FTC Alleges Hims & Hers Shared Patients' Health Data While Quietly Enrolling Them in Paid Subscriptions

Key Takeaways

• FTC Targets Telehealth Practices: The FTC, joined by Utah and California, has sued Hims & Hers, alleging deceptive billing, subscription, and privacy practices in federal court.
• Consumers Allegedly Charged Before Consultation: Regulators claim most consumers were billed and automatically enrolled in recurring prescription subscriptions shortly after submitting an intake form, despite expecting to consult with a healthcare provider first.
• Health Data Shared With Advertising Platforms: The complaint alleges Hims shared consumers' sensitive health information with third-party advertising platforms, including Meta and Snap, through customer lists and website tracking technologies while promising to protect patient privacy.
• Cancellation Process Under Scrutiny: The FTC alleges Hims made subscriptions difficult to cancel by requiring cumbersome cancellation methods and later obscuring the online cancellation option behind multiple navigation steps.

Deep Dive

Someone looking for treatment through Hims & Hers could reasonably believe they were beginning a conversation with a medical provider. The company's advertising invited them to connect with a clinician, discuss their symptoms, and determine whether a prescription made sense. According to the Federal Trade Commission, many consumers were doing something else entirely. They were setting a recurring subscription in motion before that conversation ever happened.

The complaint accuses the San Francisco-based telehealth company of misleading consumers about when they would be charged, making subscriptions unnecessarily difficult to cancel, and sharing highly sensitive health information with advertising platforms despite repeated assurances that patient privacy would be protected.

For a company built on reducing the friction between patients and healthcare, regulators argue Hims removed friction in only one direction. They allege that consumers were encouraged to believe they would first consult a medical provider to decide on an appropriate treatment while being told they would not be charged unless medication was prescribed. Yet after submitting an online intake form and providing payment information, most consumers, according to the complaint, were charged for prescription treatments almost immediately and automatically enrolled in recurring subscription plans. The FTC says many never had an opportunity to review or approve the prescribed treatment before the charge appeared.

The distinction matters because it changes what consumers believed they were consenting to. The intake form looked like the beginning of a medical evaluation. Regulators contend it functioned as the beginning of a billing relationship.

Consumer complaints cited in the lawsuit tell a familiar story. One customer wrote that they had been told they would speak with a doctor within a few days and that no charge would be placed on their card until then. Instead, the payment was processed immediately, before any consultation with a healthcare professional had taken place.

The FTC also argues that leaving proved considerably harder than signing up.

Until 2023, the agency says, most consumers could cancel subscriptions only by contacting customer service through phone, email, or online chat. When Hims later introduced online cancellation for most users, regulators allege the company simply buried the option beneath a series of unrelated menu selections. According to the complaint, customers first had to choose an option labeled "add/remove items from order" before working through several additional screens where the cancellation button eventually appeared.

The lawsuit's privacy allegations reach further still. Regulators say Hims disclosed consumers' sensitive health information to advertising platforms including Meta and Snap while promising patients that their information would remain private. According to the complaint, the company shared customer lists with advertising partners and used third-party tracking technologies that automatically transmitted information about visitors' activity on the Hims website. The FTC alleges those practices revealed information connected to consumers' medical conditions without their consent.

"The FTC's complaint lays out a troubling scenario—consumers unknowingly locked into recurring subscriptions and the disclosure to third parties of consumers' most private health information without their consent," Christopher Mufarrige, director of the FTC's Bureau of Consumer Protection, said in a statement announcing the lawsuit. "The FTC will not hesitate to act on behalf of consumers deprived of their ability to choose which products they want and whether to keep their most sensitive health information private."

The complaint alleges Hims violated both the FTC Act and the Restore Online Shoppers' Confidence Act, which governs recurring billing and subscription practices. Utah separately alleges violations of the Utah Consumer Sales Practices Act, while California alleges violations of the state's False Advertising and Unfair Competition laws.

‍The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.