Can the FTC Sue Me Over My Privacy Policy? 

“My privacy policy says customer data stays private. What does my product’s code actually do with it?” 

Most founders never ask that question twice. They write the policy once, ship the product, and move on. That gap is exactly where a funded, scaled company just got sued. 

What the FTC Alleges Happened 

On July 29, 2026, the FTC, joined by Utah and Los Angeles County, sued telehealth company Hims & Hers. The complaint alleges it installed tracking pixels from Meta, Snap, Microsoft, Pinterest, Reddit, and X that shared patients’ health data with advertisers, despite its own promises that data would stay private. 

The Legal Theory Is Simple: Your Promises Define Your Exposure 

The FTC is not alleging that using ad tracking pixels is illegal on its own. The theory is that the company’s own privacy policy promised something its product did not deliver. That mismatch is what allegedly makes the practice deceptive. 

Your risk is not about which tracking tool you use. It is about whether your policy and your product agree. 

This Is Not Just a Health Data Problem 

Health information is especially sensitive, which is likely why this case is getting attention. But the underlying exposure applies to any company: 

• any privacy policy promising data will not be shared with third parties 

• any product that adds analytics, ad pixels, or SDKs after that policy was written 

• any gap between what legal wrote and what engineering shipped 

If your policy makes a promise your code does not keep, you have the same exposure, regardless of industry. 

Who Actually Controls This Risk Inside Your Company 

Marketing and growth teams add pixels and SDKs to hit growth targets. They are rarely thinking about the privacy policy when they do it. That decision happens fast, without legal review, and that is how the gap opens up. 

Common Founder Mistakes 

• Treating the Privacy Policy as a One-Time Document. Founders write a privacy policy at launch and treat it as done. It is a living document. Every time a new pixel, analytics tool, or ad SDK gets added to the product, the policy needs another look. 

• Assuming a Well-Known Tool Is Automatically Compliant. A tracking tool from a major ad platform feels like standard practice, so founders assume it is safe. The FTC’s theory here is that using a standard tool to transmit sensitive data broke the company’s own promises. Popularity is not a compliance defense. 

• Letting Growth Teams Add Tracking Without Legal Review. Marketing and product teams add pixels and SDKs to move fast on growth metrics. Without a legal check on each addition, the business ends up with a live gap between what the policy says and what the code does. 

10-Minute Self-Check 

Before your next product or marketing update, work through this: 

• Do I know every third-party pixel, SDK, and analytics tool currently in my product? 

• Does my privacy policy accurately describe what each of those tools actually does with user data? 

• Have I reviewed my policy since the last time engineering or marketing added a new tool? 

• Do I have a process requiring legal review before a new tracking tool goes live? 

• If my product touches health, financial, or other sensitive data, have I flagged that specifically? 

• Could an investor or acquirer find a mismatch between my policy and my product in diligence? 

If you cannot answer yes to all of these, you are not ready to call your privacy policy accurate yet. 

Bottom Line 

A privacy policy is not paperwork you file away after launch. It is a specific, checkable promise about what your product does with user data. The moment that promise and your actual code diverge, you have exposure, not just to regulators, but to anyone reviewing your business closely. 

Does My Privacy Policy Actually Match What My Product Does? 

Our launch-ready legal package is tailored to your software, your customers, and the way your product actually operates. Schedule a free 30-minute discovery call to discuss your business, your goals, and whether our team can help prepare your product for launch. 

Book here: https://calendly.com/primumlaw/30min