FTC, California and Utah sue Hims & Hers over health data sharing
A first-of-its-kind FTC privacy case against a telehealth company could change how health sites track visitors and handle subscriptions, including for weight-loss treatments.
On July 29, 2026, the Federal Trade Commission, California and Utah filed a lawsuit against Hims & Hers Health, Inc. in federal court in San Francisco, accusing the telehealth company of sharing users' sensitive health information with advertising platforms and of deceptive billing and cancellation practices [1][2]. The case is the current FTC's first enforcement action targeting tracking pixels and unauthorized health-data sharing with third-party ad platforms, according to a law firm analysis of the complaint [1].
The government says Hims & Hers promised users their health information would stay "private" and be seen "only by medical providers," then shared that data with advertising companies including Meta (Facebook) and Snap (Snapchat) [2]. According to the allegations, tracking pixels and similar tools sent information about users' health conditions — including mental health, sexual health and prescriptions — to those ad platforms [2]. The complaint also alleges the company disclosed health information through customer lists and online tracking technologies that transmitted details about what consumers did on its website [1].
The complaint separately alleges that Hims & Hers enrolled consumers in recurring prescription subscriptions and charged them before they had a chance to consult with a medical provider [1]. It further alleges the company failed to clearly disclose certain subscription terms and made canceling a subscription difficult [1]. The FTC says those practices violate the FTC Act and the Restore Online Shoppers' Confidence Act; Utah and California also allege violations of their own consumer protection laws [1]. The agencies are seeking injunctive relief, monetary relief and civil penalties [1].
The action is part of a wider push on health data collected through website tracking technology. On August 5, 2026, a patient filed a proposed class action against University of Colorado Health in federal court in Colorado, alleging the health system put Meta's tracking pixel on its website — including a tool patients use to find doctors — and that the pixel sent health-related searches, appointment information, IP addresses and Facebook IDs to Meta without patients' consent [2]. That suit alleges violations of the Electronic Communications Privacy Act and HIPAA, and notes UCHealth serves nearly 3 million patients a year [2]. Separately, a consumer filed a class action against Amazon on February 10, 2026 in the Western District of Washington under Washington's My Health My Data Act [2]. Nevada has adopted a similar law, Connecticut added parts of it to its Data Privacy Act, and New York has a version moving through its legislature [2].
The allegations against Hims & Hers have not been proven in court, and no ruling in the case has been reported. A response from Hims & Hers has not been reported [1][2].
Why it matters for patients
Regulators are treating a broad range of data as health information. If a visit to a website about a treatment — including weight-loss treatment — can be linked to a specific person, that data may count as sensitive health information even if the company is not covered by HIPAA [2].
Much of that collection happens through pixels and similar tools that are common marketing infrastructure, which means patients often cannot tell from a privacy policy what is being shared or with whom [2]. The case also covers the whole customer experience, not just data: unclear subscription terms, being charged before seeing a provider, and difficult cancellation are all part of the complaint [1][2]. How telehealth companies write disclosures, take consent and handle cancellation could shift as this case moves forward.
Because the claims are untested, the outcome is not known. What the complaint does show is that privacy promises published on a health company's website can become the basis for a federal enforcement action when the government says the actual data practices did not match them [2].
What happens next
The complaint was filed on July 29, 2026 in federal court in San Francisco [1][2]. Hims & Hers has not yet answered the allegations in any publicly reported filing, and no trial date or ruling has been reported [1][2]. The UCHealth class action, also without a reported ruling, was filed on August 5, 2026 [2]. No settlement amounts, penalty figures or compliance deadlines have been disclosed in either matter.
Sources
- https://www.hunton.com/privacy-and-cybersecurity-law-blog/ftc-california-and-utah-sue-telehealth-company-hims-hers-for-deceptive-and-unlawful-privacy-practices
- https://www.beneschlaw.com/insight/emerging-enforcement-trends-in-digital-health-data-privacy-lessons-from-washingtons-my-health-my-data-ftc-vs-hims-hers-and-uchealth-enforcement-actions/
Semaglutides.org provides information only, not medical advice. Talk to a licensed provider about your own care before making changes. Some telehealth links are affiliate links and are labeled where they appear.