Hims CEO says FTC wanted a headline as shares recover past pre-lawsuit level
The FTC's suit over health-data sharing and subscription billing is still pending, and it describes practices that touch people buying weight-loss prescriptions online.
On August 18, Hims & Hers chief executive Andrew Dudum told CNBC that the Federal Trade Commission "wanted more of a headline than a real agreement here," after settlement talks in the agency's nearly three-year investigation failed [1]. The company's shares have since climbed back above where they traded before the FTC sued [1].
Hims & Hers stock fell about 15 percent, to $25.00, on July 29, the day the FTC and two states filed their complaint in the Northern District of California [1]. It closed at $31.10 on August 19, up 13.55 percent on the day [1]. The company continues to call the allegations baseless and has said it will "vigorously defend" the case, describing it as "an effort to generate headlines at our expense" [1].
The complaint runs 48 pages and nine counts. Hims operates a direct-to-consumer telehealth platform selling prescription and non-prescription treatments for conditions including hair loss, mental health and weight loss; it is not a pharmacy or a medical provider, and routes information collected through an online intake form to contracted providers and pharmacies [1][2]. The FTC authorized the filing on a 2-0 vote, with two of the five commissioner seats filled, and the plaintiffs are the FTC, the Utah Division of Consumer Protection and the People of the State of California [1].
The FTC alleges Hims shared sensitive health information with advertising platforms two ways: by uploading customer lists to be matched against platform accounts, and through pixels and API business tools that reported activity on its websites [1][2]. It also alleges the company charged some consumers before they spoke with a provider and that cancellation required multiple steps, with the word "cancel" not appearing on the subscription page [1][2]. Three of the nine counts are Restore Online Shoppers' Confidence Act claims that are not about data at all [1][2]. Hims has said its privacy policy "makes clear that they may choose how their data is used" [1].
Hims has put a dollar figure on the matter. A Form 10-Q filed August 10 reports a legal accrual of approximately $60 million as of June 30, against the $15 million disclosed three months earlier, and a legal-contingencies line of $62.5 million versus $0 at the end of 2025 [1]. The filing states that "good faith settlement negotiations with the FTC" were unsuccessful and discloses a follow-on class action, Doe v. Hims & Hers Health, Inc., filed in the same court under the federal wiretap statute and two California privacy laws [1]. The company warns the accrual "may decrease or increase materially in future periods" [1].
In the same quarter, Hims reported 2.891 million subscribers, up 19 percent year over year, U.S. revenue up 16 percent to $621.8 million, and monthly revenue per average subscriber up 21 percent to $92. It lost $86.3 million and its gross margin fell from 76 percent to 64 percent [1].
The FTC has brought similar health-data cases before. GoodRx paid a $1.5 million civil penalty in February 2023, and BetterHelp was ordered to pay $7.8 million that July, with roughly 800,000 people receiving refund notices in May 2024 [1]. A 2022 audit of 50 telehealth sites found 25 reporting cart adds or checkouts to at least one big technology platform [1].
Why it matters for patients
Many people now reach weight-loss and other prescriptions through telehealth sites rather than a doctor's office, and the case describes what can happen to the information entered along the way. According to the complaint, tracking code from at least fifteen advertising platforms ran on Hims' website, reporting activity from people on their way to prescriptions for conditions including weight loss [1].
A central point in the case is that HIPAA covers the provider group but generally not a telehealth company's marketing website, which is where the checkout page lives and where tracking code fires [1]. That means promises about privacy on a consumer health site are not automatically backed by the federal health-privacy law patients may assume applies.
The billing allegations matter separately: the FTC says consumers were enrolled in automatically renewing subscriptions, that first refill charges were processed roughly 10 days early, and that cancellation was harder than it needed to be in most states, even though California and Colorado had single-click cancellation in 2022 [2].
The allegations have not been proven, and no court has ruled on them.
What happens next
The case is pending, and the plaintiffs are asking the court to permanently bar the conduct and impose civil penalties of up to $2,500 per violation under two California statutes; the FTC itself is not seeking civil penalties [1][2]. The Doe class action is also pending. No trial date has been reported, and it has not been disclosed whether the alleged data sharing has stopped. The size of the accrual could change as the case proceeds [1].
Images from the sources
Sources
Semaglutides.org provides information only, not medical advice. Talk to a licensed provider about your own care before making changes. Some telehealth links are affiliate links and are labeled where they appear.