FTC Sues Hims & Hers Over Data Sharing and Subscription Practices: How Telehealth Tracking Works

The convenience of direct-to-consumer telehealth has fundamentally transformed how millions of people access medications for sensitive conditions. Platforms offering discreet, app-based consultations have removed traditional barriers to healthcare, allowing patients to seek treatment from the privacy of their homes. However, that seamless digital experience often comes with a hidden cost to consumer privacy. As patients navigate online intake forms and digital storefronts, their most intimate medical inquiries are frequently tracked, categorized, and monetized by the underlying architecture of the modern internet. This tension between healthcare accessibility and digital privacy has now culminated in a major legal confrontation involving one of the industry's largest players.[1][3]

On July 29, 2026, the Federal Trade Commission, joined by the states of California and Utah, filed a sweeping federal lawsuit against Hims & Hers Health Inc. in the Northern District of California. The regulatory complaint alleges a pattern of severe consumer protection violations, accusing the telehealth giant of secretly sharing highly sensitive patient data with advertising platforms like Meta and Snap. Furthermore, the lawsuit claims the company utilized deceptive billing practices to trap users in recurring prescription subscriptions. The legal action represents a significant escalation in the government's ongoing effort to police the intersection of healthcare and e-commerce.[1][6]

The core of the government's case rests on two distinct but intertwined mechanisms that power the direct-to-consumer healthcare model. The first involves the invisible transmission of user behavior to third-party tech companies, a practice that directly contradicts the company's public promises of medical discretion. The second mechanism centers on digital "dark patterns"—user interface designs intentionally crafted to confuse consumers, obscure costs, and prevent subscription cancellations. Together, regulators argue, these practices have misled hundreds of thousands of consumers and compromised the privacy of roughly 2.6 million subscribers.[4][6]

To understand the privacy allegations, it is essential to examine the mechanics of tracking pixels. A tracking pixel is a microscopic, invisible snippet of code embedded within a website's architecture. When a user interacts with the site—such as clicking on a specific medication, filling out an intake form, or lingering on a page about a particular condition—the pixel automatically records that "Event" and transmits the data back to the advertising platform that supplied the code. In this case, the FTC alleges that Hims & Hers allowed Meta and Snap to monitor exactly what treatments users were exploring.[3][7]

The data transmitted through these pixels is not trivial. Hims & Hers specializes in treatments for conditions that patients rarely discuss in public, including erectile dysfunction, severe hair loss, obesity, and mental health struggles like anxiety and depression. When a user seeks help for these deeply personal issues, they operate under the assumption of medical confidentiality. Instead, the lawsuit claims, their digital footprints were packaged and sent to social media giants to optimize future ad targeting. The FTC also alleges that the company went a step further by directly uploading lists of customer names and behaviors to these platforms.[4][6]

A critical regulatory gap makes this type of data sharing possible. Most consumers assume that the Health Insurance Portability and Accountability Act, commonly known as HIPAA, universally protects all health-related information. However, HIPAA strictly applies only to traditional "covered entities" like hospitals, doctors' offices, and health insurance plans. Direct-to-consumer telehealth platforms and health apps often operate outside of HIPAA's strict boundaries, classifying their users as consumers rather than traditional patients during the initial intake phase.[8]

Because HIPAA does not always apply, the FTC has increasingly relied on general consumer protection laws to police digital health privacy. The agency argues that if a company promises privacy and discretion in its marketing materials, secretly deploying tracking pixels constitutes a deceptive business practice under Section 5 of the FTC Act. This legal strategy allows regulators to penalize companies for breaking their own privacy promises, even if they technically fall outside the jurisdiction of traditional medical privacy frameworks.[6][8]

The second half of the lawsuit shifts focus from data privacy to the mechanics of subscription billing. According to the complaint, Hims & Hers aggressively marketed its services by promising "free" consultations and displaying prominent "Pay $0 today" banners on its medical intake forms. These advertisements led consumers to believe they were simply submitting their medical history for a professional review, with no financial obligation until they actually spoke with a healthcare provider and agreed to a specific treatment plan.[1][4]

In reality, the FTC alleges that the moment a user clicked submit on the intake form, the company immediately charged their credit card and enrolled them in a recurring subscription. Most customers never received a live consultation with a clinician. Instead, they were billed for prescription medications almost instantly, completely bypassing the opportunity to review the recommended treatment, ask questions about side effects, or decline the purchase.[4][7]

The financial impact of these immediate charges was often substantial. The lawsuit cites multiple consumer complaints detailing unexpected and exorbitant bills. In one instance, a patient reported being charged $897 before ever speaking to a healthcare professional. Another consumer stated they were billed $147 for a three-month supply of the antidepressant Lexapro simply because they indicated they were "open to" medication on their initial intake questionnaire.[1]

Once a consumer was locked into a subscription, escaping the recurring charges proved to be a formidable challenge. The FTC accuses Hims & Hers of employing sophisticated dark patterns to make cancellation deliberately difficult. Prior to 2023, the company required customers to navigate a cumbersome process of calling customer service, sending emails, or waiting for live chat agents to process a cancellation request, intentionally creating friction to retain revenue.[4][6]

Even after the company introduced an online cancellation option, the process allegedly remained deceptive. The lawsuit claims that the cancellation button was intentionally hidden deep within the user interface, buried behind an ambiguous menu labeled "Add/remove items from order." Crucially, the interface never explicitly used the word "cancel," leaving users confused about whether they had successfully terminated their subscription or merely modified an upcoming shipment.[1][4]

To further complicate matters, regulators allege that Hims & Hers manipulated its billing timeline to preempt cancellations. While the company advertised monthly or quarterly refill schedules, it allegedly processed the actual credit card charges up to 10 days earlier than a consumer would reasonably expect. Because customers were required to cancel at least two days before this unannounced early processing date, many missed the hidden deadline and were forced to pay for unwanted medication refills.[1]

These billing practices are being challenged under the Restore Online Shoppers' Confidence Act, a federal law specifically designed to combat deceptive auto-renewal programs. The law requires companies to clearly and conspicuously disclose all material terms of a transaction before obtaining billing information, and mandates that they provide a simple, easy-to-use mechanism for consumers to stop recurring charges. The states of Utah and California have also attached their own state-level consumer protection and false advertising claims to the federal suit.[6][8]

Hims & Hers has fiercely pushed back against the government's allegations. Following the announcement of the lawsuit, the company's stock experienced a sharp decline, falling more than 15% in intraday trading. In a public statement released on social media, the telehealth provider categorized the FTC's claims as "baseless" and characterized the litigation as an effort to "generate headlines at our expense" rather than a genuine attempt to protect consumers.[3][5]

The company argues that the lawsuit fundamentally misunderstands the telehealth industry and ignores established state laws governing digital care. Hims & Hers maintains that it provided substantial evidence demonstrating its compliance during the FTC's nearly three-year investigation. Furthermore, the company asserts that its privacy policy clearly informs consumers about how their data is utilized, and insists that any information shared directly between a patient and a clinician is strictly protected and used solely for providing medical care.[3][7]

Despite these defenses, the lawsuit against Hims & Hers is not an isolated incident. It represents the latest strike in a systematic, multi-year crackdown by the FTC on the digital health and wellness sector. Regulators have made it abundantly clear that they view the unauthorized sharing of health data with advertising platforms as a red line, regardless of whether the company considers itself a traditional healthcare provider or a modern tech platform.[5][8]

The agency has already secured significant victories in this arena. In 2023, the FTC penalized the prescription discount provider GoodRx for disclosing sensitive consumer data to third-party advertisers. Shortly after, the agency banned the therapy platform BetterHelp from sharing consumer data for marketing purposes. Earlier in 2026, the virtual mental health startup Cerebral paid over $7 million in penalties and refunds to settle allegations that it shared the prescription data of millions of users with platforms like TikTok and Google while utilizing similar deceptive cancellation practices.[2][3]

As the Hims & Hers case heads to federal court, it sets the stage for a defining legal battle over the future of online healthcare marketing. The outcome will likely determine the boundaries of how telehealth companies can acquire and retain customers in a highly competitive digital landscape. For an industry built entirely on the premise of frictionless convenience, the regulatory message is pointed: convenience cannot come at the expense of informed consent and data privacy.[5][8]

For consumers, the lawsuit serves as a vital educational moment. It highlights the invisible data pipelines that power the modern internet and underscores the importance of reading privacy policies before utilizing digital health services. As telehealth continues to expand its reach into everyday medical care, understanding the mechanics of tracking pixels and subscription dark patterns is no longer just a matter of tech literacy—it is a fundamental component of protecting one's personal health information and financial well-being.[6][8]