The TikTok S2S Pixel and Healthcare Data: What the FTC's Hims and Hers Complaint Names

Paragraph 77 of the FTC's complaint against Hims & Hers Health, Inc. does not say TikTok. It says "TikTok (s2s)." The parenthetical is the whole story: the agency specified the server-to-server integration, not the browser pixel, and pled it as one of the technologies that allegedly transmitted "Events," defined in paragraph 67 as "the actions of website visitors on Hims' website," to advertising platforms. Nothing has been proven. Hims has denied the allegations, says its privacy policy makes clear that users may choose how their data is used, and intends to defend the case.

Curve is a HIPAA-compliant conversion tracking platform that lets healthcare advertisers send server-side conversion events to TikTok and other ad platforms with protected health information removed before the data ever leaves their infrastructure.

For the last three years, the standard remediation advice after a pixel finding has been to move the integration server-side. This complaint is the clearest available evidence that the advice was incomplete. In one filing, the FTC names three separate server-side integrations: Meta's Conversions API in paragraph 70, Google Ads S2S in paragraph 77, and TikTok s2s in the same list. It describes the mechanism correctly and treats it as a sharing vector anyway.

TikTok also carries a second and a third layer of complication that the other platforms do not. It has the most restrictive ad policies in the health category of any major platform, and it sits inside an unresolved conversation about where advertiser data lives and who can reach it. All three layers deserve separate handling.

The Short Version

• The complaint names TikTok's server-to-server integration specifically, in paragraph 77, in a list that also includes Google Ads S2S.
• Together with paragraph 70's treatment of Meta's Conversions API, that is three server-side vectors pled in a single complaint. Server-side transport is not being treated as a mitigating factor.
• TikTok's Events API sends a structured payload from your server including hashed identity fields, a click identifier, page URL and event properties. Every one of those fields is a decision you own.
• TikTok restricts health advertising heavily, including prescription products and weight management, so many healthcare advertisers on the platform are already running on narrow policy ground.
• Data residency and platform governance questions add a risk axis that HIPAA does not address and that no ad platform will contract around. TikTok does not sign business associate agreements.
• Server-side is still the correct architecture. It is the only place you can remove data before it leaves. The removal is the control, not the transport.

Why the Parenthetical Matters

Read paragraph 70 and paragraph 77 together and a deliberate pattern appears.

Paragraph 70 names both the Meta Pixel and the Conversions API, and describes the API as operating differently "to the extent it creates a direct connection between the advertiser's server, website, app or other internal software and Meta's systems." That is an accurate description written by someone who understood the architecture. The FTC did not confuse a server integration for a browser tag. It distinguished them, then pled both.

Paragraph 77 then enumerates the other technologies allegedly present on Hims platforms: Microsoft's Bing Pixel and Bing Image Pixel, Google Ads Pixel and Google Ads S2S Pixel, Criteo, MediaBids.com, PartnerCentric, PebblePost.com, Pinterest, Podsights, Reddit, StackAdapt, TikTok (s2s), The Trade Desk and X. Two entries in that list carry explicit server-side markers. The agency could have written TikTok and Google Ads without qualification. It chose to be specific.

The inference available to any healthcare advertiser is direct. The theory of the case is about what information reached an advertising platform, measured against what the company promised consumers in paragraph 66: "100% online, private, and secure," conditions treated "privately," an experience that was "totally private" and "discreet." A promise is broken by the disclosure, not by the protocol that carried it. We wrote at length on why server-side tracking alone is not HIPAA compliance before this filing existed. Paragraph 77 is the citation that argument was missing.

How TikTok's Server-Side Integration Actually Works

TikTok's server-side product is the Events API, and s2s is TikTok's own long-running shorthand for it. Your server sends an authenticated HTTPS request to TikTok's business API endpoint carrying a pixel code, an event name, a timestamp, a deduplication identifier and a payload.

The payload has two parts that matter here.

Context and identity. This is where hashed email, hashed phone, an external identifier you assign, the TikTok click identifier, the TikTok browser cookie value, the visitor IP address and the user agent travel. IP and user agent are ordinarily included to improve match rates. So is the page URL. The identity block is the reason server-side integrations often outperform browser pixels: they can carry richer and more durable identifiers than a browser will surrender.

Properties. Event value, currency, content identifiers, content names and content categories. In ecommerce these fields describe a product. In healthcare they very often describe a treatment, because the content identifier is whatever your site calls the thing the user just signed up for.

Two implementation realities are worth stating plainly. First, most server-side integrations are built by mirroring the browser pixel, because that is the fastest way to get parity and keep deduplication working. The result is that the server payload contains everything the browser payload contained, plus more identity fields. Second, hashing is applied to identity fields by design, and hashing an email does not de-identify it. A SHA-256 email is a stable join key whose entire function is to be matched against a platform's user table. That is a disclosure with an extra step, which is the point our piece on what server-side tracking does and does not fix works through in technical detail.

What a Curve-Style Setup Does Differently

Curve takes over the server-side leg rather than removing it. Conversion events are collected first-party on your own domain, then sanitized on Curve's infrastructure before egress, so condition-bearing URL paths, content identifiers naming a treatment, intake responses and direct identifiers are stripped or replaced rather than hashed and forwarded. What TikTok receives is a conversion event with the click identifier and campaign context it needs to attribute and optimize, and nothing describing the person's health. Destinations are configured per platform, so the TikTok payload can be materially narrower than a search platform's without breaking either one. Curve signs a business associate agreement, which TikTok and every other ad platform decline to do, and which is why the sanitization must happen upstream of the handoff. Our guide to maintaining HIPAA compliance while running TikTok healthcare ads covers the campaign-side companion to this.

TikTok's Health Advertising Restrictions Are a Separate Constraint

Compliance conversations about TikTok tend to collapse two different problems into one. They are genuinely separate and you can fail either independently.

The first is platform policy. TikTok maintains some of the strictest health advertising rules among the major platforms. Prescription products face broad prohibitions, weight management advertising is restricted and age-gated, and health claims in creative are reviewed aggressively. The platform has also moved against GLP-1 and weight loss promotion, which reshaped where that category buys media. Our overview of the GLP-1 advertising restrictions and where that spend went tracks how advertisers responded.

The second is data disclosure, which is what the FTC complaint is about. Policy compliance and data compliance are unrelated. An advertiser can run a perfectly policy-compliant TikTok campaign, approved by review, promoting a non-prohibited service, and still transmit a conversion event that names a treatment. Ad review looks at your creative. Nobody at any platform reviews what your Events API integration sends them, and no platform will tell you that your payload contained something it should not have.

The practical failure mode follows from the restrictions themselves. When creative is constrained, advertisers lean harder on conversion optimization, which means richer event data and more identity matching to keep the algorithm fed. The tighter the policy, the stronger the pull toward exactly the configuration that creates exposure.

The Jurisdictional Layer

TikTok carries a data governance question the other platforms in paragraph 77 do not, and it is worth handling carefully rather than dramatically.

TikTok has been under sustained scrutiny in the United States over where user data is stored and who can access it, and the company has built a US data governance program in response. The specifics have changed repeatedly and will keep changing. That is precisely why it should not be the basis of your planning.

The stable analysis is this. Your obligations as a covered entity or business associate do not adjust based on a platform's corporate structure or the current state of its regulatory negotiations. If protected health information should not go to an ad platform, it should not go to any ad platform. What the jurisdictional question adds is a second-order risk: an ordinary regulatory outcome, a change in corporate ownership, a data localization requirement, or a state enforcement action can force a migration, an audit or a disclosure on a timeline you do not control. Data you never sent cannot become a problem later. Data you sent in 2024 stays sent, and paragraph 78 of the complaint, which cites SEC filings from 2021 and an October 2023 Civil Investigative Demand, is a reminder that regulators read backward.

It is also worth being explicit that a contract does not solve this. TikTok does not offer business associate agreements to advertisers, and even where a BAA does exist, it is a floor rather than a ceiling, as our piece on why a BAA is not enough under the Security Rule explains.

What to Check on a TikTok S2S Integration

1. Get the actual payload. Not the documentation, not the spec, the real request body your server sends on a real conversion. Log one from production, redact it for the review, and read every field.
2. Check the content fields. Content name, content category and content ID are the fields most likely to contain a treatment name, because they were designed to hold product names and someone mapped them faithfully.
3. Check the URL field. Server-side integrations pass the page URL routinely. If your paths encode conditions, this single field carries the disclosure regardless of what else you cleaned.
4. Inventory identity fields. Hashed email, hashed phone, external ID, IP, user agent. Decide deliberately which are necessary for attribution and remove the rest instead of sending everything because the schema allows it.
5. Confirm whether the browser pixel is still live. Many teams add the server integration and never remove the tag, which means two payloads leave for every conversion and the audit only found one.
6. Check who holds the access token. Events API credentials are often issued to an agency. Whoever holds the token can change what is sent without touching your codebase.

Frequently Asked Questions

Does the FTC complaint really single out TikTok's server-side pixel?

Paragraph 77 lists the technology as "TikTok (s2s)," alongside a separately listed "Google Ads S2S Pixel." The complaint distinguishes server-side integrations from browser pixels elsewhere too, most explicitly in paragraph 70 regarding Meta's Conversions API. These remain unproven allegations against Hims, which has denied them and intends to defend the case.

If server-side is not safer, why use it at all?

Because it is the only architecture that gives you a place to intervene. A browser pixel executes in the visitor's browser with access to the page, and you cannot reliably control what it observes. A server integration means every field is explicitly constructed by code you own, which is what makes sanitization possible. The value is the inspection point, not the protocol.

Is TikTok's Events API HIPAA compliant?

No ad platform API is HIPAA compliant on its own, and TikTok does not sign business associate agreements with advertisers. Compliance is determined by what your integration sends. The same endpoint can be used safely or unsafely depending entirely on the payload your server constructs.

Can healthcare companies advertise on TikTok at all?

Many can, within TikTok's advertising policies, which restrict prescription products and weight management advertising and review health claims closely. Whether you can advertise is a policy question answered by TikTok's ad review. Whether your tracking creates a disclosure is a separate question that nobody at TikTok will answer for you.

Does hashing the email before sending it solve the problem?

No. Hashing prevents casual reading of the value and does nothing to prevent matching, which is the field's purpose. If the platform can resolve the hash to an account, and it can, then you have identified a person in connection with a condition-specific conversion. The analysis is the same one we apply to the Meta Pixel and Conversions API question.

What should we do first if we find a problem?

Stop the outbound field that carries the condition, usually the URL or a content field, before you redesign anything. That is a small change that removes most of the exposure immediately. Then rebuild the integration properly, with a sanitization layer between your site and every destination, rather than patching each platform separately.

This article reflects the public record as of July 2026 and describes allegations in a complaint that has not been adjudicated. The filing is available as the redacted e-filed complaint on ftc.gov.

If your remediation plan for pixel exposure was to move everything server-side, paragraph 77 is the reason to revisit it this quarter. Curve gives healthcare advertisers server-side conversion tracking that keeps TikTok and every other destination optimizing on real signal while protected health information stays on your side of the line, with a business associate agreement in place. See how it works at curvecompliance.com.