Hims & Hers Faces an FTC Press Case Over Privacy, Billing, and Cancellation

Hims & Hers faces an FTC press case alleging that it shared sensitive health information despite promising privacy, while also trapping consumers in unwanted subscriptions. The complaint links three practices that companies often treat separately: advertising technology, prescription enrollment, and cancellation design.

The Federal Trade Commission filed the case on July 29, 2026, alongside the Utah Division of Consumer Protection and California, acting through Los Angeles County Counsel. The regulators allege that Hims & Hers sent health-related customer information to advertising platforms, charged consumers before meaningful consultations, and obstructed cancellation.

Those claims remain allegations. Hims & Hers has not been found liable, and the case must be decided by the U.S. District Court for the Northern District of California. Still, the complaint creates a direct conflict between the privacy language used to attract patients and the data systems used to acquire customers.

That conflict matters beyond one telehealth company. GoodRx and BetterHelp previously faced FTC action over health information used for advertising. The Hims & Hers case now combines similar privacy concerns with the mechanics of recurring prescription sales.

What the FTC Press Case Actually Alleges

The lawsuit challenges the entire path from a health questionnaire to an advertising audience, prescription charge, and recurring subscription.

The FTC press release says Hims & Hers shared sensitive health information with Meta, Snap, and other third parties. Regulators claim those disclosures contradicted promises that the company’s services were private and secure.

Hims & Hers operates online platforms offering treatment across sexual health, hair loss, skin care, mental health, and weight management. The company connects consumers with contracted medical providers and pharmacies rather than serving as the medical provider itself.

A consumer seeking prescription treatment completes an online intake flow. According to the complaint, this process can include approximately 5 to 15 preliminary questions and a medical assessment containing 25 to 50 questions.

The intake then presents a possible treatment, shipment frequency, billing fields, and a button submitting the information for provider review. That sequence is central to the government’s billing allegations.

Regulators say advertisements and intake screens promoted a free consultation or assessment. Some screens allegedly told consumers they would pay nothing that day and would only be charged if prescribed.

The complaint claims the practical outcome was different for many customers. It says Hims & Hers routinely charged consumers and enrolled them in prescription subscriptions almost immediately after receiving their intake forms.

Consumers allegedly had little opportunity to review the selected treatment before the charge. The government says this process misled hundreds of thousands of consumers about whether they had agreed to buy medication.

The case also targets recurring refills. Regulators allege that Hims & Hers failed to disclose refill charge dates clearly enough for consumers to stop unwanted shipments.

Cancellation presented another barrier, according to the complaint. Before 2023, most consumers allegedly had to contact customer service by phone, email, or chat.

The company later added online cancellation for most users. However, the FTC says the relevant button remained difficult to find because consumers first had to choose an option about adding or removing order items.

They then had to navigate several more steps before seeing the word “cancel.” The complaint argues that this process violated federal requirements governing negative-option subscriptions.

A negative option treats a customer’s silence or failure to cancel as permission for continued charges. The Restore Online Shoppers’ Confidence Act requires clear disclosures, informed consent, and a simple cancellation mechanism for covered online transactions.

The plaintiffs allege violations of that federal law and the FTC Act. California also brings claims under its False Advertising Law and Unfair Competition Law, while Utah cites its Consumer Sales Practices Act.

The requested remedies include permanent restrictions, monetary relief, restitution, and civil penalties. The exact outcome will depend on evidence, legal arguments, and any settlement negotiations.

That distinction is important. An FTC press announcement reflects the government’s allegations, not a final judicial finding. Yet the complaint’s breadth makes it more significant than a narrow disagreement over one privacy notice or cancellation screen.

It presents privacy, billing, and subscription design as connected parts of the same customer-acquisition system. That framing puts the telehealth business model itself under scrutiny.

Health Data Allegedly Became Advertising Data

The central reversal is simple: information collected within a private treatment journey allegedly became an input for advertising systems.

The federal complaint says Hims & Hers described its process as private and secure. Regulators contend that consumers would reasonably understand those promises to limit disclosures outside their care.

The government alleges that Hims & Hers nevertheless shared health information in two principal ways. The first involved customer lists uploaded to advertising platforms for matching against existing user accounts.

The second involved tracking technologies embedded in company websites. A tracking pixel is website code that records selected visitor actions and sends related event data to another system.

The complaint specifically identifies Meta Pixel and Meta’s Conversions API. Meta Pixel operates through code placed on a website, while the Conversions API can send events through a direct server connection.

Those tools help advertisers measure conversions, build audiences, and improve campaign delivery. In ordinary retail, an event might indicate that someone viewed shoes or completed a purchase.

Health care changes the stakes. Visiting a treatment page, starting an assessment, or joining a condition-specific customer list can expose or support an inference about a person’s health concerns.

The complaint contains redactions that limit the public’s view of certain transmitted fields and audience details. Therefore, readers should avoid assuming every technical detail or affected data category is publicly known.

However, regulators expressly allege that shared events and customer lists revealed sensitive health information. They say Hims & Hers used the resulting specificity to build advertising audiences.

Snap allegedly received customer lists that could be matched with Snapchat accounts. The complaint also identifies pixels associated with Google, Microsoft, Criteo, Pinterest, Reddit, TikTok, X, The Trade Desk, and other advertising businesses.

Naming a platform does not establish that every recipient knowingly violated a privacy promise. The government’s case focuses on what Hims & Hers allegedly represented, collected, and disclosed.

It also does not mean every advertising tag necessarily transmitted identical information. The complaint says many pixels captured health-related events, but several details remain redacted or require proof.

The main conflict concerns context. A person completing a medical intake may expect information to reach a clinician, pharmacy, or service provider supporting treatment.

That person might not expect the same journey to produce an advertising audience or conversion event. A broad privacy policy does not automatically resolve that difference if prominent marketing created a stronger promise.

The current Hims privacy policy also illustrates a wider digital-health complication. It states that Hims & Hers is not itself a covered entity under the Health Insurance Portability and Accountability Act.

HIPAA applies to defined covered entities and business associates. It does not protect every piece of health-related information wherever that information appears online.

Some clinical information handled by medical groups, providers, laboratories, or pharmacies can receive different protection. Other information submitted to a consumer platform can fall under privacy policies, state statutes, or FTC consumer-protection authority.

For users, those legal divisions are rarely intuitive. A medical questionnaire looks sensitive regardless of which corporate entity receives a particular answer.

This gap between legal structure and consumer expectation is why privacy promises matter. The FTC can challenge a company for deceptive representations even when HIPAA does not govern the company’s entire platform.

The Hims & Hers privacy allegations are therefore not merely about code. They concern whether interface language encouraged disclosure under one expectation while data systems operated under another.

That is the strongest part of the government’s narrative. “Private” describes the experience being sold, while advertising integrations allegedly describe how the growth system actually worked.

The Subscription Flow Turns Privacy Into a Broader Trust Test

A telehealth company cannot separate informed medical choice from informed commercial consent when one intake flow controls both.

The complaint says Hims & Hers always sells its prescription products through subscriptions. That makes the final moments of the intake process unusually consequential.

A customer is not simply requesting a medical opinion. The same action can lead to a prescription decision, immediate payment, product fulfillment, and future refill charges.

Regulators claim company advertising led consumers to expect a free consultation before making that commitment. The complaint cites language about connecting with a licensed provider and finding care that is right for the patient.

Such language can suggest a conversation and a later purchase decision. According to the government, many consumers instead received a treatment decision and charge with virtually no time to review either.

The difference is not semantic. Medical consent addresses treatment, while commercial consent addresses payment and recurring delivery. A well-designed flow should make both decisions understandable.

The complaint alleges that Hims & Hers blurred them. A consumer could interpret the submission button as permission for provider review, while the company allegedly treated it as authorization for a subscription.

This issue places pressure on every telehealth platform using asynchronous care. Asynchronous care allows patients and clinicians to exchange information without meeting at the same time.

That model can improve convenience and access. It can also compress clinical assessment, checkout, and enrollment into a sequence that resembles ordinary ecommerce.

Medication is not an ordinary ecommerce product. A provider must determine whether treatment is appropriate, and a patient needs a meaningful chance to understand that recommendation.

The FTC press case does not claim that asynchronous telehealth is inherently unlawful. It challenges representations and interface choices surrounding the transaction.

That distinction matters for competitors such as Ro and LifeMD. They do not become implicated merely because they use online questionnaires or subscriptions.

However, the case gives their compliance teams a clear reason to examine the distance between marketing language and actual workflows. They must ask when payment authorization becomes binding and how clearly the interface communicates that moment.

They should also review whether a patient can reject a recommended treatment without being charged. Refill schedules, cancellation controls, and customer-service records deserve the same examination.

The government’s theory treats interface design as evidence, not decoration. Button labels, screen order, visual emphasis, and hidden controls can determine whether consent was informed.

That approach reflects a broader regulatory focus on dark patterns. Dark patterns are interface choices that steer users toward decisions they might not otherwise make.

A cancellation control hidden beneath an unrelated order-management option can create practical friction. Several additional screens can increase abandonment, even if cancellation remains technically available.

The complaint says Hims & Hers knew about consumer frustration through years of complaints. That allegation, if proven, would make the design harder to characterize as an isolated oversight.

One quoted consumer said the company charged immediately despite stating that no charge would occur before a health care conversation. Other allegations describe missed refill deadlines and unsuccessful cancellation attempts.

Individual complaints do not prove a companywide violation by themselves. They can still help establish notice, consumer interpretation, and recurring injury when combined with product records.

The case therefore pressures Hims & Hers on two fronts. It challenges the original enrollment and the company’s treatment of consumers trying to leave.

Privacy adds a third front. Consumers allegedly entered the flow believing their medical concerns would remain private, then faced commercial outcomes extending beyond treatment.

Together, these allegations create one trust problem. The platform allegedly claimed to reduce the discomfort of seeking care while using design and data practices consumers did not expect.

Hims & Hers Is Not the First Digital-Health Privacy Target

GoodRx and BetterHelp gave digital-health companies a clear warning that advertising infrastructure does not become harmless when it runs behind a medical interface.

In 2023, the FTC brought its first enforcement action under the Health Breach Notification Rule against GoodRx. The agency alleged that the prescription-discount provider disclosed identifiable health information to advertising and analytics companies.

The GoodRx action involved information about prescriptions and health conditions shared with Facebook, Google, Criteo, and others. GoodRx agreed to restrictions on advertising disclosures and a civil penalty.

The FTC also acted against online counseling provider BetterHelp. Regulators alleged it sent email addresses, IP addresses, and questionnaire information to advertising platforms despite making privacy promises.

The final BetterHelp order prohibited sharing health data for advertising. It also required affirmative consent for certain disclosures, deletion requests to recipients, and a comprehensive privacy program.

Those cases established a recognizable pattern. A digital-health service makes reassuring statements, gathers highly sensitive information, and integrates common advertising tools into the user journey.

The Hims & Hers lawsuit follows that pattern but adds recurring prescription commerce. Its billing and cancellation claims make the alleged injury broader than unwanted data disclosure.

This history weakens any argument that health-platform tracking presented an entirely novel compliance question. The FTC publicly explained the risks of pixels after the GoodRx and BetterHelp cases.

The agency has described modern pixels as code capable of recording and transmitting website events. It has also emphasized that health inferences can emerge from page visits and user behavior.

The legal landscape strengthened further in 2024. The FTC updated its Health Breach Notification Rule to clarify its application to health apps and similar technologies outside HIPAA.

That rule can require covered businesses to notify consumers, the FTC, and sometimes the media after unauthorized acquisition of unsecured identifiable health information.

Interestingly, the public Hims & Hers complaint centers its federal privacy counts on deception under the FTC Act. Its other federal counts concern online subscription requirements under ROSCA.

The complaint does not publicly present a Health Breach Notification Rule count. That difference prevents a direct one-to-one comparison with GoodRx.

It also shows that the FTC has several possible legal routes. A misleading privacy promise can support a deception claim even when a separate breach-notification theory is absent.

Still, the government must prove its allegations. The complaint includes redactions, and Hims & Hers will have opportunities to challenge how regulators characterize its disclosures and interfaces.

The company might dispute whether transmitted data constituted sensitive health information, whether consumers received adequate disclosures, or whether particular statements created the alleged expectations.

It might also challenge the scale, timing, or materiality of the alleged conduct. The public complaint alone cannot resolve those factual questions.

The meaning of consent will be another contested area. A privacy policy can authorize data uses, while prominent statements elsewhere can shape a different consumer understanding.

Courts examine representations in context. Regulators must show that the challenged claims or omissions were likely to mislead reasonable consumers in a material way.

Billing claims carry similar uncertainty. The existence of disclosures does not settle whether they were sufficiently clear and conspicuous within the complete intake flow.

The government will need evidence showing what consumers saw, how screens changed over time, and when charges occurred. Hims & Hers can present its own records and interpretation.

For that reason, the FTC press case should not be described as a completed enforcement victory. It is a consequential complaint with substantial factual allegations, not a final verdict.

The Real Conflict Is Privacy Promises Versus Growth Systems

The case argues that Hims & Hers used privacy to reduce hesitation while its growth systems allegedly converted sensitive behavior into measurable advertising signals.

Direct-to-consumer telehealth depends on lowering barriers. People may avoid traditional appointments because of cost, scheduling, embarrassment, or limited local access.

A private online process can make treatment feel easier. That promise is especially valuable for conditions involving sexual health, mental health, hair loss, or weight.

However, the same company must attract customers in expensive digital markets. Advertising teams want conversion measurement, audience matching, campaign optimization, and attribution.

Those goals produce the article’s primary conflict. Privacy encourages users to disclose more, while advertising systems benefit from more detailed behavioral signals.

The two functions are not automatically incompatible. A health company can limit collection, restrict event data, obtain meaningful permission, and prevent sensitive information from entering advertising pipelines.

Problems emerge when privacy controls follow ordinary retail assumptions. A marketing team might view a page visit as a conversion event without accounting for the health condition that the page reveals.

Customer-list matching creates similar risk. Uploading contact details can appear routine, but a list defined by treatment interest adds sensitive context.

The complaint alleges that Hims & Hers created audiences with condition-level specificity. If proven, that would make the privacy conflict difficult to dismiss as generic analytics.

Company structure can make accountability harder. Marketing teams select advertising tools, product teams build intake flows, clinicians review assessments, and legal teams draft disclosures.

Consumers experience one service. They do not distinguish among internal owners when the platform promises privacy and then charges a card or transmits an event.

That is why a trustworthy data program needs shared records. Teams should know which events exist, what each field means, where information travels, and which promise governs it.

A searchable knowledge base can help teams connect technical documentation with privacy reviews. Documentation alone does not create compliance, but fragmented documentation makes contradictions easier to miss.

Telehealth companies also need stricter classifications than ordinary ecommerce businesses. A product page for prescription treatment can reveal a health concern before a user submits any explicit diagnosis.

URLs, button names, event labels, and audience definitions can all carry meaning. Removing a person’s name does not necessarily remove identifiability when an advertising platform can match other account signals.

Server-side tracking deserves particular scrutiny. Browser controls may block some client-side pixels, while an API can transmit conversions directly from company systems.

That architecture can improve measurement reliability. It can also make data flows less visible to users and harder for standard browser protections to interrupt.

The FTC complaint’s focus on both Meta Pixel and Conversions API captures this technical reality. Privacy review cannot stop at scripts visible in a browser.

It must include server integrations, uploaded lists, data warehouses, audience tools, tag managers, mobile software development kits, and downstream retention.

Consent must be equally specific. Accepting a privacy policy should not become a universal substitute for understanding sensitive advertising disclosures.

Likewise, entering payment details should not obscure when a recurring prescription obligation begins. The commercial and privacy decisions require clear, separate explanations.

This does not mean every screen needs lengthy legal text. It means the consequential action must match the language around it.

If a button submits information for review, the interface should not quietly treat it as final approval for an unknown treatment. If a process is described as private, sensitive events should not silently feed advertising audiences.

Hims & Hers built its brand around making personal care less awkward. The complaint alleges that its growth machinery introduced a different kind of discomfort.

That allegation strikes at a strategic asset, not merely a compliance checklist. Trust determines whether consumers will answer intimate questions accurately and remain with a telehealth provider.

Three Signals Will Show Where the Case Goes Next

The court record, remediation details, and platform changes will reveal whether this becomes a narrow dispute or a wider reset for telehealth growth practices.

The first signal is Hims & Hers’ formal response in federal court. That filing should clarify which allegations the company contests and which factual descriptions it accepts.

Watch for arguments about the meaning of health information, the adequacy of disclosures, and the timing of consent. Those positions will define the genuine factual disputes.

A motion to dismiss would test the legal sufficiency of the claims. An answer would respond to individual allegations and identify defenses.

Neither filing would determine liability. However, a broad factual denial would point toward discovery, while early settlement discussions could produce operational remedies sooner.

The second signal is any documented remediation. Changes to tracking configurations, audience uploads, privacy language, intake buttons, refill notices, or cancellation paths would show where risk was concentrated.

A company can change practices without admitting liability. Therefore, interface updates should not be treated as proof that earlier conduct violated the law.

Still, those changes matter for consumers and competitors. A clearer treatment-approval step or visible cancellation control can establish a new practical benchmark.

Privacy remedies deserve particular attention. Previous FTC health-data settlements required advertising limits, affirmative consent, deletion requests, retention controls, and formal privacy programs.

The government seeks permanent injunctive relief here. Any proposed order will show whether regulators pursue similar restrictions or broader limits tied to Hims & Hers’ subscription model.

The third signal is whether other telehealth businesses revise their systems before the case ends. Competitors do not need to wait for a judgment to audit comparable risks.

Watch for shorter cancellation paths, clearer refill dates, separated consultation and purchase decisions, and reduced use of condition-linked advertising events.

Also watch Meta, Snap, and other advertising platforms. Stronger technical restrictions for health-related advertisers would shift some prevention from individual clients into platform infrastructure.

Such controls could include event filtering, blocked parameters, stricter customer-list rules, or additional attestations. Their effectiveness would depend on enforcement and accurate advertiser classification.

Consumers should not assume that a medical-looking service receives complete HIPAA protection. They can review privacy terms, examine subscription timing, and save copies of enrollment and cancellation screens.

They should also treat medication intake as both a clinical and financial action. Before submitting, users can check whether approval triggers payment and when the next refill occurs.

For companies, the larger lesson is not to abandon analytics or subscriptions. It is to test whether each system behaves consistently with the promise that persuaded a person to continue.

The FTC press action places that consistency at the center of the case. The government alleges that Hims & Hers promised discretion while disclosing health-related signals, and promised consultation while triggering recurring commerce.

If the evidence supports those allegations, the case will strengthen an established regulatory message: common advertising technology does not excuse unexpected health-data use.

If Hims & Hers successfully challenges the complaint, the court could narrow how regulators apply deception and subscription law to integrated telehealth flows.

Either outcome will influence product teams, privacy officers, marketers, and digital-health buyers. The most useful question is now concrete: can a company trace every promise to the exact interface, billing rule, and data transfer that follows?

That is the standard readers should apply as the case proceeds. Follow the court filings, compare any revised workflows, and examine whether the telehealth sector changes before regulators force it to act.