FTC, Utah, and California Sue Hims & Hers Over Billing Practices and Health Data Sharing
On July 29, 2026, the Federal Trade Commission, joined by Utah and California, filed suit against telehealth company Hims & Hers in the Northern District of California. The complaint alleges that Hims shared consumers’ condition-specific health information with third-party advertising platforms, including Meta and Snap, through both customer-list uploads and tracking pixels that automatically transmitted website “Events”—despite representations to users that Hims would not disclose consumers’ health information to third parties. The complaint also alleges that Hims enrolled consumers in recurring prescription subscriptions and charged them shortly after they submitted an online intake form, before they had connected with a provider, and made subscription cancellation unreasonably difficult. The FTC asserts claims under Section 5 of the FTC Act and the Restore Online Shoppers’ Confidence Act, while Utah and California assert state consumer protection and false advertising claims.
The case reflects the FTC and states’ continued use of general consumer protection laws to scrutinize digital health companies’ use of tracking technologies, advertising platforms, subscription practices, and privacy representations, as seen in recent regulatory actions involving BetterHelp and Flo Health. The complaint also reinforces that HIPAA is not the only privacy regime with meaningful enforcement risk. Even companies that fall outside HIPAA’s scope may face exposure under the FTC Act’s deception and unfairness theories, as well as increasingly active state consumer protection and false advertising laws, which may reach conduct that HIPAA does not, and often with broader remedies.
Professionals
