The Reddit Pixel in Healthcare Marketing: What the FTC's Hims and Hers Complaint Shows

Reddit's pixel is technically unremarkable. What makes it worth separating from the other entries in the FTC's list is who is standing on the other end of the ad. Reddit is where people describe symptoms they have not told a physician, ask questions they would not ask under their own name, and read threads from strangers with the same diagnosis at two in the morning. The platform's pseudonymity is not incidental to its value. It is the reason the health content on Reddit is candid.

Reddit appears in paragraph 77 of the FTC's complaint against Hims & Hers Health, Inc., among tracking technologies the agency alleges were placed on the company's websites and transmitted "Events," which paragraph 67 defines as "the actions of website visitors on Hims' website." These are allegations in a case filed in late July 2026 that has not been adjudicated. Hims has denied the allegations, says its privacy policy makes clear that users may choose how their data is used, and intends to defend the case.

Where that leaves advertisers who still want the channel: Curve is a HIPAA-compliant conversion tracking platform that lets healthcare advertisers run and measure Reddit campaigns without sending protected health information to Reddit or any other ad platform.

That candor is what makes conversion tracking on Reddit different in kind, not just in degree. When you retarget a Meta user, you are following someone who visited your site. When you target a Reddit community, you are advertising into a space people entered because they believed they could not be identified there.

The Short Version

• Reddit is named in paragraph 77 alongside Bing, Google Ads, Google Ads S2S, Criteo, Pinterest, Podsights, StackAdapt, TikTok s2s, The Trade Desk and X.
• The Reddit Pixel is a standard event-based tag with advanced matching, and Reddit also offers a Conversions API for server-side delivery. Both send the same conceptual payload.
• Reddit's community targeting lets advertisers buy specific subreddits. A subreddit list can itself encode a clinical inference, which is the exposure paragraph 74 of the complaint describes.
• Pseudonymity on Reddit is a user-facing property, not a technical one. Advanced matching resolves a hashed email to a Reddit account, and Reddit accounts require an email.
• The FTC described Meta's server-side Conversions API accurately in paragraph 70 and pled it anyway, so moving Reddit to CAPI does not change the analysis.
• Reddit remains a strong healthcare channel. The fix is controlling the payload, not abandoning the platform.

One Paragraph of Case Context

The case is Federal Trade Commission; The People of the State of California, acting by and through Los Angeles County Counsel Dawyn R. Harrison; and Utah Division of Consumer Protection v. Hims & Hers Health, Inc., Case No. 3:26-cv-7871, Northern District of California. It pleads FTC Act Section 5(a), ROSCA Section 4, California's Unfair Competition Law and False Advertising Law, and Utah's Consumer Sales Practices Act, and seeks a permanent injunction, a monetary judgment and a civil penalty judgment. Paragraph 66 quotes the published promises: "100% online, private, and secure," conditions treated "privately," an experience that was "totally private" and "discreet." Paragraph 78 notes that Hims' SEC filings had acknowledged privacy and consumer-protection regulatory risk since 2021 and that the FTC issued a Civil Investigative Demand in October 2023. GoodRx settled with the FTC in February 2023 and BetterHelp in March 2023. This one is being litigated, with civil penalties sought and two states as co-plaintiffs.

How Reddit Conversion Tracking Works

The Reddit Pixel is a JavaScript tag that exposes an rdt function. A base call initializes the pixel with an advertiser ID and fires a PageVisit. Subsequent calls fire standard events from a defined set, including ViewContent, Search, AddToCart, Lead, SignUp and Purchase, plus custom events. Each event can carry parameters such as value, currency and item identifiers.

Three parts of the setup are the ones that matter for a healthcare advertiser.

Advanced matching. The pixel can pass a hashed email address, a phone number, or an external identifier you assign, so Reddit can resolve the site visitor to a Reddit account. Reddit accounts require an email at signup, which means a hashed email is a viable join key to a pseudonymous account. This is the mechanism that converts an anonymous browser event into a person-level record on the platform side. Hashing does not change that. A SHA-256 email is a stable identifier, and its whole purpose in this pipeline is to be matched.

The Reddit Conversions API. Server-side delivery sends events from your infrastructure to Reddit's endpoint with an access token, typically with a conversion identifier so the platform can deduplicate against browser-fired events. Advertisers often adopt CAPI to recover signal lost to browser restrictions, which is a legitimate performance motivation and has no bearing on the privacy question unless you also change the payload.

Custom audiences. Reddit supports customer list uploads and lookalike expansion from them. Paragraph 76 of the complaint deals with a comparable practice at a different platform, alleging Hims uploaded customer lists to Snap to match users to Snapchat accounts. Any list of your patients or customers, uploaded anywhere, is a disclosure of the fact that those people are your patients or customers. On a single-condition site, that fact is the diagnosis.

How Curve Handles Reddit Conversion Tracking

Curve collects conversion events first-party from your own domain rather than letting Reddit's tag observe your pages directly. Events are sanitized server-side before egress, so condition-bearing URL paths, intake responses and direct identifiers are stripped or replaced instead of hashed and forwarded, and what reaches Reddit is the conversion signal plus the click context the platform needs to attribute and optimize. Destinations are configured per platform, so a Reddit destination can carry a deliberately narrower payload than a search destination. Curve signs a business associate agreement, which no ad platform offers advertisers, and Reddit is a supported destination alongside the other channels covered in our overview of Curve support for ChatGPT, Reddit, Amazon Ads and Nextdoor.

Why the Reddit Context Raises the Stakes

Every platform in paragraph 77 can receive a conversion event from a condition page. What differs is the surrounding context, and context is what regulators and plaintiffs' lawyers actually argue about.

Reddit's health communities function as support groups with search engines attached. People post detailed symptom histories, medication side effects, dosages, lab values and treatment failures under handles they chose specifically so the post would not follow them. Many of these subreddits are among the largest patient communities that exist for their condition, larger than any clinical registry. That is a genuine public good, and it depends entirely on the belief that participation is not being catalogued.

Now consider the advertiser's side of that. A campaign targeted at a set of condition-specific communities, driving to a landing page for that condition, with a conversion pixel on the intake completion page and advanced matching passing a hashed email, produces a record on the platform that ties a Reddit account to a completed medical intake. Nothing in that chain is unusual. It is the default implementation that any competent agency would ship. It is also, on the FTC's theory, exactly the kind of specificity paragraph 74 objects to: "Hims was only able to create audiences with such specificity because it flouted the promises it made to its users about treating their medical conditions 'privately' or keeping their health information private."

The reason to be careful here is not that Reddit is more dangerous technically. It is that if this ever becomes a narrative in front of a jury or a state attorney general, the Reddit fact pattern tells better than the display network one. Our guide to community-based advertising compliance on Reddit covers how to keep the channel without building that record.

Community Targeting Is Its Own Disclosure Question

Reddit's targeting options include interests, keywords, and communities, meaning specific subreddits. Community targeting is the most effective option in healthcare and the most sensitive.

The mechanics are worth being precise about. When you buy a subreddit, Reddit does not hand you a list of its members. You are buying placement, not data. So targeting alone is not a disclosure from you to Reddit in the way a conversion event is. The problem arrives at the other end of the funnel, when the conversion pixel reports back. At that point the platform holds both facts: this account was reachable in a condition-specific community, and this account converted on a condition-specific page. The advertiser supplied the second fact.

There is a related exposure that is entirely internal. Campaign names, ad group names and audience names are read by agencies, contractors, reporting tools and anyone with dashboard access. An audience labeled after a diagnosis is documentation of an inference about real people, sitting in a system with loose access controls. Rename them. For reach strategies that avoid encoding a condition, see our piece on building lookalike audiences from in-market segments without PHI.

What to Check on Your Reddit Setup

1. Find every page where rdt fires. Open a network panel, filter for Reddit's collection endpoint, and walk the funnel through intake and confirmation. Note every page that produces a request.
2. Read the page URL and referrer being sent. These travel by default. If your paths name conditions, you are transmitting the condition on every page view, before any event parameters are considered.
3. Check whether advanced matching is enabled. Find out whether a hashed email or phone number is attached, and from which pages. Confirmation pages are the ones to look at first.
4. Audit your custom audiences. Look for any customer list ever uploaded. Then look at who has access to the ads account and could upload another one.
5. Rename anything labeled with a condition. Campaigns, ad groups, audiences, conversion events, saved reports.
6. Decide what your consent banner is actually doing. A cookie banner is not a HIPAA authorization, and the two serve different legal purposes. Our explainer on consent management versus HIPAA authorization covers where each one applies.

The Server-Side Question

Teams frequently respond to a finding like this by proposing a move to Reddit's Conversions API. It is a reasonable engineering instinct and an insufficient answer on its own.

Paragraph 70 of the complaint describes Meta's Conversions API as operating differently "to the extent it creates a direct connection between the advertiser's server, website, app or other internal software and Meta's systems." The FTC characterized the mechanism correctly and pled it as a sharing vector regardless. Paragraph 77 separately names Google Ads S2S and TikTok s2s. Across three platforms, the agency treated server-side integrations the same as browser tags.

Server-side delivery is still the right architecture, because it is the only point where you can inspect a payload and remove things before it leaves. That inspection step is the control. The transport is not. This distinction is developed at length in our analysis of whether the Meta Pixel or the Conversions API is HIPAA safe, and it applies to Reddit without modification.

Frequently Asked Questions

Does the FTC complaint say Reddit received health information?

The complaint alleges in paragraph 77 that Reddit tracking code was among the pixels placed on Hims platforms, and alleges more generally that these technologies transmitted visitor actions to advertising platforms. Reddit is not a defendant and is not accused of wrongdoing. These are unproven allegations against Hims, which has denied them and intends to defend the case.

Is the Reddit Pixel HIPAA compliant?

No ad platform pixel is HIPAA compliant by itself, and Reddit does not sign business associate agreements with advertisers. Whether your implementation creates a disclosure depends on what your pages transmit. A pixel firing on a page whose URL names a treatment, with a hashed email attached, is a disclosure regardless of the platform's own health data policies.

Can healthcare brands advertise on Reddit safely?

Yes, and many should. Reddit reaches high-intent patient populations that are hard to reach elsewhere, and the ad units perform well when the creative respects the community. The safety question is about the conversion tracking on your own site, not about the media buy.

Is targeting a health subreddit itself a privacy problem?

Targeting alone does not send Reddit any information about your users, since you are buying placement rather than receiving a member list. The concern arises when conversion events flow back, because the platform can then connect community reachability with a condition-specific conversion. Targeting also creates an internal documentation risk if you name campaigns and audiences after diagnoses.

What is the fastest way to find out whether we have exposure?

Complete a test conversion on your own site with a network panel open and read every outbound request. If a request to Reddit carries a URL naming a condition, or a hashed email from an intake completion page, you have your answer immediately. A structured sweep across all platforms is the right follow-up, and our pixel audit walkthrough lays out the sequence.

This article reflects the public record as of July 2026 and describes allegations that have not been proven. The filing is available as the redacted e-filed complaint on ftc.gov.

If you are advertising a healthcare service on Reddit, the users you are reaching went there specifically because they expected not to be identified. Curve lets you keep the channel and the measurement while protected health information stays on your side of the line, with a business associate agreement in place. See how it works at curvecompliance.com.