State Attorneys General Are Joining Federal Pixel Cases: California and Utah in the Hims Complaint

The most structurally significant thing about the FTC's July 2026 complaint against Hims & Hers Health, Inc. is not in the allegations. It is in the caption. The case is styled Federal Trade Commission; The People of the State of California, acting by and through Los Angeles County Counsel Dawyn R. Harrison; and Utah Division of Consumer Protection v. Hims & Hers Health, Inc., filed as Case No. 3:26-cv-7871 in the Northern District of California. Three sovereigns, one complaint, and each of them brought their own statutes.

Curve is a HIPAA-compliant conversion tracking platform that lets healthcare advertisers measure paid campaigns without protected health information ever reaching an ad platform, which is the exposure both federal and state consumer protection regulators are now pursuing.

For a healthcare marketing team, the practical consequence is this: the number of parties who must agree before a matter goes away has gone up, and each additional party brings a separate penalty mechanism that a federal resolution does not automatically extinguish. That changes the arithmetic of risk in a way that a bigger federal number would not.

Everything below describes allegations. Nothing has been proven. Hims has denied the allegations, has said its privacy policy makes clear that users may choose how their data is used, and has said it intends to defend the case.

The Short Version

• California appears as The People of the State of California, acting through Los Angeles County Counsel, bringing claims under the Unfair Competition Law (Bus. & Prof. Code 17200) and the False Advertising Law (17500).
• Utah appears through its Division of Consumer Protection, bringing a claim under the Utah Consumer Sales Practices Act (Utah Code 13-11-4(1)).
• These are independent causes of action, not state versions of the federal counts. They have their own elements, their own remedies, and their own penalty structures.
• A settlement with the FTC does not, by itself, resolve state claims. Peace has to be negotiated with each plaintiff.
• State consumer protection statutes generally support per-violation civil penalties, which scale with the number of affected consumers or transactions rather than with a negotiated lump sum.
• Private class litigation is a fourth track entirely, unaffected by any government resolution.

Who Actually Filed, and Why the Detail Matters

The California entry deserves a closer read than it usually gets. The plaintiff is not the California Attorney General's office. It is The People of the State of California, acting by and through Los Angeles County Counsel. Under California's Unfair Competition Law, public prosecutors other than the state Attorney General, including county counsel and district attorneys, can bring actions in the name of the People. The geographic reach of the office does not limit the caption.

That matters for two reasons. First, it means the set of offices capable of opening a health advertising matter in California is larger than most compliance plans assume. Second, it means a company that has mapped its regulatory relationships to the state AG level has mapped an incomplete picture.

Utah's participation runs through the Division of Consumer Protection, the agency charged with enforcing the Consumer Sales Practices Act. Utah is not a state that appears on most healthcare marketing risk registers. Its inclusion here is a reminder that consumer protection enforcement follows where consumers are, not where the company is headquartered or where its largest markets sit.

Three Statutes, Three Different Questions

The counts are not duplicative. Each state statute asks a somewhat different question of the same facts.

California's Unfair Competition Law

The UCL reaches business acts or practices that are unlawful, unfair, or fraudulent. Those are disjunctive prongs, which is the single most important feature of the statute. A practice can fail the UCL by being unfair even where it is not independently unlawful, and the unlawful prong can borrow a violation of another statute and treat it as a UCL violation in its own right. In a case that already pleads federal counts, that borrowing capacity means the federal theories can do double duty.

California's False Advertising Law

The FAL addresses untrue or misleading statements made in connection with the sale of goods or services. In a case built around published privacy promises, this is the count that maps most directly to the marketing copy. The complaint quotes specific published phrases at paragraph 66, including "100% online, private, and secure", treatment of conditions "privately", "totally private" and "discreet", and notes those claims also appeared in television, radio and podcast advertising. An advertising statute applied to advertising statements is the tightest fit in the complaint.

Utah's Consumer Sales Practices Act

The CSPA provision cited addresses deceptive acts or practices in connection with consumer transactions. Like the California counts, it stands on its own. A Utah consumer's claim does not depend on the FTC prevailing on its Section 5(a) theory, and the Division can pursue relief on the state track regardless of what happens federally.

What a Curve-Style Setup Removes From This Picture

Every one of these statutes, federal and state, is applied to the same underlying facts: what a company said in its marketing, and what data actually left its website for third parties. Curve is built to make the second half of that comparison boring. Events are captured first-party and sanitized on Curve's servers before egress, so the payload delivered to an advertising platform carries conversion signal without carrying identifiers, condition context, page paths that reveal a diagnosis, or intake responses. Each destination is configured separately, so adding a new network does not silently widen what is shared. Curve signs a Business Associate Agreement covering the tracking layer, which puts it inside the compliance perimeter rather than adjacent to it. None of that makes a company immune from scrutiny. It does mean that when three different regulators ask the same question about data egress, there is one documented answer rather than three uncomfortable ones.

Why Multi-Jurisdiction Exposure Changes Settlement Dynamics

Single-plaintiff enforcement has a well-worn resolution path. The agency investigates, the company negotiates, a consent order and a payment figure are announced together, and the matter closes. Multi-plaintiff enforcement breaks that path in several places at once.

Global peace requires everyone

A company cannot settle with the FTC and treat the matter as concluded. California and Utah are separate plaintiffs with separate claims and separate approval processes. Each has its own institutional priorities, its own view of what conduct relief should look like, and its own timeline. A deal that satisfies one may not satisfy another, and the company does not get to pick.

Penalty structures are different in kind

Federal monetary relief and state civil penalties are computed differently. State consumer protection statutes commonly authorize penalties assessed per violation, which means the exposure scales with the count of affected transactions or consumers rather than resolving into a single negotiated figure. When the underlying conduct is a website event firing across a large user base, the multiplier question becomes the whole question. This is the same mechanic that makes private pixel litigation expensive, and our penalty estimator for pixel exposure walks through how per-record math compounds.

Conduct relief can be additive

Injunctive terms from different plaintiffs do not automatically harmonize. A company can end up operating under overlapping obligations with different reporting cadences, different definitions, and different durations. Compliance cost after resolution is often larger than the payment.

The record becomes public earlier

A negotiated matter announced as resolved compresses the factual record into a consent order. A litigated multi-plaintiff case generates filings, motions, and discovery disputes over time, all of which sit on a public docket. That record is available to private plaintiffs, to other state regulators, and to journalists, long before the case ends.

The Fourth Track Nobody Includes in the Count

Three government plaintiffs is not the full exposure map. Private class litigation over web tracking has proceeded on entirely separate theories, including wiretapping statutes and state privacy laws, and it is unaffected by any government resolution. The anatomy of that track is laid out in our breakdown of the Advocate Aurora pixel settlement, and the volume across the sector is visible in the 2024 to 2026 settlement tracker.

State legislatures have also been active in health privacy specifically, and several recent state health privacy laws include enforcement mechanisms that do not depend on any regulator acting at all. The direction of travel is toward more available plaintiffs, not fewer. A company evaluating its exposure should count government enforcement, state statutory claims, private class actions, and where applicable, contractual liability to covered entity partners, as four separate lines rather than one.

What This Means for Compliance Programs

The traditional model, where a healthcare marketing team tracks HIPAA obligations and treats consumer protection law as somebody else's department, does not survive a caption like this one. Practical implications:

• Marketing copy is now legal exhibit material. Every privacy assurance on a landing page, in an ad, in a podcast read, or in a script is a statement a false advertising statute can be applied to. Paragraph 66 shows the FTC and California collecting them across channels, broadcast included.
• Your data flows must match your claims, not the other way around. If the tracking stack cannot support the promise, the promise has to change or the stack does.
• State presence is determined by your consumers. If you ship to a state, you may be answerable to it. Utah's appearance in this case makes that concrete.
• Server-side does not narrow the map. Paragraph 70 of the complaint names the Meta Pixel and the Conversions API together and describes the server-side connection accurately before pleading it. Paragraph 77 lists further integrations including Google Ads S2S and TikTok s2s, alongside Bing, Criteo, Pinterest, Reddit, StackAdapt, The Trade Desk, X and others. Paragraph 76 separately alleges customer list uploads to Snap.
• Audit before someone else does. A 14-point self-assessment and a structured pass at identifying PHI leakage in ad tracking answer the exact factual question all four tracks are built on.

The broader enforcement context is worth keeping in view as well. Our overview of FTC telehealth enforcement actions shows that the multi-plaintiff structure is a development on an established trend rather than an isolated event.

Frequently Asked Questions

Can a county office really sue in the name of an entire state?

Under California's Unfair Competition Law, public prosecutors including county counsel and district attorneys may bring actions in the name of the People of the State of California. In this case the complaint is brought by The People of the State of California acting through Los Angeles County Counsel Dawyn R. Harrison. The office is county-level; the caption is not.

If a company settles with the FTC, do the state claims go away?

Not automatically. California and Utah are separate plaintiffs asserting their own statutes. Resolving the federal counts does not resolve state causes of action unless those plaintiffs agree to release them as part of the same deal. That is why multi-plaintiff matters take longer and cost more to close.

Why Utah?

The Utah Division of Consumer Protection enforces the state's Consumer Sales Practices Act, and consumer protection enforcement generally follows where consumers were affected. States that do not feature prominently in a company's revenue mix can still have standing to act on behalf of their residents.

Does this pattern apply to smaller healthcare organizations?

State consumer protection statutes contain no size threshold. A regional practice or a single-location clinic running paid acquisition is subject to the same deceptive practice provisions as a national brand. The difference is that a smaller organization has less capacity to litigate on four tracks at once.

What is the single most useful thing to do about multi-jurisdiction exposure?

Reduce the underlying factual predicate. All four tracks depend on health-revealing data having reached a third party. If the data never leaves in that form, the theories have less to attach to, regardless of which statute a given plaintiff is using.

This article reflects the public record as of July 2026 and describes the redacted complaint as filed, available at ftc.gov. It is not legal advice. Hims has denied the allegations and intends to defend the case.

The way to shrink exposure across every one of these tracks at once is to stop sending protected health information to ad platforms, without giving up the conversion signal your campaigns run on. That is what Curve does: sanitization before egress, per-destination configuration, and a signed BAA covering the tracking layer. See how it works at curvecompliance.com.