A privacy promise is not a footer line. It is a media control that either matches the stack or becomes evidence against it.
Your privacy promise is now a media control.
On July 29, 2026, the FTC, California, and Utah sued Hims & Hers over subscription practices and alleged sharing of sensitive health information with advertising platforms while the company told customers the experience was private and discreet (Nixon Peabody, Baker Donelson). The case is early. The operating lesson is not.
Regulators are reading your growth stack against your public words. Pixels, conversion APIs, customer-list uploads, and lookalike seeds are no longer "implementation details" sitting under marketing. They are the proof or the contradiction of what the homepage, the ad, and the influencer script promised.
The Gap Is The Product
The FTC theory is simple enough for a board slide.
What did you promise. What did the technology do. Did the buyer get a clear chance to consent before sensitive context moved to an ad platform.
Nixon Peabody and Baker Donelson both walk the same alleged paths: customer lists uploaded for matching, and site or app events firing into Meta, Snap, and other ad servers from intake and checkout style journeys. The complaint treats condition-revealing pages and events as sensitive even when HIPAA never applies. That is the mid-market trap. Many marketing sites sit outside HIPAA and still collect health, finance, or identity-adjacent context that a reasonable buyer hears as private.
If your copy says private, secure, confidential, discreet, or provider-only, every live tracker on that journey is part of the claim.
Inventory Before You Scale Spend
This week, do not open with a redesign. Open with a map.
List every pixel, SDK, conversion API, session replay tool, chat embed, analytics script, customer-list upload, and lookalike audience on the marketing site and the money paths: pricing, demo, intake, checkout, account. Name the owner. Name the event. Name whether consent or opt-out actually suppresses the fire. Baker Donelson's practical takeaway is blunt: a banner that does not stop the event is theater.
Then print the public promises. Homepage. Paid landing pages. App store copy. Influencer scripts. Privacy policy. Put the two lists side by side. Anywhere the promise is hotter than the stack, either cool the promise or quiet the stack before you pour more media into that path.
Treat Sensitive Journeys Differently
Not every page carries the same risk.
Condition-specific content, symptom checkers, prescription interest, account portals, and checkout that reveals treatment category deserve a harder rule than a blog post. The safer program default on those URLs is no advertising trackers, or events redesigned so they cannot imply the buyer's condition. Ordinary first-party analytics can stay. Audience matching that exports the sensitive cohort should not.
This is a CMO decision, not a tag-manager ticket. It decides which conversion paths are allowed to fund paid acquisition with shared identifiers.
Make The Match A Standing Control
Write one rule into the media operating cadence.
No new pixel, CAPI destination, or list upload ships without a one-line attestation that it matches the live privacy language on the pages it fires from. Review the attestation in the same weekly meeting that reviews CPL and pipeline. Legacy lists already sitting in platforms need a suppression or deletion plan, not a shrug.
Private on the page means quiet in the stack. If those two disagree, the next enforcement letter will not care which team owned the tag.
