The Federal Trade Commission (FTC) has filed a lawsuit against telehealth company Hims & Hers, alleging that the firm shared customers' sensitive health information with advertising platforms including Meta and Snap, while also making it unreasonably difficult for consumers to cancel subscriptions and avoid unexpected charges.
According to the FTC's complaint, filed in the US District Court for the Northern District of California, Hims & Hers passed on details about customers' medical conditions and lists of specific patients to advertising platforms, using online tracking technologies embedded in its services. The regulator alleges this contradicted the company's own public assurances that its platform was "100 percent online, private, and secure," and that health information would only be accessible to its medical providers.
Hims & Hers offers online consultations and prescriptions for a range of conditions, including hair loss, erectile dysfunction, obesity and mental health disorders. The FTC's complaint states that the company's promises of confidentiality were "false or misleading" given the extent of data sharing with third-party advertising platforms.
The Register, which first reported the allegations, said it had contacted Hims & Hers for comment but had not received a response by the time of publication. The company did, however, publish a blog post on the day the lawsuit was filed, titled "Our Commitment to Privacy." The post did not refer to the FTC or the lawsuit directly, but encouraged customers to review the company's privacy policy and outlined internal practices intended to protect patient data, including separating clinical information from marketing activity and using techniques such as hashing to reduce the risk of identifying individual patients.
The statement did not address a separate set of allegations concerning the company's billing and cancellation practices, which form a significant part of the FTC's complaint.
Under the model described in the lawsuit, customers are told they will speak with a medical provider before receiving treatment, and that they will not be charged unless a prescription is approved. The FTC alleges that, in practice, most customers received no live consultation or opportunity to review a recommended treatment before being charged and automatically enrolled in a recurring subscription.
The complaint further alleges that Hims & Hers failed to clearly inform customers when prescriptions would next be refilled and billed, making it difficult for them to cancel in time to avoid paying for further months of medication they no longer wanted.
Before April 2023, customers wishing to cancel had to do so by phone, email or online chat. The company subsequently introduced an online cancellation option for most users, though not through its mobile apps. The FTC alleges that even this process remained deliberately convoluted. According to the complaint, customers were first required to navigate to a section of their account used for managing medications, and manually remove every prescribed medication from their subscription before a cancellation button would appear.
Even after clicking that button, the complaint states, the subscription was not immediately cancelled. Instead, customers were presented with between three and ten separate survey screens, each requiring further clicks, before being asked to reconfirm that they wished to proceed with cancellation.
The FTC, joined by the states of California and Utah, is seeking a court injunction to stop the alleged practices, along with monetary relief for affected consumers and civil penalties for breaches of consumer protection law.
Christopher Mufarrige, director of the FTC's Bureau of Consumer Protection, said the complaint described "a troubling scenario" in which consumers were locked into recurring subscriptions without clear consent, while sensitive health information was disclosed to third parties without their knowledge. He said the agency would continue to act on behalf of consumers whose ability to control their own health data and subscription choices had been undermined.
The case adds to a wider pattern of regulatory scrutiny facing telehealth and digital health platforms, which have expanded rapidly in recent years by offering online prescriptions for conditions traditionally requiring in-person consultation. Health data is subject to stricter protections than most other personal information under US law, and regulators have increasingly examined how tracking technologies used for advertising purposes intersect with obligations to safeguard patient confidentiality.
The lawsuit is at an early stage, and the allegations have not been tested in court. Hims & Hers has not publicly responded to the specific claims made in the FTC's complaint. The outcome of the case is likely to be closely watched by other telehealth providers, given the potential implications for how such companies handle patient data and structure subscription-based billing.
