Snap Pixel and Customer List Uploads: The Allegations in the FTC's Hims and Hers Complaint

Paragraph 76 of the FTC's July 2026 complaint against Hims & Hers Health, Inc. describes something most healthcare compliance reviews never look at. The allegation is not that a tag on a web page leaked data. It is that Hims uploaded customer lists to Snap so those customers could be matched to their Snapchat accounts. No browser is involved in that transaction. No cookie banner can intercept it. No tag manager records it.

That is why the customer list vector deserves its own article. It is the least-audited disclosure path in healthcare marketing, it usually runs on a schedule nobody remembers configuring, and the file being uploaded is frequently a direct export of patient records. Curve is a HIPAA-compliant conversion tracking platform that gives healthcare advertisers measurable Snap and social campaigns without protected health information leaving the covered entity, whether through a pixel or through an audience upload.

The case is Case No. 3:26-cv-7871 in the Northern District of California, brought by the FTC together with the People of the State of California, acting through Los Angeles County Counsel, and the Utah Division of Consumer Protection. These are allegations and nothing is proven. Hims has denied them, has said its privacy policy makes clear that users may choose how their data is used, and has said it intends to defend the case.

The Short Version

• Paragraph 76 alleges Hims uploaded customer lists to Snap so users could be matched to Snapchat accounts.
• List uploads bypass consent management platforms entirely, because the disclosure happens server to server from your CRM, not in the visitor's browser.
• Matching works on hashed identifiers, and hashing is what makes matching possible rather than what makes it safe.
• The audience name and the membership criteria can be the disclosure, before any field value is inspected.
• Reverse ETL tools and CRM connectors mean these uploads often run automatically, on a schedule, without a human in the loop.
• Suppression lists and lookalike seeds are the same disclosure wearing a different label.

What Paragraph 76 Alleges, and Why It Is Different

The Meta allegations in this complaint, at paragraphs 67 and 70, concern Events, which the FTC defines as "the actions of website visitors on Hims' website." Those are behavioral signals generated in real time as someone browses. The Snap allegation is a different shape. According to the complaint, Hims uploaded customer lists to Snap to match users to their Snapchat accounts.

A customer list is not behavior. It is a roster. When a telehealth company assembles a list of customers for advertising purposes, the list is drawn from the system that knows who those customers are and what they were prescribed. The segmentation logic that decides who belongs on the list is the sensitive part, and it lives upstream of anything a privacy engineer can inspect in a browser.

Paragraph 74 of the complaint connects the two ideas. The FTC alleges that Hims "was only able to create audiences with such specificity because it flouted the promises it made to its users about treating their medical conditions 'privately' or keeping their health information private." Audience specificity is the output. Customer list uploads are one of the mechanisms that produce it.

How Customer List Matching Actually Works

Snap's audience matching follows the same pattern as every major platform's list product, and understanding the mechanics tells you where the exposure sits.

You start with a file of identifiers, typically email addresses, phone numbers, or mobile advertising identifiers. Before upload, each value is normalized according to published rules, meaning lowercased, whitespace trimmed, phone numbers reduced to digits with a country code. Then each normalized value is hashed with SHA-256. The upload happens either through the ads manager interface or through the marketing API, and increasingly through an automated connector wired into a data warehouse or CRM.

On the platform side, the same normalization and hashing is applied to the identifiers the platform already holds for its own account holders. The two sets of hashes are compared. Where they match, the platform now knows that a specific Snapchat account belongs to a person on your list. Platforms enforce a minimum matched size before the audience becomes usable for delivery, which is a fraud and privacy guardrail rather than a de-identification measure.

Three things follow from those mechanics, and each one matters for healthcare.

First, the hashing is not obfuscation. Deterministic hashing with published normalization exists so that two parties who each hold the same email arrive at the same string. That is the entire function. A value engineered to identify one individual across organizational boundaries is an identifier regardless of whether a human can read it.

Second, the match is the disclosure. Even if the platform learned nothing from the field values, it learned that a particular account holder is a member of a group you defined. If the group is "patients on a weight management protocol" or "refill lapsed, dermatology," the membership fact carries the health information. This is the point people miss when they reason about list uploads as though only the columns matter.

Third, the audience name travels with the audience. Ad accounts are shared with agencies, contractors, and platform support staff. An audience labeled by condition is legible to every one of them, permanently, in an interface that has no relationship to your access controls.

Why This Vector Is the Least Audited in Healthcare Marketing

Almost every healthcare privacy control that exists today was built for the browser. Consent management platforms gate tag firing. Tag managers hold the inventory. Privacy engineers open a network tab and read outbound requests. Session recording tools get masked. All of that machinery watches one door.

Customer list uploads use a different door. The data path runs from a production database or data warehouse, through an export or a sync tool, to a platform API. Nothing about it appears in a browser. A consent banner cannot block it, because the person whose data is moving is not present when it moves. The distinction between what a cookie banner governs and what actually authorizes a health data disclosure is covered in more depth in consent management versus HIPAA authorization, and it is the gap that list uploads fall straight through.

Ownership is the second problem. Pixels belong to marketing, so marketing reviews them. Audience uploads tend to be built once by a growth engineer or a data analyst, wired into a scheduled sync, and then forgotten. The person who set it up may have left. The sync keeps running. When an audit asks "what do we send to ad platforms," the honest answer from the marketing team is often incomplete because the marketing team genuinely does not know.

Modern reverse ETL tooling has made this worse in a quiet way. It is now trivial to define an audience as a warehouse query and sync the result to a dozen ad platforms on a cadence. The query might filter on a prescription table. The sync might have been configured for one platform and later extended to others by a dropdown. Nobody wrote a document. The 14-point self-assessment for healthcare websites is a reasonable starting point, but a list-upload audit has to be run against your data stack, not your site.

What a Curve-Style Setup Does Differently for Audiences

Curve is built on the premise that the ad platform should receive signal and never receive the underlying record. Conversion events are captured first-party and sanitized on Curve's servers before egress, so identifiers and condition context are removed at the boundary rather than trusted to whoever configured the destination. Destinations are configured per platform, which means an integration is an explicit decision with an explicit payload rather than a default that inherits whatever a connector felt like sending. Curve offers a Business Associate Agreement, so the vendor handling the data sits inside the compliance perimeter instead of outside it. The practical consequence for the audience problem is that campaign targeting is driven from signal Curve has already stripped, rather than from an export of the patient roster. If you need to build reach without an identified list, the technique is in building healthcare lookalike audiences from in-market segments without PHI.

Who Runs Snap in Healthcare, and What to Check

Snap is not a general-purpose healthcare channel, but it is a real one for specific categories. Direct-to-consumer telehealth uses it. So do dermatology and acne brands, sexual and reproductive health services, mental health apps, and weight management programs. The common thread is a younger consumer making a self-directed purchase decision, which is exactly the audience Snap delivers and exactly the category where the condition is sensitive.

Snap also runs a browser pixel and a server-side conversions interface of its own, and both deserve the same scrutiny the Meta tools get in this complaint. But the list vector is where the concentrated risk sits, because a single upload can disclose thousands of people at once, while a pixel discloses one visitor at a time.

Here is what to actually pull up.

• Every audience in every ad account, with its name. Read the names as a stranger would. If the name describes a condition, treatment, or clinical status, treat it as a disclosure that already happened.
• The origin of each list. For each audience, identify the query, export, or connector that produced it, and the system it read from. If the source table contains prescription, diagnosis, or intake data, you have your answer.
• Scheduled syncs. Check your reverse ETL tool, CRM, and ecommerce platform for recurring audience pushes. Look at the destination list, not just the ones you remember enabling.
• Suppression and exclusion lists. Uploading a list of existing patients to exclude them from acquisition ads is still uploading a list of existing patients. The intent is defensive. The disclosure is identical.
• Lookalike seeds. A lookalike audience requires a seed. If the seed was a customer list built from clinical criteria, the derived audience inherits the problem.
• Account access. List who can see audience names in each ad account, including agency users and platform representatives.
• Retention and deletion. Determine how long uploaded audiences persist and whether anyone has ever deleted one. Most organizations have never run this process even once.

A vendor agreement does not cure any of this on its own, for reasons laid out in why a BAA alone is not enough under the Security Rule. The controls have to exist in the pipeline.

The Enforcement Context

The FTC has been building toward this for three years. GoodRx settled in February 2023 for $1.5 million. BetterHelp settled in March 2023, ultimately at $7.8 million. Both matters resolved without litigation, and both involved disclosures to advertising platforms. The Hims matter is different in posture: it is being litigated rather than settled, it seeks civil penalties, and two states joined as co-plaintiffs. Paragraph 78 notes that the agency issued Hims a Civil Investigative Demand in October 2023 and that the company's SEC filings had acknowledged privacy and consumer-protection regulatory risk since 2021. Broader agency activity in this space is collected in FTC enforcement actions against telehealth advertisers.

Frequently Asked Questions

Is uploading a customer list to Snap illegal for a healthcare company?

The complaint does not frame it that way. It alleges that Hims uploaded customer lists to Snap to match users to Snapchat accounts, and that this conflicted with published privacy promises. For a HIPAA covered entity, the analysis turns on whether the list constitutes protected health information and whether a permitted use or a valid authorization covers the disclosure. Marketing convenience is not one of the permitted uses.

Does hashing the emails before upload make it safe?

No. Hashing with published normalization rules is what makes cross-organization matching possible in the first place. The value is stable and portable by design, which is the definition of an identifier. It is not readable by a human, and that is a different property from being de-identified.

Our consent banner is fully configured. Does that cover audience uploads?

It does not. A consent management platform governs what runs in a visitor's browser. An audience upload leaves your systems on a schedule, often when the person is not on your site at all, and the CMP has no visibility into it. This is one of the clearest cases where browser-layer consent and lawful authorization are not the same thing.

What about suppression lists, where the goal is to protect patients from seeing ads?

The intent is genuinely better and the data flow is identical. You are still transmitting a set of identifiers that, by construction, describes people with a relationship to your clinical service. Platforms generally offer no mechanism to suppress without first disclosing who to suppress.

How do I find uploads nobody remembers configuring?

Work backward from the platforms rather than forward from your documentation. Open each ad account, list every audience, and for each one trace the upload origin. Then check your reverse ETL and CRM tooling for scheduled destination syncs. The uploads that matter most are almost always the ones missing from the tracking inventory.

Can healthcare advertisers use Snap at all?

Yes, with a measurement layer designed so the platform never receives identified health data. That means no clinical customer lists, no condition-named audiences, sanitized conversion events, and targeting built from context and behavior rather than from patient records. The same architecture applies across social platforms, and the approach used for TikTok healthcare campaigns carries over directly.

This article reflects the record as of July 2026 and is based on the redacted complaint e-filed on ftc.gov. The allegations are unproven. Hims has denied them, stated that its privacy policy makes clear that users may choose how their data is used, and said it will defend the case.

If you cannot currently produce a list of every audience your organization has uploaded to an ad platform, along with the query that built each one, that inventory is the highest-value work available to you this quarter. Curve exists so that campaign measurement and audience building do not require handing patient records to an advertising platform. See how it works at curvecompliance.com.