Privacy & Cybersecurity Law Blog

The Federal Trade Commission, along with the Utah and California State Attorneys General, recently sued Hims & Hers Health, Inc., alleging that the telehealth company unlawfully shared consumers’ sensitive health information and engaged in deceptive billing and subscription cancellation practices.

According to the complaint, Hims & Hers shared information about consumers’ medical conditions with third-party advertising platforms despite representations that it would protect consumers’ health information. The complaint alleges that Hims & Hers disclosed this information through customer lists and online tracking technologies that transmitted information about consumers’ activity on the company’s website.

The complaint also alleges that Hims & Hers enrolled consumers in recurring prescription subscriptions and charged them before they had an opportunity to consult with a medical provider. The complaint further alleges that the company failed to clearly disclose certain subscription terms and made subscription cancellation difficult.

The FTC alleges violations of the FTC Act and the Restore Online Shoppers’ Confidence Act. Utah and California also allege violations of their respective state consumer protection laws. The agencies seek injunctive relief, monetary relief, and civil penalties.

Notably, the Hims & Hers lawsuit marks the current FTC’s first enforcement action targeting tracking pixels and unauthorized health data sharing with third-party ad platforms. The agency’s allegations of deceptive subscription and billing practices are consistent with recent FTC enforcement actions and other FTC enforcement activity, reflecting the agency’s continued focus on deceptive subscription and billing practices as an enforcement priority.