FTC and States Sue Hims & Hers Over Health Data Leaks and Deceptive Billing
The telehealth provider faces allegations of sharing sensitive patient data with advertisers and using 'dark patterns' to trap subscribers.
The Federal Trade Commission, joined by the states of California and Utah, sued telehealth provider Hims & Hers on July 29, 2026, alleging the company illegally shared sensitive health data and misled customers. The lawsuit, filed in the U.S. District Court for the Northern District of California, targets the company's privacy and billing practices.
According to the complaint, Hims & Hers shared private health information with third-party advertising platforms, including Meta and Snap, using tracking technologies and customer lists. Beyond privacy breaches, the FTC accuses the company of deceptive billing, claiming it charged consumers for prescriptions almost immediately after they submitted intake forms. This occurred despite company promises that charges would only be processed after a medical provider had completed a consultation.
Additionally, the FTC alleges that Hims & Hers intentionally obstructed users attempting to end their services. While the company introduced online cancellation in 2023, the lawsuit claims the cancellation button remained hidden behind multiple navigation steps to discourage users from leaving. This creates a scenario where consumers are unknowingly locked into recurring subscriptions while their most private health information is disclosed to third parties without consent.
Regulatory Implications
This legal action underscores a growing regulatory crackdown on the intersection of health data privacy and aggressive subscription models. By utilizing "dark patterns" to prevent cancellations and leveraging ad-tech tracking for medical services, Hims & Hers has become a focal point for how the government views the protection of digital health records. The case signals that the FTC and state attorneys general are increasingly unwilling to tolerate the use of standard advertising trackers when sensitive medical intake is involved.
Legal Framework and Next Steps
The lawsuit alleges multiple legal violations, including breaches of the FTC Act and the Restore Online Shoppers’ Confidence Act. It further cites violations of the Utah Consumer Sales Practices Act and California’s False Advertising and Unfair Competition Laws.
As the case proceeds in the Northern District of California, the industry will be watching for a potential settlement or a court-mandated overhaul of how telehealth platforms handle patient data and subscription transparency. The outcome may set a new precedent for the direct-to-consumer prescription market, forcing companies to decouple their medical intake processes from third-party advertising ecosystems.