Hims & Hers patients may have shared more than symptoms and treatment concerns when they sought care online.
The Federal Trade Commission (FTC) has filed a lawsuit against Hims & Hers, alleging that the company allowed advertisers to collect and share sensitive patient information while telling customers their health information would remain confidential. The complaint, filed with support from California and Utah, also alleges deceptive billing and subscription practices, including charging some customers before consultations with healthcare providers and making it difficult to cancel recurring subscriptions.
The company has responded, claiming it did nothing wrong. In a statement, Hims & Hers said the FTC’s lawsuit ignores evidence it provided during the agency’s investigation and maintains that its practices complied with applicable laws and industry standards. Separately, the company points to its privacy policy, which says users “may choose how their data is used.”
What is Hims & Hers, and why does this case even matter?
Hims & Hers is a San Francisco-based telehealth company that connects patients with licensed healthcare providers online. Built around digital onboarding, recurring subscriptions, and direct-to-consumer care, the platform relies on consumers to share deeply personal medical information.
That is what makes the FTC’s lawsuit particularly significant.
At the center of the case is patient trust — the expectation that sensitive health information shared for treatment will remain confidential. According to the commission, Hims & Hers used tracking technologies to monitor users’ activity across its websites. The commission said it shared that information with Meta, Snap, and other third-party vendors, despite assuring consumers otherwise.
If those allegations are proven, the impact could extend beyond the company. Patients who lose confidence in how telehealth platforms handle their medical information may be less willing to seek care online or to disclose details essential for accurate diagnosis and treatment.
Subscription practices have drawn scrutiny before
The commission also claims that some Hims & Hers users were automatically charged before service was rendered, despite the company stating otherwise — a practice the commission says has generated many complaints.
Still on that, the FTC further alleges that Hims & Hers relied on platform design to keep users subscribed, making it unnecessarily difficult to cancel recurring payments once they had signed up. The commission specifically alleges that Hims & Hers hid the online unsubscribe button from easy view, making it harder for customers to cancel recurring subscriptions.
Hims & Hers won’t be the first company to be called out for allegedly employing shady tactics in making it difficult for users to opt out of recurring payments.
In 2025, Amazon agreed to a $2.5 billion payout over making Prime subscriptions hard to cancel. More recently, the FTC scored a win against Shutterstock, which it says used automatically renewing subscriptions, unclear pricing and renewal terms, and difficult cancellation processes that led consumers to incur charges without fully informed consent.
What this means for anyone using telehealth
Whether the FTC ultimately prevails or not, the lawsuit highlights a broader reality: health-related data have become some of the most valuable information people generate online. Advertising companies see them as a way to deliver highly targeted marketing, cybercriminals view them as lucrative targets for fraud and identity theft, and regulators are paying closer attention to how companies collect, use, and share them.
For users, the case serves as a reminder that privacy concerns extend beyond traditional data breaches. Even when a healthcare platform is not hacked, questions can still arise about whether sensitive information is being shared in ways patients never expected. As more medical services move online, consumers may want to pay closer attention to privacy policies, consent settings, and subscription terms before sharing personal health information.
At the heart of the lawsuit is a simple expectation shared by most patients: information disclosed while seeking medical care should be used only for the purposes they understand and have agreed to. Whether the FTC can prove Hims & Hers violated that expectation will now be decided in court, but the outcome could influence how telehealth companies handle patient data for years to come.
Related reading: For a broader look at today’s data security landscape, check out our analysis of IBM’s 2026 Cost of a Data Breach report and its biggest takeaways for organizations.