FTC sues Hims & Hers over health data sharing, billing practices

The Federal Trade Commission sued Hims & Hers Health, alleging the telehealth company shared sensitive user health data with Meta and Snap and misled patients about billing and cancellation practices on July 29, 2026. Utah and California joined the case, and Hims & Hers shares fell 13% on the news.

The complaint puts a hard edge on what many patients may have believed they were agreeing to when they used an app to answer medical questions and sign up for care. Regulators say Hims & Hers told consumers it would protect their privacy, but instead allowed health information to flow into advertising systems built to target users across the internet. The FTC also alleges the company charged patients before they met with providers and made subscriptions difficult to cancel.

Hims & Hers built its brand on direct-to-consumer telehealth, using an app-driven model to sell quick access to treatments. That business model depends on online advertising and performance marketing to bring in customers, which makes the company’s data handling central to how it operates. The FTC’s case suggests regulators believe the privacy promises around that model did not match the company’s actual practices, especially when health information was combined with ad-tech tools used for tracking and targeting.

The lawsuit lands in a sector that has grown rapidly as telehealth, weight-loss treatments and men’s and women’s health services draw heavy consumer demand. It also fits a broader enforcement pattern. In February 2023, the FTC ordered GoodRx to stop sharing consumers’ sensitive health information for advertising. In July 2023, the FTC and the U.S. Department of Health and Human Services warned hospital systems and telehealth providers about the privacy and security risks created by online tracking technologies.

FTC guidance says businesses collecting or sharing consumer health information should not assume HIPAA alone shields that data, because many digital-health companies fall outside HIPAA’s core covered-entity framework. The Hims & Hers case tests how that warning plays out when a health brand operates more like a consumer app than a traditional clinic, and it may force tighter rules on privacy disclosures, ad partnerships and subscription billing across the telemedicine industry.