Hims FTC lawsuit targets health-data sharing and cancellation practices

The Hims FTC lawsuit accuses Hims & Hers of sending sensitive customer health information to advertising platforms and pushing customers into recurring subscriptions without the clear consent the company promised. The Federal Trade Commission filed the case in the US District Court for the Northern District of California with partners from California and Utah, seeking injunctions, consumer relief and civil penalties, with no dollar amount or affected-customer total disclosed.

Hims & Hers sells online care and medication access for conditions including hair loss, erectile dysfunction, obesity and mental health disorders. According to the FTC complaint, the company shared health-related customer data with Meta, Snap and other advertising platforms, both through customer lists and online tracking technologies.

For telehealth operators, the case goes directly at two systems that drive growth: performance marketing and subscription refills. The FTC is arguing that the company’s privacy representations and billing flows were not just poor product design, but violations of consumer protection law.

What does the FTC allege Hims did?

The FTC says Hims & Hers told users its process was “100 percent online, private, and secure” and led consumers to believe that medical information would be viewed only by Hims medical providers unless the consumer consented to wider disclosure. The agency says those representations were false or misleading because health information tied to medical conditions was disclosed to third parties.

Online tracking tools are code used to measure user activity and send events to outside platforms. In a healthcare funnel, those events can expose sensitive signals about what condition a person researched, what treatment flow they entered or what product was recommended.

Hims & Hers published a blog post titled “Our Commitment to Privacy” on the day the FTC filed the case. The post did not mention the lawsuit or the FTC, and instead directed users to review the company’s privacy policy. In the post, Hims & Hers said its internal practices are designed to protect user information, including separating information patients share with healthcare providers from marketing activity, configuring technology to avoid sending protected health information, and using abstraction and hashing to reduce identifiable information.

The FTC’s complaint also challenges Hims & Hers’ billing flow. The agency says the company’s websites told customers they could consult a medical provider and would not be charged unless medication was prescribed. The complaint alleges that many customers did not receive a consultation or a chance to approve a recommended treatment before a prescription triggered a charge and recurring subscription enrollment.

The agency also says Hims & Hers failed to make refill timing clear enough for customers to cancel before being billed for months of medication. Before April 2023, most customers had to cancel through customer service by phone, email or online chat, according to the complaint. After the company added website cancellations for most customers, the FTC says the option was still difficult to find and was not available through its mobile apps.

According to the complaint, customers had to go into an account area for adding or removing medications, uncheck all prescribed medications, then click a cancellation button. Even after that, the FTC says users had to answer roughly three to 10 survey screens and confirm again that they wanted to cancel before the company accepted the request.

Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection, said the complaint describes consumers being put into recurring subscriptions without understanding the terms and having private health information disclosed to third parties without consent. The case now moves into litigation unless the parties reach a resolution.

This story draws on original reporting from The Register.