The privacy policy says customer information is protected. The tag manager says it is Tuesday and somebody added three conversion events before lunch.
Those two versions of the business need to meet.
On July 29, the Federal Trade Commission, California, and Utah sued Hims & Hers. The complaint alleges that the telehealth company promised a private and secure process while sharing sensitive health information with advertising platforms. It also alleges immediate subscription charges, unclear refill timing, and a cancellation path that made stopping recurring charges harder than it should have been.
The case is pending. These are allegations, not a court finding. Still, the complaint is useful reading for any marketing team that collects personal information and measures campaigns.
A privacy promise is marketing copy. The pixel, API, customer list, and cancellation flow decide whether the promise is true.
The pixel is only one pipe
Teams tend to say “pixel” when they mean all advertising data movement. That is too narrow.
The FTC complaint alleges several routes: customer lists sent to ad platforms, browser-based pixels, and server-side connections such as Meta’s Conversions API. It names a long list of advertising technologies beyond Meta and Snap.
That matters because removing a browser tag may leave the server event running. Turning off an audience may leave a customer-list sync intact. A consent banner can look tidy while the CRM, call-tracking system, form tool, analytics platform, and ad account continue trading data behind it.
Start the audit with a map, not a policy draft. For every form, booking flow, account page, chat, purchase, and upload, record:
- what the person provides;
- what the page or app infers from the visit;
- which browser tags fire;
- which server events leave your systems;
- which lists or audiences receive the data; and
- how long each destination keeps it.
If nobody can draw that map without opening six old tickets and texting a former vendor, you have found the first problem.
Read the words next to the form
A fifty-page privacy policy does not rescue a clear promise made beside the submit button.
The complaint points to claims such as a “private and secure” process and statements that sensitive information would be accessed only by medical providers. The alleged data sharing sat in direct tension with those assurances.
Pull the actual language from ads, landing pages, forms, app screens, chat scripts, sales emails, and influencer briefs. Compare it with the data map. Watch for absolute words: private, secure, confidential, only, never, anonymous. Those words have a way of wandering into copy while the implementation keeps changing.
This is the same discipline we recommend when teams vet an AI vendor’s targeting claims. The deck, contract, implementation, and public promise should describe the same thing.
Give sensitive pages a default-deny rule
Some pages deserve a stricter tracking standard because the visit itself says something personal. Think treatment interests, financial hardship, legal issues, employee complaints, donor circumstances, or crisis support.
Mark those pages and flows as restricted zones. No advertising endpoint should receive an event, parameter, URL, form field, hashed identifier, or audience membership from that zone until a named reviewer approves the exact purpose and payload.
Do not rely on a friendly event name. A label like lead_complete can still reveal plenty when it travels with a page path, campaign, product category, email hash, or account identifier.
The FTC’s health-information guidance says that sharing health information for advertising without affirmative express consent may be an unfair practice. It also warns that privacy promises must match behind-the-scenes tracking. Health data has specific legal rules, but the operational lesson travels well: collect less, route less, and make sensitive flows prove why every connection exists.
Separate measurement from audience building
“We need it for attribution” can become a permission slip for almost anything. Make the team answer three questions instead:
- What decision will this data change? Name the budget, channel, page, or offer decision.
- What is the least sensitive signal that can answer it? A counted completion may be enough. The form contents probably are not.
- Will the destination use the data for anything else? Measurement, optimization, matching, modeling, and retargeting are different jobs. Treat them that way.
Then document the approved event name, fields, destination, purpose, owner, review date, and removal date. Put that record beside the implementation ticket. A clean UTM naming system helps reporting, but it does not govern the personal data riding through the rest of the stack.
Audit the exit, too
The Hims & Hers complaint is also about charges and cancellation. That belongs in the marketing conversation because acquisition promises do not stop at conversion.
Walk through signup, billing, renewal, cancellation, deletion, and suppression on a phone. Confirm that the date, price, recurring term, and next action are obvious. Test whether a cancellation request actually stops the charge and whether a deletion or opt-out request reaches the CRM, email platform, audience syncs, and support tools.
A lead response system should move interested people forward quickly. It should be equally competent when someone says stop.
Run the audit before the next campaign
Book 90 minutes with marketing, analytics, product or web, privacy or legal, and customer support. Pick one high-value flow. Trace one real test record from the first click through every destination, audience, message, charge, and exit request.
Leave with owners and dates, not a prettier policy:
- remove unneeded tags, fields, and audience syncs;
- rewrite promises that overstate the actual controls;
- block sensitive zones by default;
- document every approved server and browser event;
- test consent, cancellation, deletion, and suppression; and
- repeat the trace whenever a vendor, form, campaign, or data layer changes.
This is an operational checklist, not legal advice. Bring qualified counsel into the decisions that involve consent, health information, state privacy law, retention, breach duties, or contract terms.
The policy still matters. It just cannot be the only person in the room who thinks the data is private.
Need the campaign and the data flow to tell the same story?
We can help map the marketing stack, tighten the public promise, and build a review process your team will actually use.