FTC Sues Telehealth Provider Hims & Hers Over Health Data Tracking and Subscription Billing

Inside the U.S. District Court for the Northern District of California on July 29, 2026, federal regulators filed a 2-0 authorized complaint that changes how consumers should evaluate the privacy of their online medical visits. The Federal Trade Commission, joined by California and Utah, sued telehealth provider Hims & Hers, alleging the company used hidden website pixels to share patients' sensitive medical data with advertising networks like Meta and Snap. For shoppers seeking discrete treatments for hair loss or weight management, the lawsuit serves as a direct warning: medical intake forms filled out on a retail website do not automatically carry the same legal shields as a doctor's clipboard.[2][4]

The FTC's action targets the intersection of e-commerce convenience and healthcare privacy. According to the complaint, Hims & Hers publicly marketed its platform as "100% online, private, and secure." However, regulators allege the company simultaneously deployed tracking technologies that automatically transmitted website visitors' health-related browsing activity and intake responses to third-party advertisers. The agency claims this allowed the company to build highly specific advertising audiences based on the medical conditions of its roughly 2.5 million subscribers.[3][5]

Hims & Hers, founded in 2017, has strongly denied the allegations. In a public statement, the San Francisco-based company called the FTC's claims "baseless" and argued that the agency disregarded substantial evidence provided during a three-year investigation. The company maintains that its privacy policy clearly outlines how customer data is used and that information shared directly with healthcare providers remains strictly for care purposes. Following the lawsuit's announcement, the company's stock price fell nearly 15%, prompting a subsequent investor class-action lawsuit filed in early September 2026.[1][4]

Beyond data privacy, the federal complaint scrutinizes the company's subscription and billing mechanics under the Restore Online Shoppers' Confidence Act (ROSCA). "The FTC's complaint lays out a troubling scenario — consumers unknowingly locked into recurring subscriptions and the disclosure to third parties of consumers' most private health information without their consent," stated Christopher Mufarrige, director of the FTC's Bureau of Consumer Protection. Regulators allege that Hims & Hers charged consumers for prescription medications almost immediately after they submitted an initial intake form, before they had actually consulted with a medical provider.[2][4]

Regulators also detailed how the platform allegedly engineered unnecessary friction into its cancellation process. From at least 2019 through early 2023, the FTC states that most users could only cancel their recurring prescriptions by contacting customer service via phone, email, or chat. Even after introducing an online cancellation portal, consumers reportedly had to navigate multiple survey screens to finalize the termination. Furthermore, the complaint alleges the company routinely processed refill charges 10 days before a consumer's selected delivery cadence, requiring them to cancel at least two days prior to that unannounced date to avoid unwanted charges.[3][5]

For consumers, the enforcement action highlights a critical regulatory gap: the Health Insurance Portability and Accountability Act (HIPAA) does not universally protect health data entered into direct-to-consumer retail platforms. Because many telehealth startups operate outside traditional healthcare frameworks, they are governed primarily by standard consumer protection laws. The FTC has increasingly utilized these broader statutes to police digital health privacy, warning over 130 hospital systems about pixel-tracking risks in recent years—a pressure campaign that helped drive hospital website pixel use down from 98% in 2021 to roughly 30% in 2025.[5]

Legal analysts note that this lawsuit represents a significant escalation in how the government defines a "material term" in online shopping. By arguing that a company's failure to disclose its data-sharing practices violates e-commerce billing laws, the FTC is effectively mandating that telehealth retailers treat privacy disclosures with the same prominence as price tags. The outcome of the federal case will likely dictate whether digital health platforms must fundamentally restructure their marketing funnels or face continued enforcement actions.[3][5]

The legal action also serves as a practical reminder for shoppers navigating the expanding digital health marketplace. Consumer protection advocates advise patients to routinely audit their smartphone app permissions, disable cross-site tracking in their browser settings, and thoroughly read the cancellation terms before submitting payment information for a "free" consultation.[3]