On this pageJump to a section
A customer list audience is a file of people who trusted you with their contact details, handed to an advertising platform so it can find those same people.
The file is not neutral. Everything the list means travels with it: who is on it, why they are on it and what they bought or asked about. For a plumber that is harmless. For a clinic, a coaching program for a medical condition or a telehealth brand, the meaning of the list can be the sensitive part.
For education only, and not legal advice. Have a qualified healthcare privacy lawyer review your setup before you upload anything.
What does Meta actually receive when you upload a list?
Contact details, hashed, and matched to accounts. That is the mechanical part, and it is not where the risk sits.
The hashing misunderstanding
Meta's technical documentation for customer information describes emails, phone numbers and names being normalized and hashed before they are sent.5 That page covers the Conversions API, but the lesson carries over to lists: hashing is a privacy measure for the identifier, not for the story around it.
A hashed email still means "this person is a customer of the clinic that sells treatment X." Meta can match it. The list's name, the campaign it feeds and the exclusions you build around it all tell the platform why those people belong together.
Where the risk really lives
The list is the disclosure. If membership means "bought a prescription weight loss program" or "completed an intake form for a condition," then uploading that list tells an ad platform something about each person's health, whether or not any name appears in the clear.
- Hashed email or phoneHides the address
- Matched to an accountMeta knows who it is
- List name, source and campaignSay why these people belong together
- Inferred meaningA condition or treatment, if the list implies one
What did the FTC allege against Hims & Hers?
The FTC, with Utah and California, filed a complaint on July 29, 2026 alleging Hims & Hers gave Meta and Snap customer lists that disclosed health information.1
The allegations in plain terms
According to the FTC's announcement, Hims allegedly gave Meta and Snap lists identifying certain customers, and used third-party tracking technologies that automatically sent visitor actions on its website to those companies. The FTC alleges the company shared sensitive information about consumers' medical conditions despite promising to protect patient privacy.1 It also raises separate billing and cancellation claims, which I covered in FTC v. Hims & Hers: The Subscription and Consent Lessons.
It has not been decided
This is a complaint, not a ruling. The FTC's own page says the case will be decided by the court.1 Treat it as a signal about where enforcers are looking, not as a final answer on what is allowed.
The FTC will not hesitate to act on behalf of consumers
This is not new
In 2023 the FTC announced an action against GoodRx. It alleged that in August 2019 the company compiled lists of users who had bought medications for heart disease and blood pressure, uploaded their emails, phone numbers and mobile advertising IDs to Facebook, then used those lists to target them with health ads.2 GoodRx agreed to pay $1.5 million for violating the Health Breach Notification Rule.2 Different year, same shape: a list whose membership reveals a condition.
What does Meta's own policy say?
Meta bars it in writing, and I covered its 2025 health event restrictions in Meta Is Coming for Health Data. Read the terms yourself, because whoever builds your audiences is also bound by them.
The Customer List Custom Audiences Terms say the audience names and criteria you set may not be based on health information, financial information, consumer report information or other categories of sensitive information.3 The Meta Business Tools Terms go further on the data side: advertisers warrant they will not share business tool data that includes or is based on health information, financial information or other sensitive categories, including information defined as sensitive under applicable laws.4
Which lists are safe to upload, and which are never worth it?
Run every list through the membership test and sort it into three buckets before it gets near Ads Manager. This is how I would think about it, not a legal opinion.
| Lists I would consider | Lists I would not upload |
|---|---|
| People who bought a non-health product or a general course | Patients, members or customers of a specific treatment |
| Opt-in newsletter subscribers whose signup says nothing about a condition | Anyone who completed a medical intake or symptom form |
| Past event attendees for a general business topic | Prescription buyers, refill customers or subscription members |
| A clean exclusion of existing buyers from a general offer | Lists named by condition, drug or program outcome |
The yellow zone
Anything in between goes to counsel before it goes to Meta. That includes a general email list from a health brand, because the brand itself implies a category. If your business is telehealth, my default is that the customer file stays out of ad platforms entirely and you let creative and broad targeting find buyers.
What to do instead
You can still grow without feeding the platform your patient file (see Telehealth Retargeting Under Meta's Health Rules):
- Let the creative do the targeting. The ad speaks to the person you want. People who relate will click.
- Use broad audiences. The platform's delivery is good at finding likely buyers once it has a clean conversion signal.
- Send neutral events. Name events after the business action, such as Lead or Purchase, not the treatment. Sending events from your server alongside the pixel can improve signal quality, but it is not a compliance shortcut, because it changes how data travels and not what the data says.
- Handle retention outside the ad platform. Email and SMS to your own patients, with proper consent, never needs to touch Meta.
How do you audit the lists you already uploaded?
Do it this week. It takes under an hour.
- Export every custom audience in your ad account with its source, creation date and name.
- Flag any audience whose name or source implies a condition, treatment, prescription or intake step.
- Check which campaigns, lookalikes and exclusions depend on those audiences.
- Pause the dependent ad sets and send the list to your privacy counsel for review before deleting or changing anything, so you keep a record of what existed.
- Replace the audience with a neutral approach: broad targeting, creative-led targeting and clean events.
- Write a one-page rule for your team and your agency: what may be uploaded, who approves it and where it is logged.
If you run a telehealth or health brand and want the tracking and audience setup built with these guardrails from day one, that is the work behind my telehealth program. It starts with what not to send.
The headline for any list is simple. Great audiences come from knowing people. Risky ones come from telling a platform who they are. Know the difference before you click upload.
Keep building.Ekai
Questions people ask
What is a customer list audience on Meta?
It is an audience built from a file of contact details you already hold, such as emails and phone numbers. Meta matches the hashed details to its users so you can advertise to, or exclude, those people.
Does hashing make a customer list safe for a health business?
No. Hashing protects the raw contact details in transit. It does nothing about what the list itself says, and a list of people who bought a particular treatment still reveals that fact about each person.
What did the FTC allege about Hims & Hers and customer lists?
The FTC alleges Hims gave Meta and Snap lists identifying certain customers, which disclosed health information, and that website tracking also sent visitor actions to those companies. The FTC says the case will be decided by the court.
Does Meta allow health information in custom audiences?
Meta's Customer List Custom Audiences Terms say audience names and criteria may not be based on health information, financial information, consumer report information or other sensitive categories.
Is this legal advice?
No. This is educational. Have a qualified healthcare privacy lawyer review any list source and audience before you upload it.
Sources
- 1
- 2
- 3
- 4
- 5
