FTC and State Regulators Sue Hims & Hers Over Patient Data Leaks and Billing
The telehealth giant faces federal and state charges for sharing sensitive health data with ad platforms and using deceptive subscription tactics.
The Federal Trade Commission, joined by the state of Utah and California’s Los Angeles County Counsel, filed a federal lawsuit against Hims & Hers Health on July 29, 2026. The San Francisco-based action alleges the telehealth company betrayed patient trust by sharing sensitive health information with advertising giants while simultaneously trapping users in deceptive billing cycles.
According to the filing, Hims & Hers utilized tracking pixels and customer list uploads to transmit patient health data to a network of platforms, including Meta, Snap, Microsoft, Pinterest, Reddit, and X. The regulators claim these actions occurred despite the company's promises of privacy. Beyond data leaks, the suit accuses the company of deceptive financial practices, alleging that Hims & Hers charged users for prescriptions immediately after intake forms were submitted, often before a clinical consultation had even taken place.
A Pattern of Telehealth Misconduct
This legal action is not an isolated incident but part of a broader regulatory crackdown on the health-tech sector. The FTC has recently pursued similar enforcement actions against other telehealth and health-tech firms, including GoodRx, BetterHelp, and Cerebral, for the unauthorized use of tracking pixels to feed sensitive data to advertising networks.
These cases highlight a systemic regulatory gap: many direct-to-consumer telehealth platforms operate outside the full protections of the Health Insurance Portability and Accountability Act (HIPAA). Consequently, the FTC’s consumer protection authority has become the primary mechanism for holding these companies accountable for privacy failures.
The Cost of 'Discreet' Care
The allegations are particularly severe given that Hims & Hers specifically markets its services as "discreet" treatments for sensitive conditions, including sexual wellness, hair loss, and mental health. Regulators state that consumers were unknowingly locked into recurring subscriptions while their most private health information was being disclosed to third parties without their consent.
This monetization of sensitive behavioral signals suggests a wider industry trend where patient privacy is sacrificed for advertising efficiency. The lawsuit further targets the company's "dark patterns" regarding cancellations. Prior to 2023, users could only cancel subscriptions via phone, email, or live chat. While a cancellation button was eventually added, regulators allege it was intentionally hidden behind multiple navigation steps to prevent users from leaving.
Legal Framework and Next Steps
The lawsuit was filed under the FTC Act, the Restore Online Shoppers’ Confidence Act (ROSCA), and various state consumer protection statutes. The outcome of the case will likely serve as a bellwether for how the federal government regulates the intersection of healthcare and digital advertising. Observers are now watching to see if the court will impose stricter data-handling mandates or significant financial penalties to deter other health-tech firms from similar practices.