On July 29, 2026, the Federal Trade Commission (FTC), joined by Utah and Los Angeles County, filed a complaint against telehealth company Hims & Hers Health Inc. in the Northern District of California, alleging a pattern of deceptive conduct spanning its subscription enrollment, cancellation, and health data privacy practices. The complaint alleges violations of Section 5 of the FTC Act, the Restore Online Shoppers’ Confidence Act (ROSCA), and state consumer protection laws. The action was authorized by a 2–0 FTC vote.
What Conduct Is Alleged?
The FTC’s allegations focus on three areas.
Billing and subscription enrollment without consultation
Hims & Hers is a San Francisco-based company that provides telehealth services and direct-to-consumer prescription medications. Consumers complete an online intake form that is reviewed by a medical provider before treatment is prescribed. The company advertised that consumers could consult with a medical provider to determine whether they need prescription medication. Consumers provided billing information based on assurances they would not be charged unless and until medication was prescribed.
The FTC alleges that most consumers did not receive an actual provider consultation. Instead, by submitting the intake form, consumers were charged and enrolled in a recurring prescription treatment plan, without an opportunity to review or approve it. The FTC also alleges that Hims & Hers failed to clearly and conspicuously make all material disclosures related to subscription plans, including when prescriptions would be refilled each month, making it difficult for consumers to cancel before the next billing cycle.
Difficult cancellation practices
The complaint alleges that before 2023, most consumers were only allowed to cancel their subscriptions by contacting customer service by phone, email, or chat.
Although Hims & Hers introduced online cancellation in 2023, the FTC alleges that the company continued to make cancellation unreasonably difficult by hiding the cancellation function. According to the complaint, the cancellation button appeared only after a consumer first selected “add/remove items from order” and navigated through several additional steps before seeing the word “cancel.”
Health data sharing with third-party advertisers
The complaint alleges that Hims & Hers shared consumers’ sensitive health information with third-party advertising platforms despite promising to protect their privacy. According to the FTC, this sharing occurred in two ways:
- Direct sharing of customer lists. Hims & Hers allegedly shared lists identifying certain customers with advertising platforms, enabling targeted advertising based on consumers’ health conditions.
- Third-party tracking technologies. The company allegedly deployed tracking tools on its website that automatically shared website visitor “Events”—including health-related browsing activity—with advertising companies.
The allegations are particularly significant because consumers seeking telehealth services routinely disclose sensitive personal health information, such as specific medical conditions, during the intake process and reasonably expect it to remain confidential.
What Legal Violations Are Alleged?
The complaint asserts claims under both federal and state law.
- Section 5 of the FTC Act. The FTC alleges that the company’s representations about provider consultations, billing, and privacy protections were materially misleading to consumers.
- Restore Online Shoppers’ Confidence Act. ROSCA prohibits charging consumers for goods or services sold in online transactions unless the seller clearly and conspicuously discloses all material terms, obtains the consumer’s informed consent, and provides a simple mechanism for cancellation. The complaint alleges the company’s subscription practices violated each of these requirements.
Importantly, the FTC appears to be expanding what it considers to be the “material terms of the transaction” from those that only relate to the transaction itself, such as the amount the consumer will be charged, the frequency of billing, and how the consumer can stop future charges. In its complaint against Hims & Hers, the FTC alleges that the company’s failure to disclose its practice of sharing consumers’ health data with third-party advertising platforms was also a material term.
- Utah Consumer Sales Practices Act. Utah alleges that the company’s practices violated the state’s consumer protection statute, which prohibits deceptive and unconscionable sales practices.
- California False Advertising Law and Unfair Competition Law. Los Angeles County alleges violations of California’s False Advertising Law and Unfair Competition Law based on the same underlying conduct.
What Happens Next?
Unlike many recent FTC enforcement actions in the consumer protection space, including the Instacart and Xponential Fitness matters we have previously covered, this action is a newly filed complaint, not a settlement.
The FTC files a complaint when it has “reason to believe” that the named defendants are violating or are about to violate the law and the FTC cannot, or chooses not to, resolve the issues with the company in a pre-complaint settlement agreement.
The FTC and Hims & Hers will now litigate the agency’s claims in the Northern District of California. The case could proceed to trial if the parties do not reach a resolution.
What Should Companies Watch For?
This complaint provides an important warning for telehealth companies, subscription-based businesses, and any consumer-facing digital company that collects sensitive personal information. Key compliance takeaways include:
- Obtain informed consent before billing. Companies that advertise consultations or evaluations before charging should ensure that consumers have a genuine opportunity to receive the promised service and affirmatively consent to charges. Enrolling consumers in a billing plan at the same time they complete an intake form, especially without a clear, separate consent step, creates significant ROSCA and Section 5 risk.
- Provide simple, conspicuous cancellation mechanisms. The complaint reinforces the agency’s ongoing focus on cancellation processes. Companies offering subscription services online should provide a simple and easy method for cancellation. Burying cancellation behind multiple unrelated navigation steps is likely to attract enforcement attention under ROSCA.
- Clearly disclose subscription terms and renewal dates. ROSCA requires that all material terms of a subscription—i.e., pricing, renewal dates, and how to cancel—be clearly and conspicuously disclosed before a consumer is charged. Under the Hims & Hers complaint, the FTC is also treating, at least in this case, health data sharing practices as material terms. Companies should review their enrollment flows to ensure key information is presented in a way consumers are likely to see and understand.
- Understand the expanding scope of “material terms” under ROSCA. For the first time, the FTC is alleging that a company’s failure to disclose its health data sharing practices violated ROSCA’s material terms disclosure requirement. Historically, the FTC treated “material terms” under ROSCA as limited to terms relating to the financial transaction itself, such as price, billing frequency, and how to stop future charges. If a court endorses the FTC’s broader reading, it could create a slippery slope for what qualifies as a material term—for example, the country of origin on a manufactured good could be deemed material. Because ROSCA violations can subject companies to monetary penalties, companies should evaluate their disclosure practices with this expanded scope in mind.
- Audit health data sharing practices with advertising platforms. Companies that collect sensitive health information should carefully evaluate whether any of that data is being transmitted to advertising platforms through tracking pixels, SDKs, or customer list uploads. Privacy promises must be backed by actual data practices.
- Prepare for multijurisdictional enforcement. The complaint demonstrates that the FTC is increasingly partnering with state attorneys general and local prosecutors to bring coordinated enforcement actions. Companies operating nationally should ensure compliance not only with federal requirements but also with the consumer protection and privacy laws of the states in which they operate.
What Does the Complaint Signal?
The Hims & Hers complaint is another example of aggressive enforcement by the FTC’s Bureau of Consumer Protection related to disclosure issues.
In 2026, the FTC has brought a series of settlements and enforcement actions, many in partnership with states. The trend is likely to continue throughout the remainder of the year.
The complaint also reflects the FTC’s broader interpretation of what qualifies as a “material term” under ROSCA. The agency is not limiting that concept to the financial terms of a transaction.
This approach is significant because ROSCA violations can expose companies to civil monetary penalties, giving the FTC a path to consumer redress and monetary relief that has otherwise been more difficult to obtain since the Supreme Court’s decision in AMG Capital Management LLC v. FTC.
We will continue to monitor the case and provide updates as it develops.
If you have any questions, or would like additional information, please contact one of the attorneys on our Consumer Protection/FTC team.
You can subscribe to future advisories and other Alston & Bird publications by completing our publications subscription form.