Five States Join FTC Lawsuit Accusing Hims & Hers of Sharing Health Data With Advertisers
Five States Join FTC Lawsuit Accusing Hims & Hers of Sharing Health Data With Advertisers
Five U.S. states joined the Federal Trade Commission’s lawsuit against telehealth company Hims & Hers Health on Tuesday, November 10, 2026, expanding a case that accuses the company of sharing customers’ sensitive health information with advertising platforms despite promising privacy — and of misleading users about billing and cancellation.
The amended complaint, filed in the U.S. District Court for the Northern District of California, adds Arizona, Florida, Nebraska, Ohio and Wisconsin as co-plaintiffs. They join the FTC, Utah and California, which brought the original lawsuit in July along with Los Angeles County Counsel. Hims & Hers denies the allegations and says it will defend itself vigorously. No court has ruled on any of the claims, and nothing in the case has been proven.
Five more states join the case
The FTC announced the expanded complaint on Tuesday. The five new states allege that Hims & Hers violated their consumer-protection laws, in addition to the federal claims already in the case: the FTC Act and the Restore Online Shoppers’ Confidence Act, a 2010 law governing online subscription billing.
The original lawsuit was filed on July 29, 2026, after a nearly three-year investigation. The FTC authorized the filing on a 2-0 commission vote. The case is Federal Trade Commission et al. v. Hims & Hers Health, Inc., No. 3:26-cv-07871.
The expansion matters because it widens both the legal exposure and the political weight behind the case. Seven states now stand behind the FTC’s claims, and the new plaintiffs can seek remedies under their own consumer-protection statutes. For a company built on trust — customers share intimate medical details through its website and app — the central question is whether its privacy promises matched its data practices.
What the FTC alleges Hims & Hers did
The complaint makes two broad sets of allegations: that the company shared sensitive health information with advertisers, and that it deceived customers about billing and cancellation.
Customer lists sent to advertisers
According to the complaint, Hims & Hers compiled email addresses from people who created accounts to seek specific treatments and from people who submitted medical intake forms, then uploaded those lists to advertising platforms so the platforms could match customers to their accounts.
Between September 2020 and June 2023, the company uploaded about 14 million email addresses to Meta, and Meta matched about 10 million of them to user identifiers, the complaint says. Between March 2020 and September 2023, it built 90 so-called Lookalike Audiences, and the audience names stated the treatment outright, including “All Time Hims ED Purchasers” and “Hers Apollo Signups.” Snap received customer lists the same way, and five of those lists held more than a million email addresses each.
The service lines named in the complaint include erectile dysfunction, premature ejaculation, hair loss, weight management and mental health — conditions many customers would reasonably expect to stay private. California’s claim alleges the sharing continued through at least May 2024.
Tracking pixels on the website
The second alleged mechanism is tracking technology embedded in the company’s own website. The complaint says the Meta Pixel and Meta’s server-side Conversions API sent customer activity back to Meta approximately 8 million times. Pixels from at least 13 other advertising platforms were also present on the site, among them Microsoft, Google, Criteo, Pinterest, Reddit, StackAdapt, TikTok, The Trade Desk and X.
Hims & Hers has said its privacy policy explains its data practices and that patients can choose how their information is used. The FTC’s position is that the company’s public promises of privacy were not matched by what it actually did with the data.
Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection, said when the case was filed that the complaint describes consumers “unknowingly locked into recurring subscriptions and the disclosure to third parties of consumers’ most private health information without their consent.”
Billing and cancellation complaints
The billing allegations are separate from the privacy claims, but they are central to the case. The FTC says Hims & Hers promised customers a free consultation with a medical provider and a private, secure process — then charged them for automatically renewing prescription subscriptions almost immediately after intake, before most of them ever learned what they had been prescribed.
The complaint also alleges the company made subscription cancellation unnecessarily difficult, a practice regulators sometimes call a “dark pattern.” The Restore Online Shoppers’ Confidence Act requires clear disclosure of subscription terms and a simple way to cancel. The FTC says Hims & Hers failed on both counts.
How Hims & Hers is responding
Hims & Hers has rejected the claims outright. In a public statement, the company said the lawsuit “disregards substantial evidence we provided the FTC during its nearly three-year investigation, ignores established state laws and industry standards in telehealth, and contorts the law to try to manufacture claims.”
Related Articles
“This is not enforcement grounded in consumer protection; it is an effort to generate headlines at our expense,” the company said. “We are confident in our position and will vigorously defend ourselves against these baseless claims.”
In October, Hims & Hers asked a federal judge to dismiss the lawsuit, arguing that customers were told how much their prescriptions would cost and when they would be charged again, and that its privacy policy already informed customers that some personal information could be shared with advertisers. The company has set aside about $60 million for the legal dispute, although it is unclear how much the case could ultimately cost. A hearing on the motion to dismiss is scheduled for January 7, 2027, before U.S. District Judge Vince Chhabria.
Hims & Hers reported nearly 2.9 million subscribers in the second quarter of 2026, an increase of 19 percent from a year earlier. Its shares fell roughly 12 percent on the day the lawsuit was first announced in July.
Why this matters
The case reaches beyond one company. Telehealth has become a mainstream way Americans get care, from hair-loss treatment to weight-loss drugs and mental health support. Customers hand over medical histories, symptoms and payment details through a website, trusting that the information stays between them and their provider. If regulators prove that a major telehealth brand routed that information to advertisers, it could reshape how the entire industry handles data — and how closely consumers read privacy policies.
The billing allegations matter for a different reason. Subscription health services charge customers month after month, and the amounts add up in household budgets already stretched by rising prices. Regulators have made subscription traps a priority across industries, and the FTC’s case argues that Hims & Hers enrolled people in recurring charges before they had even spoken to a doctor.
The case also tests the limits of health-data enforcement. The complaint does not bring a claim under the FTC’s Health Breach Notification Rule. Instead, it treats the alleged sharing as deceptive advertising and an unfair business practice — a theory that, if it succeeds, could be applied to other companies that promise privacy while sharing data with ad platforms.
What happens next
The amended complaint must still be answered in court. Hims & Hers has not yet filed its formal response to the expanded case, and the January 7 hearing on its motion to dismiss will be the next major date. If the judge allows the case to proceed, discovery will follow, and the five new states will press their own claims alongside the FTC, Utah and California.
For customers, the practical advice from regulators is unchanged: review subscription terms before signing up for any telehealth service, check cancellation options, and report suspected deception to the FTC at ReportFraud.ftc.gov. The case is a government enforcement action, so consumers do not join it, and there is no claim form, settlement fund or payout at this stage.
Frequently asked questions
What is Hims & Hers accused of doing?
The FTC alleges the company shared customers’ sensitive health information with advertising platforms including Meta and Snap despite promising privacy, and misled customers about billing — charging them for recurring prescription subscriptions before a medical consultation and making cancellation difficult. Hims & Hers denies the allegations.
Which states joined the lawsuit on November 10?
Arizona, Florida, Nebraska, Ohio and Wisconsin joined as co-plaintiffs in the amended complaint. They join the FTC, Utah and California, which filed the original lawsuit in July 2026.
Has Hims & Hers been found guilty of anything?
No. A complaint is an accusation, not a finding. No court has ruled on the allegations, and Hims & Hers has asked the judge to dismiss the case. A hearing on that request is scheduled for January 7, 2027.
What should Hims & Hers customers do?
Customers who believe they were misled about billing or privacy can report it to the FTC at ReportFraud.ftc.gov. The case is a government enforcement action, so there is no claim form or payout for consumers at this stage.
The FTC’s case against Hims & Hers began as a federal lawsuit in July and has now grown into a multi-state enforcement action. With five more states behind it, a dismissal hearing set for January and nearly three million subscribers watching, the outcome will say a great deal about how far telehealth companies can go in sharing the health information their customers trust them to protect.
Sources: Reuters; dig.watch; TipRanks; LegalScoops; Kainjoo Institute. Case: Federal Trade Commission et al. v. Hims & Hers Health, Inc., No. 3:26-cv-07871 (N.D. Cal.).
