problem. Events are collected first-party, then processed on Curve's servers where identifiers and condition-revealing context are removed before anything is forwarded, so what reaches Meta, Google, Microsoft, or another configured destination is a click identifier and a conversion value rather than a description of a person and their treatment. Because sanitization happens server-side at egress, it does not depend on a tag manager configuration that a campaign launch can quietly overwrite. Destinations are configured separately for each platform, which lets a single-condition advertiser make different decisions for a search platform, a social platform, and a programmatic partner instead of accepting one payload everywhere. Curve signs a Business Associate Agreement covering the data it handles for you. What it does not do is repair a marketing claim that overstates what your systems do, and that review belongs on your side.

Why Privacy Promises Are So Prominent in This Category

There is a straightforward commercial reason these brands advertise on discretion. The condition categories they serve are ones people historically avoided treating because raising them with a physician in person was uncomfortable. Erectile dysfunction, hair loss, and mental health all have documented gaps between prevalence and treatment. Removing the in-person conversation is the entire value proposition, and privacy is how that value gets expressed in a thirty-second spot.

The result is that privacy language ends up in more places than a legal team typically reviews. Paragraph 66 alleges the promises appeared in television, radio and podcast advertising in addition to published website copy. Podcast and radio scripts are usually written by media buyers or agency creatives against a performance brief, iterated weekly, and never routed to counsel. Influencer briefs and app store descriptions have the same problem. Every one of those becomes a potential Section 5 exhibit if the underlying stack does not match the claim.

This creates an obligation that is genuinely different from a hospital's. A health system that removes a pixel has fixed its problem. A DTC brand in a sensitive category has to fix the pixel and then reconcile the fix against a marketing corpus that spans channels its compliance function has never audited. Both halves are required. The complaint's theory is precisely the distance between them.

The Adjacent Enforcement Record

Mental health is the sensitive category with the longest enforcement history, and it is the clearest guide to how regulators reason about condition disclosure. The BetterHelp matter, which settled in March 2023 for what ultimately reached $7.8 million, turned on the same core idea: users were told their information would be kept private, and the FTC alleged it was shared with advertising platforms anyway. We covered the mechanics in the BetterHelp settlement and what it means for therapy practices and the operational failures in the specific privacy mistakes that produced it. The Cerebral matter followed a similar shape in telehealth, examined in the Cerebral pixel settlement and the telehealth gaps it exposed.

What has changed by July 2026 is posture. GoodRx settled in February 2023. BetterHelp settled a month later. This complaint is being litigated, with civil penalties sought and two state enforcers named as co-plaintiffs. Paragraph 78 addresses knowledge, citing SEC filings since 2021 that acknowledged privacy and consumer-protection regulatory risk, and a Civil Investigative Demand issued in October 2023. Whatever the outcome, the pattern for sensitive-category advertisers is that the enforcement path has moved from negotiated resolutions toward contested litigation with penalty exposure.

A Practical Review for Sensitive Condition Advertisers

The work below is scoped for a marketing team that owns the tags and can get a week of engineering attention.

1. Ask what your domain alone communicates. If the answer is a specific condition, then every third-party request from that domain carries the condition. Start there rather than with a parameter audit, because it changes what the parameter audit needs to accomplish.
2. Record a real session and list every recipient. Ad click through to purchase confirmation, on desktop, on mobile web, and in your app. Compare the list to the enumeration in paragraph 77, which includes affiliate networks, direct mail retargeting, podcast measurement, and demand-side platforms that rarely appear on an internal tag list.
3. Audit custom audiences and every list upload. These do not appear in a network log and are usually created outside engineering. A list built from purchasers of a single-condition product discloses that condition by construction, hashed or not. Paragraph 76 alleges this pattern with Snap. There are workable alternatives, described in building lookalike audiences from in-market segments instead of patient lists.
4. Walk the intake flow. Sensitive-category intake asks explicitly clinical questions, and the answers frequently reach a URL, a data layer, or a step event named after the question. The specific failure modes are catalogued in the leak points in medical intake forms.
5. Collect your privacy claims from every channel. Website, checkout, app store listing, television and radio and podcast scripts, influencer briefs, and the privacy policy. Put them next to the tag inventory in one document and reconcile the two. Absolutes are the highest risk, because they leave no interpretive room later.
6. Read an actual server-side payload. Not the vendor documentation. Paragraph 70 describes server-side transport correctly and pleads it as a sharing vector regardless, so the question is what fields your container is forwarding, not where the request originates.

Frequently Asked Questions

If we remove all custom parameters, is a purchase event still a disclosure?

On a single-condition site, yes. The referring domain and the landing page identify the treatment category, so an event carrying only a click identifier and a value still tells the platform that this person converted on a site that sells one thing. The remedy is to change what identifies the person in the payload, not only what describes the event.

Why is men's health treated as more sensitive than general healthcare marketing?

Because the condition categories are narrow and stigmatized, and because the brands serving them are usually organized around one category. That combination means an ordinary conversion event carries a specific clinical inference. Regulators have treated condition-revealing disclosure as the core harm in this line of cases, which is the theory paragraph 74 of the complaint advances.

Does obtaining user consent solve the problem?

Consent mechanics matter, but the complaint's theory is about the gap between what was promised and what allegedly occurred. A consent banner that permits sharing while your advertising says treatment is totally private creates a contradiction rather than resolving one. Align the claim, the disclosure, and the technical behavior, in that order.

Can we still run retargeting for a sexual wellness product?

Retargeting built on site-visit audiences from a single-condition domain is the highest-risk configuration in this category, because audience membership is the disclosure. Contextual placements, interest and in-market segments the platform builds independently, and broad prospecting fed by sanitized conversion signals are lower-risk approaches that preserve most of the reach.

What does the FTC say about server-side tracking?

Paragraph 70 of the complaint names the Conversions API alongside the Meta Pixel and describes it as creating a direct connection between the advertiser's systems and the platform's. Paragraph 77 separately lists server-to-server implementations for other platforms. The filing describes server-side transport accurately and treats it as a sharing vector, which means the architecture is not itself a defense.

Has the company responded to these allegations?

Yes. Hims has denied the allegations, has said its privacy policy makes clear that users may choose how their data is used, and has stated it intends to defend the case. No court has ruled on any claim, and this article should not be read as suggesting any wrongdoing has been established.

This article reflects the public record as of July 2026 and describes allegations that have not been proven in court. It is general information about advertising and privacy practices rather than legal advice.

If you market treatment in a sensitive condition category and need conversion measurement that does not carry the diagnosis to the ad platform, see how Curve approaches it at curvecompliance.com.