FTC Sues Hims & Hers Over Alleged Sharing of Health Data and Unlawful Subscription Practices

The Federal Trade Commission, acting in coordination with state authorities in California and Utah, has launched a sweeping federal lawsuit against Hims & Hers Health Inc., alleging that the prominent telehealth provider unlawfully shared highly sensitive patient data with advertising platforms and locked consumers into deceptive recurring subscriptions. The lawsuit, filed in the U.S. District Court for the Northern District of California, marks a significant escalation in federal oversight of the rapidly expanding direct-to-consumer healthcare market. Regulators argue that the company systematically prioritized rapid customer acquisition and targeted marketing over fundamental patient privacy and transparent billing practices, fundamentally violating the trust required in digital healthcare.[1][5]

The core of the government's privacy allegations centers on the company's aggressive integration of third-party tracking technologies into its digital health platform. According to the federal complaint, Hims & Hers transmitted highly sensitive medical information—specifically including data related to conditions such as erectile dysfunction, premature ejaculation, and hair loss—to external advertising platforms including Meta, Snap, Microsoft, Pinterest, and X. This data was allegedly shared through the use of tracking pixels despite the company's explicit and repeated marketing promises that its telehealth services were "100% online, private and secure." The FTC contends that this unauthorized data flow allowed advertisers to build highly specific audience profiles based on private medical vulnerabilities.[2]

Beyond the passive deployment of tracking pixels, the FTC claims the telehealth company took active steps to compromise patient confidentiality by uploading customer lists directly to advertising platforms for audience matching purposes. Christopher Mufarrige, director of the FTC's Bureau of Consumer Protection, stated unequivocally that the agency will act aggressively on behalf of consumers who were denied the fundamental ability to keep their most sensitive health information private. The regulatory action underscores a growing federal intolerance for digital health platforms that attempt to monetize patient data by treating medical intake forms as standard e-commerce lead generation tools.[4][5]

The billing and enrollment practices outlined in the lawsuit present an equally aggressive operational model designed to minimize consumer friction at the expense of informed consent. Regulators allege that Hims & Hers heavily advertised "free" consultations and prominently displayed "Pay $0 today" on its digital intake forms to lure prospective patients. However, the company is accused of charging patients and automatically enrolling them in expensive recurring subscriptions almost immediately after a provider wrote a prescription. This automated process allegedly bypassed the consumer's opportunity to review the proposed treatment plan, understand the ongoing costs, or decline the medication before their credit card was billed.[1][3]

Consumer complaints cited extensively in the federal filing highlight the severe financial impact of these automated billing practices on everyday patients. One customer reported being charged $897 before ever speaking to a healthcare professional, while another was billed $147 for a three-month supply of medication simply after indicating they were "open to" treatment on an initial intake questionnaire. Over the past five years, the FTC has received more than 4,800 consumer complaints regarding the platform's billing and cancellation procedures, with many patients reporting that unexpected charges drained funds needed for essential living expenses like rent and groceries.[1][6]

The mechanics of subscription cancellation were allegedly designed to maximize customer retention through deliberate interface friction and confusing timelines. The lawsuit claims that Hims & Hers buried the cancellation option deep within its user interface, hiding it behind an ambiguous "Add/remove items from order" button that deliberately omitted the word "cancel." Furthermore, the company reportedly processed refill charges up to 10 days earlier than a standard monthly or quarterly schedule would suggest to a reasonable consumer. Because customers were required to cancel two days prior to that early processing date, the timeline made it exceptionally easy for patients to miss the deadline and incur unwanted charges.[1][4]

Hims & Hers management has strongly denied the federal allegations, characterizing the lawsuit as a politically motivated effort to generate headlines rather than a genuine consumer protection measure. In a public statement addressing the litigation, the company called the claims "baseless" and asserted that its privacy policy clearly and legally outlines how customer data is utilized across its platform. The telehealth provider maintains that any information shared with healthcare professionals is used strictly for providing medical care, arguing that the FTC has willfully ignored evidence provided during a three-year investigation and failed to recognize standard operating procedures within the modern telehealth industry.[2]

The financial markets reacted swiftly and negatively to the regulatory action, reflecting Wall Street's concern over the potential impact on the company's core business model. Shares of Hims & Hers Health Inc. plummeted between 11% and 15% immediately following the announcement of the federal complaint, erasing significant market value as investors weighed the risks of forced operational changes and substantial financial penalties. The company, anticipating regulatory friction, had previously set aside $15 million in reserves to address the FTC's ongoing investigation into its privacy and advertising practices, though the scope of the federal lawsuit suggests the ultimate cost could be much higher.[2][6]

The lawsuit strategically invokes both the FTC Act and the Restore Online Shoppers' Confidence Act (ROSCA), signaling a broader federal interpretation of what constitutes a "material term" in online consumer transactions. By partnering directly with state authorities in California and Utah, the FTC is leveraging a combination of federal and state consumer protection laws to target the lucrative intersection of digital health data and subscription commerce. Legal experts suggest this coordinated enforcement action sets a critical precedent that could force widespread compliance overhauls and stricter data governance across the entire direct-to-consumer telehealth industry.[1][4]