The Federal Trade Commission has filed a comprehensive lawsuit against Hims & Hers Health, Inc., alleging that the telehealth giant compromised the sensitive medical information of millions of users and employed deceptive "dark patterns" to lock consumers into recurring subscriptions. The legal action, filed in a California federal court, marks a significant escalation in the federal government’s crackdown on digital health platforms that allegedly prioritize advertising revenue and growth metrics over patient confidentiality and consumer rights. According to the complaint, the San Francisco-based company, which specializes in direct-to-consumer prescriptions for sensitive conditions like hair loss, sexual dysfunction, and weight loss, systematically shared private health data with third-party advertising platforms including Google, Microsoft, and X (formerly Twitter), despite repeated marketing promises of "total discretion" and "medical-grade privacy."
The Core Allegations: Privacy Breaches via Tracking Pixels
At the heart of the FTC’s case is the company’s use of tracking pixels—small snippets of code embedded in websites that monitor user behavior. When a consumer visited the Hims or Hers websites to research treatments for erectile dysfunction, anxiety, or hair loss, these pixels allegedly captured their actions and transmitted that data to external tech giants. This information often included the specific types of medications users were interested in, their progress through medical intake forms, and their purchase history.
The FTC argues that this practice stands in direct contradiction to Hims & Hers’ public-facing image. For years, the company’s advertising campaigns have leaned heavily on the promise of a "discreet" experience, catering to individuals who might feel stigmatized by seeking treatment in person. By allegedly feeding this data into the advertising algorithms of third-party vendors, the company enabled those platforms to build more detailed profiles of consumers based on their private health concerns, which were then used for targeted marketing.
This data sharing occurred without the explicit, informed consent of the users, the FTC claims. While Hims & Hers maintained a privacy policy, the complaint suggests that the complexity of the tracking mechanisms and the company’s affirmative promises of secrecy effectively misled consumers about the true destination of their sensitive health information.
Deceptive Billing and Subscription "Dark Patterns"
Beyond the privacy concerns, the FTC’s lawsuit targets the company’s business model, specifically its subscription and billing practices. The commission alleges that Hims & Hers utilized "dark patterns"—user interface designs intended to manipulate users into making choices they might not otherwise make.
According to the complaint, the company made it unnecessarily difficult for customers to cancel their recurring subscriptions. Many patients reportedly found themselves "locked in" to auto-refills they no longer wanted or needed. The FTC alleges that the cancellation process was intentionally labyrinthine, requiring users to navigate multiple screens and overcome various hurdles designed to discourage them from ending their relationship with the service.
Furthermore, the lawsuit alleges that Hims & Hers failed to provide transparent pricing and billing information during the initial sign-up process. Specifically, the company is accused of charging customers for prescriptions almost immediately after they submitted an online intake form. This practice allegedly occurred even though the company’s marketing suggested that customers would have the opportunity to consult with a licensed healthcare provider before committing to a paid treatment plan. In many cases, consumers found their credit cards charged before a medical professional had even reviewed their file or determined if the medication was appropriate for them.
A Pattern of Regulatory Scrutiny in Telehealth
Hims & Hers is the latest in a series of high-profile telehealth companies to face federal action over data privacy and consumer protection. The FTC’s move follows a similar trajectory to its 2023 settlement with BetterHelp, an online counseling service. In that case, the FTC banned BetterHelp from sharing consumer health data for advertising purposes after it was revealed the company shared sensitive information with Facebook, Snapchat, and Pinterest. BetterHelp was also ordered to pay $7.8 million to settle the charges.
Similarly, in 2024, the telehealth platform Cerebral was ordered to pay a $7 million fine and was restricted from sharing sensitive data for marketing. The Cerebral case was particularly notable because it involved the disclosure of mental health data, including information about self-harm and substance abuse.
The scrutiny on Hims & Hers also comes at a time when the company has significantly expanded its footprint in the highly lucrative weight-loss market. Recently, the company began offering compounded versions of GLP-1 medications, similar to Ozempic and Wegovy, which has fueled a surge in its stock price and user base. The FTC’s intervention suggests that as these digital health platforms scale into major healthcare providers, they will be held to the same rigorous standards as traditional brick-and-mortar institutions regarding patient autonomy and data security.
Chronology of the Investigation and Corporate Response
The lawsuit follows a three-year investigation by the FTC into Hims & Hers’ internal practices. During this period, the commission reviewed internal communications, technical data regarding pixel implementation, and thousands of consumer complaints regarding billing and cancellation issues.
In response to the filing, Hims & Hers has issued a firm denial of the allegations. In a public statement, the company asserted that the FTC’s complaint "disregards the extensive evidence" provided throughout the multi-year inquiry. The company maintains that its data practices are designed with patient protection in mind and that it has always been transparent about how it handles user information.
Coinciding with the announcement of the lawsuit, Hims & Hers published a "Privacy Commitment" on its corporate website. The document outlines the company’s stance on data protection, claiming that it excludes specific information shared between patients and providers from its marketing activities. However, the FTC’s complaint suggests that the tracking pixels captured data before the formal provider-patient relationship was established—during the browsing and intake phases—which still constitutes a breach of consumer trust and privacy.
The Technical and Security Risks of Tracking Pixels
The use of tracking pixels in healthcare is a growing point of contention for privacy advocates and cybersecurity experts. A 2023 study published in the journal Health Affairs found that nearly 99% of non-federal acute care hospital websites in the United States used third-party tracking technologies. These pixels are often used for legitimate analytics, such as measuring website traffic or improving user experience, but in a healthcare context, they risk exposing Protected Health Information (PHI).
The risks are not merely theoretical. Research published in PNAS Nexus indicates that hospitals and healthcare providers utilizing third-party tracking pixels are 46% more likely to suffer a data breach. This is because these pixels create a conduit through which data flows to external servers, increasing the "attack surface" for potential hackers.
Hims & Hers has already experienced the consequences of such vulnerabilities. Earlier this year, the company confirmed that a hacker gained access to its third-party customer service platform through a social engineering scheme. While the company has not fully disclosed the volume of data compromised in that specific breach, the incident underscored the fragility of the digital ecosystems that telehealth companies rely on to manage patient records.
Broader Implications for the Digital Health Industry
The FTC’s legal action against Hims & Hers serves as a warning shot to the broader digital health industry. It signals that the commission is willing to use its authority under Section 5 of the FTC Act—which prohibits unfair or deceptive acts or practices—to regulate companies that may fall outside the strict jurisdiction of the Health Insurance Portability and Accountability Act (HIPAA).
Many direct-to-consumer health platforms operate in a regulatory "gray area" because they are not always considered "covered entities" under HIPAA. However, the FTC’s recent enforcement actions, including the invocation of the Health Breach Notification Rule in other cases, demonstrate that the government will treat the unauthorized sharing of health data as a deceptive practice regardless of a company’s HIPAA status.
"The FTC’s complaint lays out a troubling scenario—consumers unknowingly locked into recurring subscriptions and the disclosure to third parties of consumers’ most private health information without their consent," said Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection. His statement emphasizes that the commission views privacy and fair billing as inextricably linked to consumer safety in the digital age.
Conclusion and Future Outlook
As the case moves forward in federal court, the outcome will likely set a major precedent for how telehealth companies must handle patient data and manage subscription-based revenue models. If the FTC is successful, Hims & Hers could face significant financial penalties and be forced to overhaul its entire marketing and billing infrastructure.
For consumers, the lawsuit highlights the importance of scrutinizing the privacy policies of digital health platforms. While the convenience of getting a prescription for hair loss or weight management through a smartphone app is undeniable, the FTC’s allegations suggest that this convenience may currently come at the cost of personal privacy and financial transparency. The digital health industry now faces a critical turning point: it must reconcile its aggressive growth strategies with the fundamental ethical and legal requirements of the healthcare profession. For now, Hims & Hers remains a central figure in a legal battle that will define the boundaries of privacy in the 21st-century medical landscape.
