The Federal Trade Commission has sued telehealth provider Hims & Hers, alleging that it shared consumers' sensitive health information with advertising platforms including Meta and Snap despite promising privacy, and that it enrolled customers in recurring prescriptions they had not agreed to buy.
The complaint, filed 29 July 2026 in the US District Court for the Northern District of California, was brought by the FTC together with Utah and California, acting by and through Los Angeles County Counsel. The Commission authorised the filing on a 2-0 vote. Shares of Hims & Hers fell by roughly 12% on the news.
"The FTC's complaint lays out a troubling scenario — consumers unknowingly locked into recurring subscriptions and the disclosure to third parties of consumers' most private health information without their consent," said Christopher Mufarrige, Director of the FTC's Bureau of Consumer Protection. "The FTC will not hesitate to act on behalf of consumers deprived of their ability to choose which products they want and whether to keep their most sensitive health information private."
Two alleged data channels
The privacy allegations describe two mechanisms, and the difference between them matters for anyone trying to assess exposure.
First, the complaint alleges Hims shared lists of certain customers with the platforms. Second, it alleges that third-party tracking technologies on the company's website automatically transmitted certain "Events" — the actions visitors took on the site — to those same companies.
The second mechanism is the one that has generated enforcement risk across the digital health sector. A tracking pixel does not need anyone to decide to send health data; it transmits what it observes. If a page reveals the condition being treated, the combination of that page view with an advertising identifier is itself a health disclosure, whether or not a name travels with it. In Hims' case the conditions involved — erectile dysfunction, hair loss, mental health, weight management — are exactly the categories where disclosure is most sensitive.
Notably, the counts brought are the FTC Act and the Restore Online Shoppers' Confidence Act, which addresses deceptive billing and subscription practices, alongside Utah's Consumer Sales Practices Act and California's False Advertising and Unfair Competition Laws. The Health Breach Notification Rule is not among them, despite being the theory used in several recent digital health privacy actions. That choice suggests the pleadings rest on deception — representations about privacy that the conduct contradicted — rather than on a standalone failure to notify.
The billing allegations
The Commission alleges that consumers completing an online intake form were asked for billing information while being told they would not be charged unless and until medication was prescribed, and that they would consult with a provider to determine what was "right for them."
In practice, the complaint says, most consumers never received that consultation. Instead, on submitting the intake form, they were charged for and subscribed to a prescription treatment without an opportunity to review or approve it. One consumer quoted in the filing said they were told they would speak with a doctor in a few days and nothing would be charged that day: "Him's & Her's charged me immediately! I never gave consent to apply charges before I spoke with a healthcare professional."
The complaint further alleges Hims did not clearly and conspicuously tell consumers when prescriptions would refill each month, making it difficult to cancel before the next billing cycle.
What "hard to cancel" actually describes
Specificity here is what makes this filing useful to read, because dark-pattern allegations tend to be pleaded vaguely.
Prior to 2023, most consumers could cancel only by contacting customer service by phone, email or chat, with additional hurdles layered on top. After online cancellation was introduced in 2023, the complaint alleges the cancellation button was hidden: it appeared only after a consumer selected an option to add or remove items from an order and moved through several further steps before the word "cancel" was visible at all.
Two features make that structure consequential. Requiring a service interaction to cancel converts a self-service action into one dependent on retention staff. And routing cancellation through an "add/remove items" path is the opposite of where a user looking to cancel would expect to find it. Neither requires a missing link — burying it is enough.
The company's response
Hims & Hers rejected the claims outright. "This lawsuit disregards substantial evidence we provided the FTC during its nearly three-year investigation, ignores established state laws and industry standards in telehealth, and contorts the law to try to manufacture claims. This is not enforcement grounded in consumer protection; it is an effort to generate headlines at our expense. We are confident in our position and will vigorously defend ourselves against these baseless claims."
The company added that it has "long shared the goal of the FTC's new Healthcare Task Force" and that "our Privacy Policy makes clear that they may choose how their data is used, and that information patients share with their healthcare providers is used only in providing care." It said it has continued to strengthen its processes and systems as it has grown.
The reference to a nearly three-year investigation is notable. It places the inquiry back to roughly 2023, meaning the filing follows a long documentary record rather than a precipitating breach — which also means both sides will litigate from a developed evidentiary base.
Why this reaches beyond telehealth
Three elements generalise to any consumer-facing health or subscription business.
Consent architecture is now the primary privacy control. Whether a policy permits sharing matters less than whether it clearly disclosed the specific sharing that occurred, at the point where the consumer could act on it.
The marketing pipeline sits inside the compliance perimeter. Tags installed by growth teams are data disclosures, and reviews of them typically sit with neither the privacy function nor clinical operations. Every prior enforcement wave in this area has followed the same pattern: pixels deployed for measurement, later characterised as unauthorised disclosure.
Subscription mechanics are treated as a pricing term. A charge the consumer did not clearly agree to is not a billing dispute but an unfair practice, and the remedy sought in these cases is typically redress rather than a penalty calculated on revenue.
One caution on reading the coverage: the original reporting described this as sharing health data "with online advertising companies including Meta Platforms and Snap." That is accurate, but the mechanism pleaded for much of it involves event-level website tracking, which is a materially different fact pattern — and a much harder one to defend — than a deliberate transfer of customer records.
Procedure and caveats
A Commission complaint is "reason to believe" pleading, not a finding. No violation has been established and the case will be decided by the court. Hims & Hers denies the allegations, and the allegations against it remain unproven. The plaintiff count also matters for remedy design: state co-plaintiffs can seek relief under state law independently of what the federal claims support.
Sources
- FTC press release, 29 July 2026: filing in the Northern District of California with Utah and California acting through Los Angeles County Counsel; the 2-0 authorising vote; the two alleged data-sharing mechanisms; the absence of any Health Breach Notification Rule count; charges under the FTC Act, the Restore Online Shoppers' Confidence Act, the Utah Consumer Sales Practices Act and California's False Advertising and Unfair Competition Laws; the pre- and post-2023 cancellation allegations; the consumer quotation; and the statement from Christopher Mufarrige. Includes the Commission's standard note that a complaint reflects "reason to believe" and will be decided by the court.
- Hims & Hers investor statement, 29 July 2026, quoting the company's response in full, including the reference to a nearly three-year investigation and its comments on the FTC's Healthcare Task Force.
- Additional reporting on the approximately 12% share price decline following the news.
- Note: analysis of the two data channels, pixel mechanics, the significance of which statutes were charged, the cancellation design, the generalisable lessons for health and subscription businesses, and the procedural caveats is the author's. All allegations remain unproven and the company denies them.
