FTC v. Hims & Hers: health data, pixels and cancellation

Current as of October 21, 2026. Next review: on any filing or ruling in the case.

The short version

In July 2026 the FTC, joined by Utah and California, sued Hims & Hers. It alleges the company shared health information of millions of consumers with ad platforms, through pixels and customer-list uploads. The complaint says about 14 million email addresses were uploaded to Meta. It also alleges the company made cancelling hard. These are allegations; no court has ruled.
The case does not rely on HIPAA. It uses the FTC Act and ROSCA, which reach companies HIPAA does not.
The federal click-to-cancel rule is vacated, but state automatic-renewal laws still apply.

Paul’s take

Many DTC health brands reason: we don’t bill insurance, so HIPAA doesn’t apply, so we’re fine. The first half is often right. The conclusion isn’t. The exposure lives in the marketing stack.

There is a right way to do this. HIPAA’s privacy rule sets out how to de-identify health data. There are tools built to do it before anything reaches an ad platform. The shortcut is the easy button: upload the customer list, drop in the pixel, and send identifiable health information straight to the platforms. For a covered entity, that can be an impermissible disclosure of PHI. For a company outside HIPAA, the FTC Act can reach it if the practice is deceptive or unfair. In some cases, so can the Health Breach Notification Rule and state consumer-health privacy laws, such as Washington’s My Health My Data Act.

Doing it right takes some work, and it means having someone who knows these rules in the room when the marketing is designed. Companies racing to acquire customers skip this step, or don’t know it exists. Regulators and state attorneys general aren’t the only ones looking, either. Plaintiffs’ lawyers check websites for tracking problems, and they aren’t hard to find. And on cancellation: the federal click-to-cancel rule is gone, but the FTC is getting to the same place through ROSCA.

— Paul Albarrán

What did the FTC allege against Hims & Hers?

FTC v. Hims & Hers Health, Inc. is the FTC’s 2026 lawsuit over the telehealth company’s alleged health-data sharing, billing and cancellation practices. On July 29, 2026, the Federal Trade Commission (FTC) sued Hims & Hers Health, Inc. in federal court. The case is No. 3:26-cv-07871-VC in the U.S. District Court for the Northern District of California. The Utah Division of Consumer Protection and the People of the State of California, through Los Angeles County Counsel, joined the complaint. The FTC alleges that the telehealth company shared consumers’ health information with advertising platforms despite promising privacy. It also alleges misleading billing and cancellation practices. These are allegations, and no court has decided them.

The FTC further alleges that, after most consumers submit the online intake form, providers regularly prescribe without offering a consultation. According to the complaint, that is the point at which the company charges the consumer and enrolls them in a subscription.

Which laws does the complaint rely on?

The FTC’s six counts rest on two federal statutes. Section 5(a) of the FTC Act declares “unfair or deceptive acts or practices in or affecting commerce” unlawful. The Restore Online Shoppers’ Confidence Act (ROSCA) governs online sales made through a negative option feature.

A negative option is an offer in which the seller treats a consumer’s silence, or failure to cancel, as acceptance.

California pleads its False Advertising Law and its Unfair Competition Law. Utah pleads the Utah Consumer Sales Practices Act. The FTC’s release says the Commission vote authorizing the complaint was 2-0.

What does the complaint say about pixels and customer lists?

The FTC alleges that the company promised privacy in its marketing. One advertising claim the complaint quotes is a “100% online, private, and secure process.” According to the complaint, the company shared health information with Meta, Snap and other platforms through at least May 2024.

The complaint describes two methods, customer lists and pixel tracking. After the court denied sealing, the FTC filed an unredacted complaint on August 18, 2026, as docket entry 28. First, the unredacted complaint alleges that the company uploaded lists of consumer email addresses to Meta and to Snap. It alleges that the audience and list names revealed the treatments those consumers sought, including mental health and sexual health treatment.

Second, the FTC alleges that the company used Meta’s tracking tools on its website, the Meta Pixel and the Conversions API. The unredacted complaint alleges that these tools sent “Complete Registration” and “Purchase” events carrying identifiers and treatment details. The complaint also names pixels from at least 13 other advertising platforms on the company’s website.

Why can a company outside HIPAA still face health privacy claims?

In 2009, Congress recognized that some companies holding consumers’ health records were not subject to HIPAA’s privacy and security requirements. The complaint against Hims & Hers does not mention HIPAA. Its privacy counts allege that the company’s privacy promises were deceptive under Section 5 of the FTC Act.

A second federal rule also reaches health data outside HIPAA. The FTC’s Health Breach Notification Rule applies to vendors of personal health records and related entities not covered by HIPAA. Amendments effective July 29, 2024 clarify that a breach of security includes an unauthorized disclosure, as well as a data breach. They also clarify the rule’s coverage of developers of many health apps. A violation of the rule is treated as a violation of an FTC rule on unfair or deceptive practices, subject to civil penalties. The complaint does not cite the Health Breach Notification Rule.

In February 2023, the FTC announced a proposed order with GoodRx, its first action under the Health Breach Notification Rule. According to the FTC, GoodRx violated the FTC Act and failed to give notices the Health Breach Notification Rule requires. Under the proposed order, GoodRx agreed to pay a $1.5 million civil penalty. It would also be barred from sharing user health data with applicable third parties for advertising. The FTC later said the settlement imposed injunctive relief and a $1.5 million civil penalty. In May 2023, the FTC brought a second action under the rule, against the developer of the Premom ovulation app.

In March 2023, the FTC announced a proposed order with the online counseling service BetterHelp. The FTC said the proposed order requires $7.8 million for consumers, to settle charges that it revealed sensitive data for advertising.

What does ROSCA require for online subscriptions?

ROSCA makes it unlawful to charge consumers in an online negative option sale unless the seller meets three conditions. The seller must provide text that clearly and conspicuously discloses all material terms of the transaction before obtaining billing information. It must obtain the consumer’s express informed consent before charging. It must also provide simple mechanisms to stop recurring charges. ROSCA treats a violation as a violation of an FTC rule on unfair or deceptive acts or practices.

What does the complaint allege about cancellation?

The FTC alleges that before April 2023, most consumers had to contact customer service to cancel. It alleges that the later online path began with a button labeled “Add/remove items from order.” According to the complaint, the word “cancel” did not appear anywhere on that subscription page. The FTC also alleges that about three to ten survey questions followed before the company accepted a cancellation.

The complaint alleges that the company added simple, single-click cancellation in California and Colorado in mid-2022. It says California and Colorado consumers received that option due to new laws in those states.

Is the FTC’s click-to-cancel rule in effect?

No. The FTC’s 2024 amended Negative Option Rule, which required a simple cancellation mechanism, is not in effect. Some state automatic-renewal laws separately require simpler cancellation; California’s requires a way to cancel online when the consumer signed up online. The U.S. Court of Appeals for the Eighth Circuit vacated the 2024 rule on July 8, 2025. The case is Custom Communications, Inc. v. FTC, 142 F.4th 1060. The court held that the FTC failed to issue a required preliminary regulatory analysis. It vacated the entire rule and did not reach the other challenges.

Effective February 12, 2026, the FTC restored the rule’s pre-2024 text, which covers only prenotification plans. On March 13, 2026, the FTC published an advance notice of proposed rulemaking on possible amendments. Comments were due April 13, 2026. A Federal Register search on October 20, 2026 found no FTC proposed rule on negative options since then.

The court vacated a rule, not ROSCA, which is a statute. The FTC’s complaint against Hims & Hers pleads ROSCA directly.

What happens next in the case?

The FTC’s release states, “The case will be decided by the court.” The FTC’s case page, last updated August 31, 2026, still listed the case as pending on October 21, 2026. The court’s public docket, as read on October 21, 2026, showed no ruling on the claims. The entries after the complaint include sealing, scheduling and related-case orders. A case management conference was set for October 30, 2026.

What does the complaint show about FTC scrutiny of telehealth?

The complaint shows which practices the FTC examined in this case:

privacy claims in advertising, on websites and in influencer posts;
events and customer lists shared with advertising platforms;
what an intake form says about when a charge occurs;
when refills are charged, and how clearly that timing is disclosed;
how many steps it takes to cancel.

These are the FTC’s allegations against one company, and the court has not ruled on them. How the law applies to any other company depends on its own facts.

The information on this site is general information, not legal advice.