SAN FRANCISCO – For millions of Americans seeking treatment for conditions they would not discuss in a doctor’s office lobby, the appeal of telehealth has always been privacy. Federal regulators said Wednesday that Hims & Hers charged admission to that private consultation, then sent the guest list to Facebook.
The Federal Trade Commission, joined by state attorneys general from California and Utah, filed suit Wednesday against Hims & Hers Health, Inc. in federal court in San Francisco, alleging the telehealth platform shared customers’ sensitive health data with Meta and Snap without consent, enrolled users in recurring subscriptions without clear disclosure, and built deliberate barriers into its cancellation process. The commission authorized the complaint unanimously.
The data-sharing allegations cut directly to what Hims & Hers sells. The company, founded in 2017 and publicly traded, built its market by offering Americans a discreet path to treatment for sexual wellness conditions, weight management, hair loss, and anxiety. Its intake forms invite users to describe symptoms and health history in detail. The FTC’s complaint alleges the platform was transmitting that detail to Meta through tracking technologies embedded in its website, technologies that Meta uses to build targeted advertising audiences based on the behavioral signals they capture. Customer information was also shared with Snap and other advertising platforms, the agency said.
Christopher Mufarrige, the director of the FTC’s Bureau of Consumer Protection, said the complaint described patients who were “unknowingly locked into recurring subscriptions” while their “most private health information” was being disclosed to third parties “without their consent.” The allegation, he said, went beyond a technical compliance failure. CBS News reported that the company’s shares fell nearly 15% on Wednesday when the filing became public.
The billing allegations in the Federal Trade Commission’s complaint add a second layer of concern. The FTC accused Hims & Hers of charging users for prescriptions immediately after they submitted their intake forms, before any clinical consultation had taken place, despite the platform’s framing of the sequence as the opposite. Before 2023, the only way to cancel a Hims & Hers subscription was by phone, email, or live chat. After 2023, the company added a cancellation button but hid it behind multiple navigation steps, the agency said.
Hims & Hers called the allegations “baseless” and said it would defend itself in court. “Our customers have the information they need to make informed decisions about their care and the use of our services,” the company said in a statement. Its privacy policy, the company said, makes clear that users “may choose how their data is used” and that information shared with healthcare providers is “used only in providing care.” The FTC’s complaint alleges precisely the opposite was true in practice.
The case lands at a structural tension that has been building inside the telehealth sector for years. The COVID-19 pandemic accelerated a regulatory loosening that brought millions of new patients into virtual health platforms, many of them for conditions they had never sought treatment for before. What those patients did not always understand is that their health data, when shared with a telehealth company rather than a licensed physician’s practice, does not automatically receive the protections the Health Insurance Portability and Accountability Act provides. Whether a telehealth platform’s advertising tracking tools qualify as a “business associate” relationship under HIPAA has been answered inconsistently by courts. That legal ambiguity is precisely the space the FTC’s unfair and deceptive practices authority was designed to occupy.
The distinction matters for patients who believed they were covered. Traditional physicians operate under a binding legal duty to protect health information. A telehealth company that routes patient data through Meta’s advertising infrastructure cannot claim that duty as a shield. Privacy advocates have flagged this gap for years, arguing that millions of Americans using digital health platforms operate under a false sense of protection. Wednesday’s complaint, if the FTC’s allegations hold in court, would stand as the federal government’s most significant attempt to close it using existing consumer protection law rather than waiting for Congress to modernize HIPAA.
The complaint was filed under the FTC Act, the Restore Online Shoppers’ Confidence Act, and state consumer protection statutes in California and Utah. California’s participation was handled through the Los Angeles County Counsel’s office, making this a multi-jurisdictional action rather than a solo federal suit. The agency is seeking financial penalties and injunctive relief. The dollar amount at stake was not specified in the filing.
Whether Wednesday’s suit signals broader scrutiny of the telehealth industry’s data practices, or stops at Hims & Hers, is not yet clear. The company is one of the most prominent players in a sector whose competitors offer similar services for similarly sensitive health categories. The FTC did not say whether other platforms are under investigation. Hims & Hers has not publicly identified which health conditions were captured in the data it shared with advertisers, or the number of users whose information was transmitted. Those details, if they emerge at all, are likely to surface in the litigation itself.
