FTC and State Regulators Allege Deceptive Health Data Sharing and Billing Practices Against Telehealth Provider Hims & Hers

What this means for your practice

This lawsuit serves as a critical reminder for all telehealth brands, medspas, dental practices, chiropractic offices, and other healthcare businesses operating digitally about the paramount importance of consumer privacy and transparent business practices. The allegations concerning the sharing of sensitive health information underscore the high regulatory scrutiny on how patient data is handled, particularly when interacting with third-party advertising platforms. Healthcare providers must ensure their privacy policies are not only robust but also accurately reflect actual data handling practices, and that explicit, informed consent is obtained for any data sharing beyond direct treatment. Furthermore, the focus on deceptive billing and difficult cancellation practices highlights the need for clear, unambiguous communication regarding pricing, subscription terms, and cancellation procedures to maintain consumer trust and avoid accusations of unfair or deceptive trade practices. Proactive auditing of data flows and consumer-facing policies is essential.

Washington, D.C. and State Capitols – The Federal Trade Commission (FTC), joined by the State of Utah and the People of the State of California, acting by and through Los Angeles County Counsel Dawyn R. Harrison, has initiated legal action against telehealth provider Hims & Hers Health, Inc. The lawsuit, filed in the Federal Court for the Northern District of California, alleges that Hims & Hers engaged in a series of deceptive practices concerning consumer privacy and billing transparency.

Core Allegations: Data Sharing and Deceptive Practices

The central thrust of the complaint revolves around two primary areas of alleged misconduct:

Sensitive Health Information Sharing

According to the FTC and state plaintiffs, Hims & Hers stands accused of sharing consumers’ sensitive health information with third-party advertising platforms. This alleged practice directly contradicts claims made by the company regarding the maintenance of consumer privacy. In the digital health landscape, the handling of sensitive health data is a critical area of focus for regulators and consumers alike. Telehealth providers are entrusted with deeply personal information concerning medical conditions, and any alleged breach of privacy representations can severely erode patient trust and result in significant regulatory repercussions. The complaint specifically highlights that the shared information pertained to consumers’ medical conditions, emphasizing the sensitive nature of the data involved.

Deceptive Billing and Difficult Cancellation Practices

Beyond data privacy, the lawsuit also targets Hims & Hers for allegedly deceiving users about its billing and subscription cancellation practices. Modern digital health services often rely on subscription models, which necessitate clear and straightforward terms for consumers. Allegations of deceptive billing can include hidden fees, unclear recurring charges, or failure to adequately disclose the full cost of services. Similarly, making it difficult for consumers to cancel subscriptions is a practice often scrutinized by consumer protection agencies, as it can trap users into unwanted recurring payments. These allegations speak to broader consumer protection principles that demand transparency and fairness in all commercial transactions, particularly in the healthcare sector where individuals may be vulnerable.

Regulatory Context and Significance

The involvement of both the FTC and state-level consumer protection agencies underscores the multi-faceted regulatory environment governing telehealth and digital health services. The FTC, operating under its mandate to prevent unfair methods of competition and unfair or deceptive acts or practices in commerce, actively monitors the digital marketplace for practices that harm consumers. State consumer protection laws often mirror federal statutes and empower state attorneys general and consumer protection divisions to pursue actions against companies operating within their jurisdictions.

This case represents a significant enforcement action against a prominent telehealth provider. It signals to the broader industry that claims of privacy must be substantiated by actual practices, and that consumer-friendly billing and cancellation processes are not merely good business practices but a regulatory expectation. The coordinated effort between federal and state agencies also highlights a growing trend of collaborative enforcement actions to address widespread consumer issues, particularly those impacting sensitive sectors like healthcare.

Broader Implications for Healthcare Businesses

The lawsuit against Hims & Hers provides crucial regulatory intelligence for all healthcare businesses leveraging telehealth, digital platforms, or subscription models. Operators across specialties, including medspas, dental practices, and chiropractic offices expanding their digital footprint, should take note:

• Data Privacy & Transparency: Revisit and rigorously audit all patient-facing privacy policies and internal data handling protocols. Ensure that disclosures about data sharing with third parties, especially for advertising or marketing purposes, are explicit, easily understandable, and obtain affirmative consent where required. Any promises of privacy must be strictly adhered to in practice. Understand that what constitutes 'sensitive health information' can be broad and requires diligent protection.

• Billing Clarity: Examine all billing practices to ensure complete transparency. This includes clear disclosure of all costs, whether services are one-time or recurring, and the exact terms of any subscription. Avoid any ambiguity that could lead consumers to believe they are paying for something other than what they agreed to.

• Accessible Cancellation Policies: Ensure that subscription cancellation processes are straightforward and easily accessible to consumers. Impeding cancellations can be construed as a deceptive practice. Cancellation instructions should be prominent and simple to execute, reflecting a commitment to consumer autonomy.

• Third-Party Vendor Management: If your practice utilizes third-party advertising or analytics platforms that receive consumer data, rigorously vet their data handling practices and ensure contractual agreements align with your privacy commitments and regulatory obligations. Understand what data is being shared, why, and with whom.

Conclusion

The Hims & Hers lawsuit serves as a potent reminder that innovation in healthcare delivery must be coupled with unwavering adherence to consumer protection and privacy principles. The regulatory landscape for digital health is evolving, and federal and state agencies are actively monitoring practices to safeguard consumer interests. For healthcare businesses, a proactive approach to compliance—focusing on ethical data stewardship, transparent communication, and fair business practices—is not just good practice, but a necessity to mitigate significant legal and reputational risks.

Key Facts

| Detail | Value | |---|---| | Plaintiffs | Federal Trade Commission; The People of the State of California, acting by and through Los Angeles County Counsel Dawyn R. Harrison; and Utah Division of Consumer Protection | | Defendant | Hims & Hers Health, Inc. | | Allegations | Shared consumers’ sensitive health information with third-party advertising platforms despite privacy claims, and deceived users about billing and cancellation practices | | Case Status | Pending | | Filing Date | July 29, 2026 | | Court | Federal Court, Northern District of California |

Frequently Asked Questions

What specific actions is Hims & Hers being sued for?

Hims & Hers is being sued for allegedly sharing consumers’ sensitive health information about medical conditions with third-party advertising platforms, and for allegedly deceiving users about its billing and subscription cancellation practices.

Which government entities are involved in this lawsuit?

The lawsuit was filed by the Federal Trade Commission, joined by the State of Utah and the People of the State of California, acting by and through Los Angeles County Counsel Dawyn R. Harrison.

What type of information was allegedly shared by Hims & Hers?

The lawsuit alleges that Hims & Hers shared consumers’ sensitive health information about their medical conditions.

Where was this lawsuit filed?

The lawsuit was filed in Federal Court in the Northern District of California.

What is the current status of the case?

The case status is currently pending.

Source: ftc.gov — FTC and States Sue Hims & Hers Over Alleged Deceptive Health Data Sharing and Billing