The U.S. Federal Trade Commission has filed a lawsuit against Hims & Hers.
The case has two central issues.
One is the privacy of health information in telehealth. The other is the way prescription drug subscriptions were billed and canceled. Together with Utah and Los Angeles County, California, the FTC alleges that Hims & Hers shared consumers’ sensitive health information with third-party advertising platforms and misled consumers about billing and subscription cancellation.
Hims & Hers is a San Francisco-based telehealth and direct-to-consumer prescription drug company. Consumers use the platform to seek treatment for issues such as hair loss, sexual health, skin care and weight management. They fill out an online intake form, receive review from a medical provider and may then obtain prescription treatment.
The central question is what consumers expected during that process.
Hims has presented itself as a service that connects consumers with medical providers and helps them determine whether treatment is appropriate. When consumers complete an online intake form, they provide sensitive information about their health status, symptoms and treatment interests.
That information is not ordinary shopping data.
It can reveal medical concerns, bodily conditions, possible diagnoses and interest in prescription medication.
The FTC’s complaint focuses on this point.
The agency alleges that Hims promised to protect patient privacy while sharing consumers’ health information with third-party advertising platforms such as Meta and Snap. It also alleges that Hims led consumers to believe they could consult a medical provider before deciding whether to proceed with treatment, while many consumers were charged and enrolled in prescription treatment subscriptions immediately after submitting the intake form.
The case exposes a dark boundary in telehealth.
Is the platform a medical service?
An advertising-driven growth company?
A subscription-commerce business?
A performance-marketing system built on health data?
The Hims & Hers lawsuit shows what can happen when all four models are combined inside one digital health platform.
What Kind of Company Is Hims & Hers?
Hims & Hers is one of the most visible digital health platforms in the United States.
Instead of visiting a clinic, users enter symptoms and health information through a website or app. A medical provider reviews the information, and the user may receive prescription medication or treatment products.
The model offers convenience.
It reduces the burden of booking and visiting a clinic. It also allows consumers to seek help for sensitive health concerns online, including hair loss, erectile dysfunction, skin conditions, mental health and weight management.
This direct-to-consumer healthcare model has grown quickly.
But the same structure creates regulatory risk.
Health information is among the most sensitive forms of personal data. When consumers enter health details into a telehealth platform, they expect a higher level of confidentiality than they would from an ordinary e-commerce site. Prescription subscriptions are also not simple product purchases. They combine medical judgment, billing and recurring delivery.
That means consumers must clearly understand when they will be charged, when a subscription begins, how they can cancel and with whom their health information will be shared.
The FTC’s lawsuit argues that Hims failed to meet those basic obligations.
The First FTC Concern: When Consumers Were Charged
The FTC alleges that Hims did not clearly disclose when consumers would be charged.
To use the service, consumers completed an online intake form and entered billing information. According to the FTC, Hims told consumers they could consult a medical provider and find treatment that suited them. The agency argues that this led consumers to believe they would not be charged until after a prescription was issued or treatment was confirmed.
The FTC claims the actual process was different.
According to the complaint, many consumers were charged for prescription treatment and enrolled in recurring subscriptions shortly after submitting the intake form, without a meaningful consultation with a medical provider. In other words, the agency alleges that consumers did not have a sufficient chance to review or approve the treatment plan before payment and subscription began.
This matters deeply in telehealth.
The moment a consumer enters billing information must be clearly distinguished from the moment an actual charge occurs. In a service involving medical judgment, consumers should be able to review the prescription, cost and subscription terms before explicitly agreeing.
The consumer complaints cited by the FTC illustrate this point.
One consumer said they believed they would be able to speak with a doctor days later and would not be charged that day. Instead, they were charged immediately and said they had not agreed to pay before speaking with a medical professional.
Billing is not only a user-interface issue.
It is a question of consumer choice.
The Second Concern: Subscriptions That Were Hard to Cancel
The FTC also alleges that Hims made subscriptions difficult to cancel.
Before 2023, many consumers had to contact customer service by phone, email or chat to cancel. The FTC claims Hims placed additional obstacles in the cancellation path, making it harder for consumers to stop recurring charges.
After Hims introduced online cancellation in 2023, the FTC argues that problems continued. The cancellation button was allegedly not easy to find. Consumers first had to choose options such as adding or removing items from an order, then pass through several steps before seeing the word “cancel.”
This connects directly to the problem of dark patterns.
A dark pattern is a design choice that nudges users toward decisions they may not want or makes it harder for them to exercise a choice. Subscription businesses often face scrutiny when they make sign-up easy but cancellation difficult.
Consumers may join with a few clicks, but cancellation may require navigating confusing menus, contacting support or passing through repeated retention screens.
The FTC alleges that Hims violated the Restore Online Shoppers’ Confidence Act, a U.S. law that prohibits deceptive billing and negative-option subscription practices.
In a subscription model, transparency is fundamental.
When will the consumer be charged?
What is the charge for?
When will the next refill or shipment occur?
Can the consumer cancel before the next billing date?
Is the cancellation button easy to find?
Are the subscription terms clear?
The FTC argues that Hims did not meet this standard.
The Third Concern: Health Data Used for Advertising
The most sensitive issue is the sharing of health information.
The FTC alleges that Hims shared consumers’ sensitive health information with third-party advertising platforms including Meta and Snap.
The complaint describes two broad mechanisms.
First, Hims allegedly shared certain customer lists with advertising platforms.
Second, it allegedly used third-party tracking technologies on its website that automatically shared visitor behavior information.
The FTC refers to this behavioral information as “Events.” These events can show what a consumer did on the Hims website. In a telehealth context, such data may not be ordinary clickstream information. Visiting a treatment page, completing a health questionnaire, selecting symptoms or expressing interest in a prescription category can all support sensitive inferences about a person’s health.
That is the key issue.
Health information is not limited to traditional identifiers such as names, medical records or insurance numbers. It can include what treatment a person searched for, what symptoms they selected, what medication they considered and which health category they explored.
For advertising platforms, this data can be valuable for targeting and conversion measurement.
For consumers, it can mean that their most private health concerns entered the advertising ecosystem.
If Hims promised to protect patient privacy, this kind of sharing could directly contradict consumer expectations.
That is why the FTC sees the issue not simply as data use, but as potential deception.
The Risky Combination of Telehealth and Ad Tech
The Hims case reveals a structural problem in digital healthcare.
Many online services grow through advertising technology. Meta pixels, Snap pixels, web-tracking events, conversion measurement, customer-list uploads and retargeting have become standard tools in digital marketing. In e-commerce, companies often track which products consumers view or add to a cart in order to improve advertising performance.
But when the same logic enters healthcare, the meaning changes.
A visit to a hair-loss treatment page.
A sexual-health questionnaire.
A skin-condition intake form.
Interest in weight-management medication.
A mental-health service search.
A prescription subscription.
These signals can reveal intimate health concerns.
The same data that improves advertising conversion can also be sensitive health information.
Digital health platforms want to grow like commerce companies.
But consumers trust them like healthcare providers.
The gap between those two expectations creates the problem.
Hims is a telehealth platform, but it is also a direct-to-consumer subscription business powered by online advertising. This hybrid model appears to be what drew the FTC’s attention.
Medicine sells trust.
Advertising technology requires tracking.
Those two worlds are colliding.
Patient or Conversion Customer?
The most important question in this case is how the consumer was treated.
When a consumer enters health information into Hims, they are close to being a patient. They are sharing sensitive bodily concerns and expecting medical judgment. In that relationship, they expect confidentiality and professional care.
Inside an advertising and subscription system, however, the consumer becomes a conversion customer. Completing an intake form becomes a funnel event. Entering billing information becomes a conversion signal. A prescription subscription becomes recurring revenue. Website behavior can be transmitted to advertising platforms, and customer lists may be used for targeting or measurement.
The FTC lawsuit exposes the collision between these two identities.
Was a consumer who should have been treated like a patient handled as an advertising conversion?
Did a consumer who expected medical consultation become an automatic subscription customer?
Did health information promised as private flow to advertising platforms?
As telehealth grows, these questions will become more important.
Digital healthcare companies can improve access and convenience. But convenience cannot come at the expense of medical ethics, consumer choice or privacy.
A patient can also be a customer.
But a customer should not be reduced to a conversion metric.
The FTC’s Message: Health Information Is Not Advertising Data
The FTC’s message is clear.
Health information should not be treated like ordinary advertising data.
Information entered into a telehealth service is deeply private. Sharing it with third-party advertising platforms requires clear notice, meaningful consent and purpose limitation. If a company promises to protect privacy, its actual data flows must match that promise.
The FTC’s consumer protection leadership described the complaint as involving consumers who were allegedly locked into recurring subscriptions without fully informed choices and whose most private health information was disclosed to third parties without proper consent.
This warning extends beyond Hims.
Health apps, weight-management platforms, mental-health services, prescription delivery services, genetic-testing companies, period-tracking apps and wellness platforms may all face similar questions.
What data is shared with advertising platforms?
Do web-tracking events reveal health inferences?
Do customer-list uploads expose health status?
Do privacy promises match real data flows?
Did consumers clearly understand and consent?
Digital healthcare privacy risk is not limited to database breaches.
Advertising tracking is also a privacy risk.
The Legal Claims: FTC Act and ROSCA
The FTC and its state and local partners allege that Hims violated multiple laws.
The FTC brought claims under the FTC Act and the Restore Online Shoppers’ Confidence Act. The FTC Act prohibits unfair or deceptive acts or practices. ROSCA targets deceptive online subscription and negative-option billing practices.
Utah alleged violations of the Utah Consumer Sales Practices Act. California authorities alleged violations of California’s False Advertising Law and Unfair Competition Law.
It is important to note that the lawsuit has not yet been decided by a court. A complaint represents the government’s allegations. Final judgment belongs to the court.
Still, the filing itself sends a strong signal to the telehealth industry.
Business models combining health data, advertising platforms, subscription billing and cancellation friction are likely to face more regulatory scrutiny.
The Case Is Also About Dark Patterns
The Hims lawsuit is not only about health privacy.
The allegation that subscriptions were difficult to cancel connects directly to dark-pattern regulation.
Dark patterns are interface designs that push users toward unwanted choices or make it difficult to exercise their rights.
Common examples include:
making sign-up easy and cancellation hard;
hiding important cost information in small text;
making a service appear free while recurring charges begin later;
placing cancellation buttons in hard-to-find menus;
forcing users through multiple persuasion screens;
or steering consumers into unwanted add-ons.
The cancellation flow described by the FTC resembles these concerns. Even if online cancellation exists, the consumer’s practical choice is weakened if the button is hidden or requires multiple confusing steps.
As the subscription economy grows, cancellation rights become an important consumer right.
Companies should not optimize only for sign-up conversion.
Cancellation must also be clear and easy.
This is especially true when the service involves health and prescription treatment.
The convenience of subscription should not become a mechanism for trapping consumers.
The Growth Formula of Digital Healthcare Is Under Pressure
Companies such as Hims & Hers represent a common digital healthcare growth formula.
Attract consumers through online advertising.
Lower the entry barrier through simple intake forms.
Offer prescription treatment through subscriptions.
Generate recurring revenue.
Use data to improve marketing efficiency.
This formula enabled rapid growth.
But the FTC lawsuit targets the weak points in that formula: the combination of online advertising and health data, intake forms and payment, prescriptions and subscriptions, convenience and consumer confusion.
The problem becomes especially serious when the consumer’s expectation of medical consultation differs from the platform’s operational flow. If a consumer believes they are entering a process to consult a doctor, but the system starts a subscription immediately after an intake form, trust erodes.
Digital healthcare can make access easier.
But if a platform treats medical trust like an e-commerce conversion funnel, regulatory risk rises. Practices that use health information for ad targeting and performance measurement are likely to face even stronger scrutiny.
Digital healthcare companies must now design privacy and billing transparency before growth marketing.
Lessons for Korean Telehealth and Healthcare Platforms
This case is not only an American issue.
Korea is also seeing growth in telemedicine, health-management apps, diet platforms, hair-loss services, skin-care platforms, mental-health services, medication delivery, hospital-booking apps and insurance-linked healthcare services. Many of these services use advertising platforms, web-tracking tools, app analytics, retargeting, subscription billing and automatic renewal.
The issue is the sensitivity of health information.
In Korea, health information is strongly protected as sensitive personal information under privacy law. Information related to illness, symptoms, medication, treatment and health status must be handled much more carefully than ordinary consumer data.
Korean platforms should examine the following questions.
Are user behavior events transmitted to advertising platforms?
Can treatment interests or disease-related signals be shared with external marketing tools?
Can customer-list uploads reveal health status?
How are intake data and billing data separated?
Does the consumer clearly approve prescription details and cost before subscription billing begins?
Is the cancellation button easy to find?
Are refill and next-billing dates clearly disclosed?
Do privacy promises match actual data flows?
When telehealth and prescription subscription models are combined, the sequence of medical judgment and payment is critical. If payment and subscription begin automatically while a consumer expects medical consultation, disputes can follow.
The lesson for Korean companies is clear.
Healthcare platforms should not simply import ordinary e-commerce UX.
Advertising Platforms May Also Face More Pressure
The FTC complaint directly targets Hims.
But over time, advertising platforms such as Meta and Snap may also face more pressure. Advertising platforms receive website and app event data for targeting, conversion measurement and lookalike-audience creation. If those events include health information or allow health inferences, the issue becomes more complex.
How far must advertising platforms go to control the nature of customer data they receive?
How should they prevent the transmission of sensitive health information?
Should healthcare advertisers face stricter data limits?
How should consumer consent and data-use purpose be verified?
The digital advertising ecosystem has long collected user behavior under labels such as “events” and “conversions.” In healthcare, those events can become sensitive data.
If advertising platforms treat them as ordinary marketing signals, regulatory risk will grow.
The Hims case may redraw the boundary between digital advertising and healthcare.
Health information is not raw material for advertising optimization.
Digital Healthcare Trust Is Decided by Billing and Data Flow
The lawsuit brought by the FTC, Utah and California against Hims & Hers exposes core risks in telehealth platforms.
Consumers complete online intake forms and provide sensitive health information. They expect to consult medical providers and find appropriate treatment. But the FTC alleges that Hims enrolled many consumers in prescription treatment subscriptions without sufficient consultation or approval, made cancellation difficult and shared sensitive health information with advertising platforms.
The essence of the case is not a simple privacy mistake.
It is a structural conflict created when digital healthcare combines medical service, subscription commerce, advertising technology and data marketing.
The patient expects privacy.
The platform optimizes conversion.
The consumer expects consultation.
The system designs recurring billing.
The user provides health information for medical purposes.
The data may flow into advertising platforms.
If this conflict is not resolved, trust in digital healthcare will erode.
The future of telehealth will not be built on convenience alone.
Subscription success cannot be measured only by retention.
The value of health data should not be converted into advertising efficiency.
Cancellation buttons, billing disclosures and data-sharing screens are now trust infrastructure.
The Hims case sends a warning to every digital healthcare company.
Once a platform presents itself as healthcare, it must meet a higher standard than ordinary commerce.
Patient trust is not proven by marketing language.
It is proven by real data flows and billing structures.
