FTC and Two States Sue Hims & Hers Over Alleged Health Data Sharing and Billing Practices

Federal and state regulators have opened a major consumer-protection case against one of the largest direct-to-consumer telehealth brands. On July 29, 2026, the Federal Trade Commission, joined by two states, sued Hims & Hers, a company known for online weight loss, men's health, and other subscription care, alleging that it broke privacy promises and used deceptive billing. The company denies the claims. Because this is a complaint rather than a judgment, nothing has been proven, and the allegations will now be tested in court.

Who filed the case and where

According to the FTC's announcement, the Commission was joined by the State of Utah and the State of California, the latter acting through Los Angeles County Counsel, in filing a complaint against Hims & Hers in the U.S. District Court for the Northern District of California. The FTC said its Commissioners voted 2 to 0 to authorize the filing. The action follows an investigation that, according to reporting on the case, began in 2023.

The health data allegations

The core privacy allegation is that Hims & Hers shared consumers' sensitive health information with third-party advertising platforms operated by Meta and Snap, even though the company told users it protected their privacy. The FTC alleges the company used third-party tracking technologies that automatically transmitted user activity, described in the complaint as 'Events,' to those advertising platforms. In plain terms, the government alleges that data reflecting people's interactions with a health service reached large advertising companies in a way that consumers were not clearly told about.

It is important to be precise about status here. The FTC is alleging this conduct. Hims & Hers has not admitted it, and a court has not ruled on whether it occurred or whether it broke the law.

The billing and cancellation allegations

Separately, the complaint targets how the company charged and retained subscribers. The FTC alleges that Hims & Hers failed to clearly disclose that it charges consumers for prescriptions almost immediately after they submit an intake form, even though its messaging suggested that users would first be able to consult a medical provider to find a treatment that is right for them. The complaint also alleges that the company made subscription cancellation unnecessarily difficult, and it notes that, prior to 2023, canceling required contacting customer service by phone, email, or chat.

The laws the regulators are invoking

The complaint pulls in both federal and state consumer-protection law. On the federal side, the FTC cites the FTC Act, which prohibits unfair or deceptive acts or practices, and the Restore Online Shoppers' Confidence Act (ROSCA), which governs how online subscriptions and negative-option billing must be disclosed and canceled. Utah cites the Utah Consumer Sales Practices Act, and California cites its false advertising and unfair competition laws. Christopher Mufarrige, Director of the FTC's Bureau of Consumer Protection, said in the announcement that the agency will act on behalf of consumers deprived of the ability to choose which products they want and whether to keep their most sensitive health information private.

How Hims & Hers has responded

Hims & Hers has publicly denied wrongdoing, characterizing the lawsuit as unsupported and disputing the FTC's account. On the day the suit was filed, the company also published a blog post about its approach to privacy. Multiple outlets reported that the company's stock fell sharply on the news; CNBC reported shares dropped about 10 percent. Investors and consumers should treat the company's statements and the government's allegations as competing positions that a court has not yet weighed.

Why this matters for telehealth patients

Direct-to-consumer telehealth typically collects highly sensitive information: the conditions you ask about, the medications you are prescribed, and how you pay. When you use these services you often agree to privacy policies and to recurring subscription billing. This case is a reminder that the promises companies make about protecting that information, and the clarity of their billing, are enforceable expectations, not marketing fine print. It is also a reminder that an FTC complaint is the start of a legal process, not its conclusion.

This is general information, not legal or medical advice. If you use an online health service and want to understand how your data is used or how to cancel a subscription, review the provider's current privacy policy and billing terms, and contact the provider directly. To learn how we assess telehealth companies, including on trust and transparency, see our methodology.

What happens next

Because the FTC filed in federal court rather than announcing a settled order, the allegations will move through litigation. The company can contest the claims, and any finding of liability, or any monetary or injunctive relief, would come from the court or from a settlement the parties might reach later. No such outcome exists today. The practical takeaway for readers is that the case is pending, and the company's conduct has not been adjudicated.