The FTC Sues Hims & Hers Over Health Data Sharing & Flock Cameras Draw Safety Warnings (07/30/2026)

The theme today is what a promise is worth once the data has moved. A telehealth company told patients their information was private and, according to the FTC, sent it to advertisers anyway. A surveillance vendor’s hardware is now drawing questions from traffic engineers, a set of critics it never expected. And a government dropped a demand for a list of people by religion, which is worth noting precisely because it was made at all.

Top 5 Critical Privacy Alerts

1. The FTC Sues Hims & Hers Over Sharing Health Data With Advertisers

The Federal Trade Commission, joined by Utah and California through Los Angeles County Counsel, sued telehealth provider Hims & Hers alleging it shared consumers’ sensitive information about their medical conditions with third-party advertising platforms including Meta and Snap, despite claiming the service was private (PogoWasRight, TechCrunch). Telehealth exists because people will disclose things to a screen they might not say in a waiting room, and an enforcement action here is about the specific promise that made the disclosure feel safe.

Operator Note: If you run any service where people describe a health condition, the advertising and analytics code on those pages is now regulated conduct. Inventory every third-party tag, know exactly what each one transmits, and match your privacy policy to what the code actually does.

2. Flock Camera Poles Draw Highway Safety Warnings

Roadside safety advocates say some Flock Safety automated license plate reader installations may not meet highway safety standards and could pose a crash risk to drivers who strike them (The Guardian). Surveillance infrastructure deployed quickly along public roads has to satisfy the same engineering rules as anything else placed at the roadside, and this is a reminder that fast municipal rollouts skip reviews that exist for physical reasons.

3. xAI Sues Minnesota Over Its Nudification Ban

Elon Musk’s xAI sued Minnesota over the state’s first-in-the-nation law banning nudification technology on websites and apps, a case that will test how far states can go in regulating AI (The Guardian). The underlying harm is the creation of fake nude images of real people without consent, and the outcome will shape whether states can address specific AI harms or must wait for federal action.

4. The Administration Drops Its Subpoena for a List of Jews at Penn

The Trump administration ended its effort to compel the University of Pennsylvania to produce the names and personal contact information of Jewish people on campus, according to court filings (PogoWasRight). A government list of individuals by religion is the category of record that history has taught societies to refuse, and the withdrawal matters less than the fact that an institution had to litigate to avoid producing it.

5. Atlassian Tightens Tracking of Employee AI Use

Atlassian moved to tighten tracking of its staff’s AI spending, while other technology firms reportedly run leaderboards celebrating employees who consume the most AI in their work (The Guardian). Monitoring how staff use a tool is one step from evaluating them on it, and a leaderboard turns a productivity aid into a metric people will optimize whether or not it helps the work.

Additional Privacy Alerts

Enforcement

• CalPrivacy Outlines Its Enforcement Priorities: Tom Kemp, executive director of the California Privacy Protection Agency, discussed the agency’s current enforcement focus areas in a podcast interview. VeraSafe

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.