Microsoft Bing Pixel and Bing Image Pixel: Named in the FTC's Hims and Hers Complaint

Paragraph 77 of the FTC's July 2026 complaint against Hims & Hers Health, Inc. lists the advertising trackers the agency alleges were placed on the company's platforms. Microsoft appears first, and it appears twice: the Bing Pixel and the Bing Image Pixel. Two separate Microsoft trackers, named individually, in a federal complaint about health data.

That is worth pausing on, because Microsoft Advertising receives a fraction of the compliance scrutiny that Meta and Google receive in healthcare, despite carrying comparable data flows and, in some verticals, a more valuable patient audience. Curve is a HIPAA-compliant conversion tracking platform that lets healthcare advertisers measure Microsoft Advertising and Bing campaigns without protected health information reaching Microsoft's systems.

The case is Case No. 3:26-cv-7871 in the Northern District of California, filed by the FTC alongside the People of the State of California, acting through Los Angeles County Counsel, and the Utah Division of Consumer Protection. Everything here is an allegation and nothing has been proven. Hims has denied the allegations, has said its privacy policy makes clear that users may choose how their data is used, and has said it intends to defend the case.

The Short Version

• Paragraph 77 names two Microsoft trackers, the Bing Pixel and the Bing Image Pixel, in a list that also includes Google, Criteo, Pinterest, Reddit, TikTok, The Trade Desk, and others.
• Microsoft's conversion tracking is built around goals defined by destination URL, which makes the URL itself the payload in a way that surprises people.
• Image-based pixels carry request data without executing JavaScript, so they slip past controls that assume a script tag is the unit of governance.
• Microsoft syndicates ads and audience targeting well beyond bing.com, which extends the surface further than most tracking inventories reflect.
• Bing and Copilot are taking a growing share of healthcare search, so the channel is getting more important at exactly the moment it is getting more scrutiny.
• The audit questions are Microsoft-specific and do not fall out of a Meta or Google review.

What the Complaint Says About Microsoft

Paragraph 77 is a list. After describing the Meta vectors at paragraphs 67 and 70 and the Snap customer list uploads at paragraph 76, the complaint enumerates the other trackers allegedly placed on Hims platforms. Microsoft leads with the Bing Pixel and the Bing Image Pixel. Google follows with the Google Ads Pixel and the Google Ads S2S Pixel. Then Criteo, MediaBids.com, PartnerCentric, PebblePost.com, Pinterest, Podsights, Reddit, StackAdapt, TikTok in its server-to-server form, The Trade Desk, and X.

The list itself carries an argument. The FTC is not describing an isolated misconfiguration on one platform. It is describing a marketing stack where health-related behavior was allegedly routed to more than a dozen commercial destinations at once. Paragraph 67 defines the shared "Events" as "the actions of website visitors on Hims' website," and paragraph 66 quotes the promises the complaint says those disclosures contradicted, including that the service was "100% online, private, and secure" and that conditions would be treated "privately."

What paragraph 77 does not do is treat any platform as lower risk than the others. There is no tier where a smaller ad network gets a pass. The trackers are listed flatly, which is how a regulator sees them.

How Microsoft's Conversion Tracking Actually Works

Microsoft Advertising runs on the Universal Event Tracking tag, a JavaScript tag placed sitewide that pushes events into a queue and reports them back to Microsoft. The tag records page loads by default, with the page URL, the referrer, the user agent, and the request IP going along with each report. Custom events, revenue values, and custom parameters can be layered on top.

The detail that matters most for healthcare is how conversion goals are defined. Microsoft's most commonly used goal type is the destination goal, configured by specifying a URL that a user must reach. You write a rule such as "URL contains" and a fragment of a path, and Microsoft counts a conversion whenever the tag reports a page load matching that rule.

Read that again with a telehealth site in mind. For the rule to work, the tag has to be sending Microsoft the full URL of every page a visitor loads, and you have to be telling Microsoft, in your account configuration, which URL fragment signifies a completed clinical action. If your paths contain condition names, treatment names, or intake step identifiers, the goal configuration is a written explanation of what those paths mean. The comparison against the equivalent setup on Google is drawn out in how Bing conversion tracking differs from Google Ads for HIPAA purposes.

Microsoft also supports auto-tagging with a click identifier appended to landing page URLs, which links a session to a specific paid click, plus offline conversion imports keyed on that identifier, and remarketing lists built from tag activity. Each of those is a separate place where identity and clinical context can converge.

Why the Image Pixel Is Listed Separately

The Bing Image Pixel appears in paragraph 77 as its own item, distinct from the Bing Pixel. Image-based tracking is an older and simpler technique, and it is worth understanding on its own terms because it defeats a category of controls that healthcare teams rely on.

An image pixel is a request for an image resource, usually a transparent one-pixel file, embedded in a page or a message. When the client requests that image, the server receiving the request logs the request. Even with no JavaScript involved at all, that log entry contains the requesting IP address, the user agent, the referring URL of the page that embedded it, and every parameter appended to the image URL itself.

Three consequences follow. First, an image pixel runs where scripts do not, including email, some syndicated placements, and page contexts where a content security policy or a script blocker stops JavaScript. Second, it cannot participate in a consent handshake, because there is no code to check a consent state before the request fires. A script-based tag can be held back by a consent management platform. An image tag in the markup fires when the markup renders. Third, image pixels are frequently placed by hand, directly in a template or a partner-supplied snippet, which means they do not appear in the tag manager inventory that most organizations treat as the authoritative tracking list.

If your tracking audit consists of opening your tag manager and reading the container, you will not find image pixels. You have to read the rendered HTML of your actual pages and inspect outbound requests. A structured method for doing that is in the healthcare pixel audit for identifying PHI leakage.

How Curve Handles Microsoft Advertising Tracking

Curve routes Microsoft conversion data through a sanitization layer instead of letting a tag report directly from the page. Events are collected first-party, then stripped of identifiers and condition context on Curve's servers before anything is transmitted, which means the URL Microsoft receives is not the raw path a patient walked and the parameters are not the ones your product catalog generated. Destinations are configured per platform, so what goes to Microsoft is an explicit decision rather than the default payload a sitewide tag would send. Curve offers a Business Associate Agreement, which puts the vendor handling that data inside the covered entity's compliance perimeter. Microsoft still gets what it needs to attribute and optimize, meaning a conversion occurred, when, and which click it belongs to. Setting the same pattern up across search platforms at once is covered in the HIPAA-compliant conversion tracking setup for Google, Meta, and Microsoft.

Why Microsoft Gets Less Scrutiny Than It Deserves

Compliance attention follows headlines, and Microsoft has not generated them. The pixel litigation wave of the last few years centered on Meta, with Google in second position. Hospital systems that ripped out the Meta Pixel in 2023 frequently left the Microsoft tag in place, not out of a considered judgment but because nobody put it on the list.

Budget share reinforces the blind spot. Microsoft usually runs at a fraction of Google spend in a healthcare account, so it draws proportionally less review time. But data exposure does not scale with budget. A tag reporting every page load reports every page load whether you spend a thousand dollars a month or a hundred thousand.

Meanwhile the channel has been getting more valuable, not less. Bing is the default search engine in Windows and Edge, which skews its user base toward older and less technical searchers, and that skew maps directly onto Medicare-eligible services, joint replacement, cardiac care, senior living, and chronic condition management. For a healthcare advertiser, Microsoft often delivers a demographic that is harder to reach elsewhere, which is precisely the argument for using it and precisely the reason its tracking deserves the same review as Meta's. Channel-specific campaign construction is covered in the Microsoft Ads healthcare campaign setup guide.

Syndication widens the surface

Microsoft Advertising does not stop at bing.com. Search ads are syndicated to partner properties, and the Microsoft Audience Network places ads across MSN, Outlook.com, Microsoft Edge surfaces, and third-party publishers. Audience targeting on that network is built partly from the behavioral signals your tag reports.

The consequence for a healthcare advertiser is that a remarketing list built from a condition-specific page is not just a Bing search targeting asset. It becomes a targeting asset across a display network reaching consumers in inboxes and news feeds. That is the same specificity problem paragraph 74 of the complaint describes, where the FTC alleges Hims "was only able to create audiences with such specificity because it flouted the promises it made to its users." The mechanism is the same regardless of which platform's audience builder produced the segment.

Copilot, AI Search, and Why This Gets More Important

Microsoft's search position is being reshaped by Copilot and by AI answers embedded in Bing results. Healthcare queries are among the highest-volume categories in conversational AI search, because people ask an assistant things they would hesitate to type into a box that autocompletes in front of a colleague.

Two things follow. Advertisers will invest more in the Microsoft ecosystem as AI-mediated search takes share, which means more healthcare tags on more healthcare pages. And AI-surfaced results change what a page has to look like to be cited, which is pushing healthcare organizations to publish more condition-specific content, generating more condition-specific URLs for a tag to report. The visibility side of that shift is covered in the Bing and Copilot healthcare visibility playbook. The compliance side is the article you are reading.

What to Check in Your Microsoft Setup

• Every UET tag ID firing on your domain. Organizations commonly discover two or three, added by different agencies over the years, still reporting to accounts nobody manages.
• Your goal definitions. Open each conversion goal and read the URL rule. Any rule containing a condition, treatment, or medication name is a documented mapping between a path and a clinical meaning, sitting in a Microsoft account.
• Rendered page source, not just the tag manager. Search your templates and partner snippets for image tags pointing at ad domains. Image pixels do not show up in a container audit.
• Remarketing lists and their membership rules. A list defined as "visited a page containing a condition name" is a health-status segment, and syndication carries it beyond search.
• Imported conversions. Microsoft can ingest goals from analytics platforms and offline conversion files. Both paths can carry data the UET tag never touched, and offline imports are keyed on click identifiers that tie back to individuals.
• Query strings on landing pages. Intake and scheduling flows often pass state in the URL. The tag reports the whole URL, including those parameters.
• Consent behavior. Verify what actually happens when a visitor declines. Test it on a real page and watch the network requests rather than trusting the configuration screen.

Frequently Asked Questions

Is the Bing Pixel HIPAA compliant?

No advertising pixel is HIPAA compliant on its own, because compliance is a property of the whole data flow rather than of a tag. Microsoft does not sign a Business Associate Agreement for its advertising products. A Microsoft tag can be part of a compliant setup only when the data reaching Microsoft contains no protected health information, which requires controls between your site and the platform.

What is the Bing Image Pixel, and how is it different from the regular pixel?

It is an image-based tracker rather than a JavaScript one. Instead of a script executing and reporting events, an image request is made and the receiving server logs the IP address, user agent, referring page, and any URL parameters. The practical difference is that it works without JavaScript, cannot be gated by a consent handshake, and does not appear in a tag manager inventory.

Does the complaint say Microsoft did something wrong?

No. The defendant is Hims & Hers Health, Inc. Paragraph 77 lists trackers the FTC alleges were placed on Hims platforms, and the alleged conduct is the advertiser's placement and use of them alongside published privacy promises. Microsoft is not a party. Hims has denied the allegations and intends to defend the case.

We removed the Meta Pixel from our healthcare site. Are we covered?

Probably not, and this complaint is the reason to check. Paragraph 77 names more than a dozen additional trackers, two of them Microsoft's. A Meta-only remediation leaves every other tag reporting the same URLs and the same behavior it was reporting before.

Can we still run Bing ads for condition-specific service lines?

Yes, if the measurement layer is rebuilt so Microsoft learns that a conversion occurred without learning what it was for. In practice that means goals that do not key on clinical URL fragments, sanitized event payloads, remarketing lists that are not defined by condition pages, and no identifiers in outbound requests.

How do I find image pixels that are not in my tag manager?

Load your real pages, including intake and confirmation steps, and inspect the full list of outbound network requests rather than the container configuration. Then grep your page templates, email templates, and any partner-supplied markup for image tags with third-party domains. Both steps are needed, because template-embedded pixels and dynamically inserted ones surface differently.

This article reflects the record as of July 2026 and is based on the redacted complaint e-filed on ftc.gov. The allegations are unproven, and Hims has denied them, stated that its privacy policy makes clear that users may choose how their data is used, and said it will defend the case.

If Microsoft has been the quiet corner of your tracking stack, paragraph 77 is a reasonable prompt to give it the same review your Meta setup got two years ago. Curve keeps Microsoft Advertising measurable for healthcare brands while protected health information stays inside your perimeter. See how it works at curvecompliance.com.