FTC health-privacy case puts telehealth advertising data under scrutiny

The Federal Trade Commission and regulators in Utah and California have sued Hims & Hers, alleging that the telehealth company shared consumers’ sensitive health information with advertising platforms while promising that its online services were private and secure.

The complaint, filed July 29, 2026, in the U.S. District Court for the Northern District of California, also accuses Hims & Hers of deceptive prescription charges, recurring subscriptions and difficult cancellation procedures. The allegations have not been adjudicated, and the court will decide the case.

What regulators allege about health data

The FTC, Utah Division of Consumer Protection and Los Angeles County, acting for California, say consumers provided medical information through Hims & Hers intake forms and used the company’s websites and apps while being told that their information would be protected.

According to the complaint, Hims & Hers shared customer lists and website activity with Meta, Snap and other advertising platforms. Regulators allege that third-party tracking technologies automatically transmitted information about visitors’ actions on the company’s websites, including activity that could reveal or allow inferences about a person’s health interests or condition.

The FTC alleges that those practices conflicted with Hims & Hers’ privacy representations. The agency is pursuing claims under Section 5 of the FTC Act, which bars unfair or deceptive acts or practices, while the state plaintiffs assert parallel consumer-protection claims.

The complaint describes alleged sharing and tracking practices; it does not establish that Hims & Hers sold medical records or that a court has found a data breach.

Why billing is part of the same case

The lawsuit also challenges how Hims & Hers allegedly enrolled customers in prescription subscriptions. Regulators say consumers were asked for billing information during the online intake process and were often charged and enrolled in recurring treatment plans shortly after submitting an intake form, before having a meaningful opportunity to review or approve the recommended prescription.

The complaint alleges that Hims & Hers did not clearly disclose when refill charges would occur. It also says the company made cancellation difficult, including by hiding or complicating the online cancellation path after that option was introduced for most consumers in 2023.

The FTC is using both the FTC Act and the Restore Online Shoppers’ Confidence Act, a federal law that addresses disclosures, consent and simple cancellation for certain online negative-option transactions. Utah and California seek remedies under their own consumer-protection laws.

HIPAA is not the only privacy framework

The case highlights a point that can be missed when consumers think about online health services: HIPAA is not the only source of privacy obligations.

FTC business guidance says companies that collect, use or share consumer health information may also have obligations under the FTC Act and the FTC’s Health Breach Notification Rule. The guidance explains that HIPAA applies to covered entities and business associates, while the FTC Act can apply to deceptive or unfair practices involving consumer health information more broadly.

That means a company’s public privacy promises, website design and behind-the-scenes tracking practices can all matter. The FTC has warned that sharing sensitive health information for advertising, or using tracking tools in ways that contradict privacy representations, may create enforcement risk.

Company disputes the allegations

Hims & Hers says the lawsuit is baseless and that the FTC disregarded evidence provided during its investigation, as well as state laws and telehealth industry standards. The company said it intends to defend itself vigorously.

In its quarterly filing with the Securities and Exchange Commission, Hims & Hers disclosed that it had recorded an approximately $60 million legal-contingency accrual as of June 30, 2026, for estimated probable losses connected with the matter. The filing cautioned that the amount could increase or decrease materially as the litigation develops. The accrual is not a fine, settlement or final judgment.

The filing also disclosed a separate putative consumer class action asserting claims based on substantially the same underlying facts. That case has not been certified as a class action, and the filing of either lawsuit does not establish liability.

What consumers should watch

The case remains pending. There is no final court finding of liability, automatic refund program or confirmed data-breach determination arising from the FTC complaint. The litigation could lead to requests for injunctive relief, monetary remedies or changes to the company’s data, advertising, billing and cancellation practices.

For consumers using telehealth services, the practical warning is broader than this one company. Before submitting an intake form, review the privacy, advertising, refill and cancellation terms. If an unexpected recurring charge appears, save receipts, screenshots, notices and records of cancellation attempts. A privacy promise can matter legally when a company’s actual data practices differ from what consumers were told.

Sources

Look for updates to this story

Discover more from Interactive News

Subscribe to get the latest posts sent to your email.