Sensitive Personal Data Sale Disclosure

What it is

The policy explicitly states that Hims & Hers may sell sensitive personal data, including health data and sexual orientation information, as those terms are defined under California and other state privacy laws, through disclosures to advertising and analytics partners.

Why it matters (compliance & governance perspective)

This provision establishes that data disclosures to third-party advertising and analytics partners may constitute a sale of sensitive personal information under applicable state law definitions, triggering opt-out rights and, in some jurisdictions, opt-in consent requirements for sensitive data categories.

Consumer impact (what this means for users)

The agreement states that sensitive personal data including health data and sexual orientation information may be sold as defined under state privacy laws. Users can opt out via the Global Privacy Control, privacy.hims.com/policies, or the 'Your Privacy Choices' link on the company's webpage.

What you can do

Institutional analysis (regulatory & governance intelligence)

1. REGULATORY LANDSCAPE: This provision directly engages the California Consumer Privacy Act as amended by the California Privacy Rights Act, which grants consumers the right to opt out of the sale or sharing of personal information including sensitive personal information. It also engages state privacy laws in Colorado, Connecticut, Virginia, Texas, Washington, and other states with comprehensive privacy frameworks. The Washington My Health MY Data Act and similar state health data statutes may impose opt-in rather than opt-out obligations for health-related data sales. The FTC is the primary federal enforcement authority for unfair or deceptive data practices. 2. GOVERNANCE EXPOSURE: High. The explicit acknowledgment that sensitive personal data including health information and sexual orientation data may be sold creates heightened compliance obligations. Several state laws require opt-in consent rather than opt-out for sensitive data categories, and the policy's opt-out framing may not satisfy those requirements in all applicable jurisdictions. 3. JURISDICTION FLAGS: California requires a clear opt-out mechanism for data sales including sensitive data. Washington's My Health MY Data Act imposes heightened requirements on health data including consumer health data not covered by HIPAA; given Hims & Hers operates as a telehealth and wellness platform, Washington-resident user data may be subject to those requirements. Illinois, Texas, Colorado, Connecticut, and other states with comprehensive privacy laws create additional jurisdiction-specific exposure for sensitive data sales. 4. CONTRACT AND VENDOR IMPLICATIONS: Data processing agreements with advertising partners including Google, Meta, and X should be reviewed to confirm alignment with sensitive data handling representations. If those agreements permit advertising partners to use health or sexual orientation data for their own purposes, additional disclosure and consent obligations may arise. Audit rights over advertising partner data use practices may warrant evaluation. 5. COMPLIANCE CONSIDERATIONS: Legal teams should evaluate whether the opt-out mechanism at privacy.hims.com/policies and the Global Privacy Control implementation satisfy opt-out requirements under each applicable state law; assess whether any applicable state laws require opt-in consent for health-related or sexual orientation data sales rather than opt-out; and review data flows to advertising partners to confirm that health-related browsing data disclosures are accurately characterized and disclosed.

Applicable agencies

Provision details

Other risks in this policy

• Collection of Biometric Information for Identity Verification high
• Collection of Health Data Including Browsing Activity high
• Collection of Sexuality Information high
• Disclosure of Sensitive Health Data to Ad Partners high
• Health Browsing Activity Used for Marketing high
• HIPAA Covered Entity Disclaimer high