Federal regulators have accused one of the largest direct-to-consumer telehealth companies of routing customers’ health conditions to advertising platforms while marketing itself on privacy.
The Federal Trade Commission, joined by Utah and by California through Los Angeles County Counsel, sued Hims and Hers Health on July 29 in federal court in San Francisco. The complaint alleges the company shared sensitive health information about medical conditions with third-party advertising platforms despite promising privacy, and separately alleges deceptive billing and cancellation practices.
None of this has been proven. The company disputes the allegations and says it will defend itself. A complaint is an accusation, and the court has made no findings.
The reason it matters to readers who have never used the platform is the category. The conditions named are the ones people specifically seek online care for because they do not want to discuss them in person.
What the Complaint Says Moved, and Where
The alleged mechanism is a tracking pixel, a small piece of code embedded in a web page that reports visitor activity back to a third party. Pixels are ordinary infrastructure across commercial websites. They become a health privacy question when the page being tracked reveals a medical condition.
According to the complaint as reported by TechCrunch, the company placed trackers supplied by Meta and Snap as well as Microsoft, Pinterest, Reddit, and X. The FTC also alleges the company uploaded lists of certain customers to advertising platforms, a separate practice from pixel tracking that matches known customer identities against platform user accounts.
The service lines named in reporting on the complaint include erectile dysfunction, premature ejaculation, hair loss, weight management, and mental health. The FTC’s contention is that the company advertised privacy and discretion for exactly these categories while the data pipeline ran the other direction.
Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection, said in the agency’s announcement that the complaint describes “consumers unknowingly locked into recurring subscriptions” alongside disclosure of private health information without consent.
The Billing Allegations Sit Alongside the Privacy Ones
The complaint pairs the data claims with allegations about money, which is unusual and is part of why the case is being watched.
Regulators allege the company advertised free consultations and displayed language indicating no payment was due at intake, then charged consumers and enrolled them in recurring subscriptions once a provider wrote a prescription, in some cases before any consultation had occurred. The complaint further alleges that cancellation was made difficult, leaving some customers paying for refills they did not want.
The cited legal authorities are the FTC Act and the Restore Online Shoppers’ Confidence Act, a 2010 statute governing online negative-option billing, which requires clear disclosure of terms, informed consent before charging, and a simple cancellation mechanism.
The company has responded firmly. In statements reported by BioPharma Dive and others, Hims and Hers called the claims baseless, said its privacy policy makes clear that users may choose how their data is used, and said it is confident in its position. It did not explicitly deny the specific factual allegations in the statements reported.
A Pattern the Agency Has Pursued Before
This is not a novel theory of enforcement. The FTC brought similar actions against GoodRx and BetterHelp in 2023, and against the telehealth startup Cerebral and the alcohol recovery provider Monument, in each case alleging that consumer health data reached advertising platforms through website technology.
The industry has responded to that pressure. Pixel deployment on hospital websites fell from about 98 percent in 2021 to roughly 30 percent in 2025, according to tracking data compiled by health marketing analytics firm Hedy and Hopp and reported by Bloomberg Law. That figure describes hospitals rather than direct-to-consumer telehealth, and should not be read as a measure of the latter.
One legal point is worth understanding because it surprises people. Most direct-to-consumer telehealth platforms operate in a space where HIPAA’s application is contested or limited, which is part of why the FTC rather than the HHS Office for Civil Rights is the agency bringing this case. Consumers frequently assume that anything involving a prescription is covered by federal medical privacy law. That assumption does not reliably hold for app-based commercial health services.
Steps for Anyone Who Has Used a Telehealth Platform
Nobody should stop needed treatment over a privacy dispute, and nothing here suggests any medication is unsafe. The relevant actions are about accounts and settings.
Check advertising controls on the platforms named. Meta, Google, and other services allow users to review and delete off-site activity that businesses have shared, and to limit how that data informs ad targeting. Those controls are typically found under account settings labeled activity, ad preferences, or data sharing.
Review recurring charges. Anyone enrolled in a telehealth subscription can check the current billing terms, the renewal date, and the cancellation process, and should document the date and method of any cancellation request. Consumers who believe they were charged without consent can dispute the charge with their card issuer and file a complaint with the FTC at ReportFraud.ftc.gov.
For future care, consider that browsing a condition-specific page on a commercial health site is not equivalent to a conversation in an exam room. Care delivered through a health system patient portal generally does sit under HIPAA. That is a meaningful difference for anyone who considers the condition itself sensitive.
Several things remain unresolved. The company has not filed its formal response. No court has ruled on any allegation. How many consumers were affected, what specific data elements moved, and what remedy regulators will seek are all matters for the litigation. MedicalDaily will report the company’s answer and any rulings.
Frequently Asked Questions
What did the FTC allege? That Hims and Hers shared consumers’ sensitive health information with third-party advertising platforms despite promising privacy, and separately deceived users about billing and cancellation.
Have the allegations been proven? No. The complaint was filed July 29, 2026, and no court has made findings. The company calls the claims baseless and says it will defend itself.
What is a tracking pixel? A small piece of code embedded in a web page that reports visitor activity to a third party. It becomes a health privacy issue when the page reveals a medical condition.
Which platforms are named? Reporting on the complaint identifies Meta and Snap along with Microsoft, Pinterest, Reddit, and X.
Does HIPAA cover telehealth apps? Not always. Many direct-to-consumer platforms operate outside or at the edges of HIPAA, which is why the FTC rather than HHS is bringing this action.
What can users do now? Review ad and data-sharing settings on the named platforms, check subscription billing terms and cancellation processes, and document any cancellation request.
Has the FTC done this before? Yes. It brought similar cases against GoodRx and BetterHelp in 2023, and against Cerebral and Monument.