FTC, two states take aim at Hims & Hers’ subscription and health-data practices

On July 29, 2026, the Federal Trade Commission (FTC), joined by the States of California and Utah, sued Hims & Hers Health, Inc. (Hims), alleging that the telehealth company enrolled consumers in prescription subscriptions without adequately disclosing the terms, made subscriptions difficult to cancel, and shared sensitive health information with advertising platforms despite promises to consumers that the information would remain private. The complaint, filed in the US District Court for the Northern District of California, raises claims under the FTC Act and the Restore Online Shoppers’ Confidence Act (ROSCA), as well as under California and Utah consumer-protection laws. The FTC vote authorizing the complaint passed 2-0.

Hims has publicly denied the allegations. The company says the lawsuit “disregards substantial evidence” provided during the FTC’s nearly three-year investigation into Hims’ practices and “contorts the law to try to manufacture claims.” The allegations remain unproven, and the case will ultimately be decided by the court.

The Hims action comes amid the FTC’s broader focus on healthcare enforcement. In March 2026, FTC Chairman Andrew Ferguson launched a new Healthcare Task Force to coordinate enforcement and advocacy across the agency and identify emerging healthcare enforcement priorities. Against that backdrop, the lawsuit offers important lessons for telehealth, subscription-commerce, and consumer-health-data businesses, particularly around how subscription terms are presented, how consumers may cancel subscriptions, and how sensitive information is shared with advertising platforms.

In this article, we summarize the FTC’s allegations and the practical compliance implications for telehealth, subscription-commerce, and consumer-health-data businesses.

How Hims’ subscription model works

Hims operates a direct-to-consumer telehealth platform offering prescription and non-prescription treatments for various conditions, including sexual health, hair loss, skin problems, mental health, and weight loss. Hims is neither a pharmacy nor a medical provider. Instead, it acts as an intermediary, collecting consumer information via an online medical intake process (the intake flow) and routing it to contracted medical providers and pharmacies.

According to the complaint, Hims sells its prescription products through automatically renewing subscriptions (often referred to as “negative-option” plans). In other words, unless a consumer affirmatively cancels, the subscription continues.

The FTC says consumers did not know when they were agreeing to pay

The FTC alleges that Hims’ advertising and intake flow led consumers to believe that submitting an intake form was risk-free – that they could “connect” with a provider for a “free consult” to determine whether a treatment was “right for them,” and that they “will only be charged if prescribed.” The final intake flow screen reportedly displayed “Due Now – $0” and a “Pay $0 today” button, reinforcing the impression that consumers were not yet making a financial commitment.

According to the FTC, however, most consumers never received a consultation. Instead, by submitting the intake flow, consumers allegedly authorized an immediate charge and enrollment in a recurring subscription as soon as a provider wrote a prescription, often before the consumer learned what treatment had been recommended. The FTC alleges that the key disclosure – that “if prescribed medication, you are purchasing an automatically-renewing subscription” – appeared only in small, low-contrast text beneath the submission button and used ambiguous “if prescribed” language. The complaint also alleges that Hims received several consumer complaints regarding this practice over several years but nonetheless continued the practice of automatic enrollment and charging.

The FTC says refill charges came earlier than consumers expected

The FTC also alleges that Hims did not adequately disclose when consumers would be charged for refills. According to the complaint, Hims routinely processed the first refill charge roughly 10 days before the consumer’s selected cadence – for example, on day 20 of a monthly subscription – and required consumers to cancel two days before that date to avoid the charge. The FTC alleges that consumers received little or no notice of the applicable cancellation deadline. According to the FTC, this made it more likely that consumers who wanted to cancel would miss the deadline and subsequently be charged for unwanted medication.

The FTC says Hims made cancellation unnecessarily difficult

The FTC alleges that, from at least 2019 through early 2025, Hims placed unnecessary hurdles in the subscription cancellation process. Before April 2023, most consumers could cancel only by contacting customer service by phone, email, or chat. Hims introduced an online cancellation process in 2023, but the FTC alleges that the cancellation option remained difficult to find. Consumers first had to select an “Add/remove items from order” button – the word “cancel” did not appear on the subscription page – then uncheck each item and navigate additional retention screens and survey questions before the cancellation would be accepted.

The complaint also points to differences in the cancellation experience across states. According to the FTC, Hims had already implemented simple, single-click cancellation in California and Colorado in 2022 but used the more complicated multistep cancellation process described above in other states.

The FTC says Hims’ data sharing conflicted with its privacy promises

The privacy allegations are a significant portion of the FTC’s case. According to the complaint, Hims prominently described its service as “100% online, private, and secure” and told consumers that their “medical records and sensitive information are only accessed by the medical providers managing [their] care.” The FTC alleges that this messaging is reinforced through influencer and offline advertising.

The FTC claims that, despite the privacy representations, Hims failed to disclose or adequately disclose that it shared sensitive health information provided by consumers with advertising platforms in two ways. First, Hims allegedly uploaded customer lists to advertising platforms to match customers to advertising platform accounts. Second, Hims allegedly used tracking technologies such as pixels and application programming interface (API) business tools that automatically transmitted information about consumers’ activity on Hims’ websites to advertising platforms. The complaint identifies pixels from several advertising platforms, including major search engines, social media networks, and programmatic advertising exchanges, that allegedly appeared on Hims websites.

Legal basis for the claims

The complaint includes nine legal claims under federal and state law.

The FTC bases its federal claims on two statutes:

• FTC Act Section 5 (Counts I–III). The FTC alleges deceptive privacy representations, failure to disclose health-data sharing, and deceptive intake practices regarding whether and when consumers would be charged and enrolled in subscriptions.
• ROSCA (Counts IV–VI). The FTC alleges that Hims failed to clearly and conspicuously disclose “material terms” of the transaction before obtaining billing information, failed to obtain consumers’ express informed consent before charging them, and failed to provide simple cancellation mechanisms. A ROSCA violation is treated as an unfair or deceptive practice under Section 5 of the FTC Act.

California and Utah also bring claims under individual state law. California alleges violations of its False Advertising Law and Unfair Competition Law, including alleged violations of the state’s Automatic Renewal Law and constitutional right to privacy. Utah brings a claim under its Consumer Sales Practices Act.

The complaint seeks a range of remedies, reflecting the different laws enforced by the FTC, California, and Utah. The FTC, proceeding under the FTC Act (Section 5) and ROSCA, seeks a permanent injunction, monetary relief, and other equitable relief, but does not seek civil penalties. California seeks injunctive relief, restitution, and civil penalties of up to $2,500 per violation under its False Advertising Law and Unfair Competition Law. Utah seeks a permanent injunction, monetary relief, an equitable accounting and disgorgement of Hims’ Utah revenue, and civil penalties under the Utah Consumer Sales Practices Act. The state plaintiffs also request attorneys’ fees and expenses under their respective laws, and all plaintiffs seek recovery of their costs in bringing the action.

Why this matters

The Hims action reflects an increasingly aggressive, multiagency enforcement posture at the intersection of subscription commerce and consumer health privacy. Several themes stand out and should be noted:

• An expansive view of “material terms” under ROSCA. The FTC treats the timing of the first charge, the point of subscription enrollment, and refill-charge dates as material terms that must be disclosed clearly and conspicuously before billing information is collected.
• Tracking pixels as a privacy-enforcement target. The complaint continues a line of FTC actions treating the deployment of advertising pixels and conversion APIs on health-related pages as a potential disclosure and consent failure, independent of any traditional data breach.
• Federal-state coordination. The joint filing of the complaint by the FTC with California and Utah authorities signals that companies may face overlapping federal consumer-protection, state unfair and deceptive acts and practices (UDAP), and state automatic-renewal exposure from a single course of conduct.
• Design choices as evidence of intent. The allegation that Hims deployed a simple cancellation flow in some states while using a more obstructive design elsewhere illustrates how interface (“dark pattern”) decisions can become central to an enforcement theory.

Recommended steps for companies

Telehealth, digital-health, and subscription-commerce companies should consider several near-term steps:

• Review what consumers see before they pay. Confirm that material subscription terms, including when the first charge occurs, what triggers enrollment, price, billing cadence, refill and cancellation deadlines, and health-data disclosure practices are presented clearly and conspicuously before billing information is collected. Companies should also be able to show when and how consumers agreed to those terms.
• Make cancellation easy to find and complete. Consider providing a simple cancellation mechanism through the same medium consumers used to enroll. Avoid hiding cancellation behind unrelated labels or unnecessary steps, and consider whether consumers receive a consistent cancellation experience and ability across jurisdictions.
• Know what your tracking technologies collect and share. Review the pixels, software development kits , APIs, and other tracking technologies used on consumer-facing websites and apps. Understand what information each technology transmits, where that information goes, and whether sensitive health or other information is being shared without appropriate consent.
• Make sure privacy promises and notices match actual practices. Review statements such as “private,” “discreet,” or “only accessed by your provider” against the company’s actual data-sharing practices, including sharing with advertising and analytics partners.
• Track complaints and what you do about them. The FTC emphasized Hims’ alleged awareness of consumer complaints and its failure to take action. Companies should have processes for identifying patterns in consumer feedback and documenting how they investigate and address potential problems. Unaddressed complaints may be used to support an inference that a company knew it was engaging in a problematic practice.

Conclusion

This case is a reminder that federal and state regulators are looking at the entire customer experience, from what consumers are told before signing up, to when and how they are charged, to how easily they can cancel. For companies handling consumer health information, this case also highlights the potential risks associated with advertising technologies that may transmit sensitive consumer information.

The allegations against Hims remain unproven, and Hims has said it will vigorously contest them. But the complaint provides a useful roadmap for companies reviewing their own subscription, cancellation, privacy, and data-sharing practices.

If you have questions about the Hims & Hers action or your company’s subscription, advertising, or health-data practices, please contact any of the authors or your regular McDermott Will & Schulte lawyer.