FTC Sues Hims for Charging Patients Without Consent and Selling Health Data to Facebook

How Hims Turned Free Consultations Into Forced Subscriptions

Hims & Hers Health, Inc. built a telehealth empire on a simple promise: get a free consultation with a licensed medical provider, delivered privately and discreetly to your phone. The San Francisco-based company launched in November 2017 targeting men’s health conditions like erectile dysfunction and hair loss. By November 2018, it expanded to women’s health through its Hers brand. The pitch was frictionless healthcare for conditions people don’t want to discuss in person.

The reality, according to the 48-page federal complaint filed July 29, 2026, was a systematic scheme to charge consumers for medications they never agreed to purchase and trap them in subscriptions they couldn’t escape.

Here’s how the scheme worked. Consumers would see advertisements promising a “free consult” or “free online visit” with a medical provider. The ads appeared everywhere: social media, podcasts, television, radio. Influencers endorsed the service as “discreet” and “private.” The company’s own website assured consumers that their “medical records and sensitive information are only accessed by the medical providers managing your care.”

Consumers seeking treatment would complete an online medical intake form consisting of 25 to 50 questions about their health history. At the end of the intake flow, Hims displayed potential treatments with pricing and directed consumers to enter their billing and shipping information. The final screen prominently stated “Due Now: $0” and “Pay $0 today.” The submission button itself read “Pay $0 today.”

Reasonable consumers interpreted this to mean they weren’t purchasing anything yet. They believed they were simply submitting their information for provider review and would have the opportunity to consult with a doctor before making any financial commitment.

That belief was false.

In most states, Hims charged consumers immediately after a provider reviewed their intake form and wrote a prescription, without any subsequent interaction with the consumer. Most consumers were charged and enrolled in automatic subscription plans before they even learned what treatment the provider had recommended. There was no consultation. No dialogue. No opportunity to ask questions, consider alternatives, or decline the prescription.

The company structured this deliberately. As the complaint documents, Hims received thousands of consumer complaints over multiple years describing this exact problem. The complaints came through direct customer service contacts, Better Business Bureau filings, and public reviews on platforms like Trustpilot and the Apple App Store. Consumers repeatedly stated they did not expect to be charged immediately, did not consent to the subscription, and were never given the opportunity to speak with a provider.

The Subscription Trap: Hidden Refill Dates and Impossible Cancellation

Being charged without consent was only the beginning of the problem. Once enrolled, consumers discovered they were locked into subscription plans with refill charges processed 10 days earlier than the advertised subscription period and cancellation deadlines buried in fine print.

Hims advertised subscription plans at regular monthly intervals: one month, three months, six months, or twelve months. But the company didn’t charge consumers at those intervals. Instead, Hims charged for the first refill 10 days before the selected period ended. For a monthly subscription, that meant the second charge hit on day 20, not day 30. To avoid that charge, consumers had to cancel by day 18.

The complaint alleges Hims failed to clearly and conspicuously disclose these refill processing dates before collecting billing information. The policy was mentioned only in small, low-contrast text beneath the final call-to-action button. After enrollment, Hims typically provided no notifications about upcoming refill dates. Consumers who wanted to cancel or skip a refill would miss the deadline and face unwanted charges for medications they no longer needed.

Even worse: Hims deliberately made cancellation difficult. From at least 2019 through early 2025, the company imposed technological barriers designed to prevent successful cancellations.

Before April 2023, most consumers could only cancel by contacting customer service via phone, email, or online chat. But none of these methods worked reliably. Phone wait times stretched beyond 15 minutes, often ending in disconnection. Email responses were slow or nonexistent. The online chat system frequently failed to process cancellation requests, leaving consumers confused about whether their subscription had actually been terminated.

In April 2023, Hims finally added an online cancellation option for website users. But the company designed it to fail. The cancellation feature was hidden behind a button labeled “Add/remove items from order” — a label that gave no indication it would lead to cancellation. The word “cancel” appeared nowhere on the subscription management page. Consumers had to guess that clicking that button might unlock a cancellation option.

After clicking through, consumers faced another page that again said nothing about cancellation. It instructed them to modify their subscription by checking or unchecking boxes for treatment items. Only after unchecking every item would a “Cancel subscription” button finally appear. Even then, the process wasn’t complete. Consumers had to click through an additional three to ten survey pages before Hims would accept the cancellation.

Mobile app users faced even worse obstacles. Hims initially provided no in-app cancellation mechanism at all. When the company finally added one, it mirrored the confusing website flow.

The complaint notes that Hims was aware consumers struggled to cancel. Internal data showed high cancellation attempt failure rates. Consumer complaints documented the problem extensively. Despite this knowledge, Hims repeatedly chose not to provide simple cancellation mechanisms because executives understood that friction in the cancellation process directly increased revenue.

The Privacy Betrayal: Selling Patient Health Data to Facebook and Snapchat

While Hims was secretly charging consumers without consent and preventing them from canceling, the company was simultaneously violating another core promise: privacy.

Hims marketed itself as offering a “100% online, private, and secure process.” The company’s website explicitly stated that consumers’ “medical records and sensitive information are only accessed by the medical providers managing your care.” Influencer advertisements described the service as “discreet.” Offline ads on television, radio, and podcasts called the platform “totally private.”

All of these representations were false.

According to the complaint, Hims shared consumers’ sensitive health information with third-party advertising platforms including Meta (Facebook/Instagram) and Snap (Snapchat) from the company’s launch through at least May 2024. The company did this in two ways.

First, Hims uploaded customer lists directly to advertising platforms. These lists allowed Meta and Snap to match Hims patients to their social media accounts and target them with ads. But the lists didn’t just contain names and email addresses. They revealed that those individuals were Hims customers, which itself disclosed that they were seeking treatment for stigmatized conditions like erectile dysfunction, premature ejaculation, hair loss, anxiety, or depression.

Second, and more invasively, Hims embedded tracking pixels from Meta, Snap, and at least 15 other advertising platforms directly into the Hims website and apps. These pixels automatically captured detailed information about user behavior, including:

• Which treatment category pages consumers visited (revealing the condition they were seeking treatment for)
• Responses to medical intake questionnaires
• When consumers submitted intake forms
• When consumers were prescribed medications
• Purchase information and subscription details

The Meta Pixel and Conversions API tools Hims deployed were sophisticated enough that Meta could identify individual consumers and link their health-seeking behavior to their Facebook and Instagram profiles. Hims then used this data to create hyper-targeted advertising audiences on Meta’s platform, segmenting users by specific medical conditions and treatment types.

The complaint identifies similar tracking pixels from Microsoft (Bing), Google, Criteo, Pinterest, Reddit, StackAdapt, TikTok, the Trade Desk, and X (formerly Twitter). Many of these pixels captured the same sensitive health information.

Hims did not clearly and conspicuously disclose these practices to consumers before collecting their health information. The company did not provide consumers with a meaningful opportunity to opt out of having their health data shared with advertising platforms. Hims prioritized advertising revenue growth over patient privacy promises.

The Non-Financial Ledger: When Healthcare Becomes a Trap

The dollar amounts matter. But the complaint reveals injuries that don’t fit on a balance sheet.

Consider the consumer seeking treatment for anxiety and depression. They complete a detailed mental health intake form, disclosing trauma history, suicidal ideation, medication side effects. They’re told they’ll consult with a provider to determine if treatment is right for them. Instead, they’re charged $147 for a three-month supply of Lexapro before anyone asks if they actually want to take it. When they try to cancel, they discover the deadline already passed. The medication they didn’t agree to take arrives at their door.

Now they’re left with a choice: take a psychiatric medication they didn’t consent to, or let it sit unused while still being charged. If they want to cancel, they have to navigate the deliberately confusing cancellation maze. If they contact customer service, they wait on hold, get disconnected, start over. The process of trying to escape the subscription becomes its own source of anxiety.

Or consider the consumer seeking treatment for erectile dysfunction. They believe their consultation will be private. Instead, their intake form responses are transmitted to Meta via tracking pixel. Facebook now knows they’re seeking ED treatment. That information becomes part of their advertising profile. They start seeing targeted ads that reveal their condition to anyone who glances at their screen.

The loss of medical privacy is not theoretical. It changes what information people are willing to disclose to providers. It makes seeking treatment for stigmatized conditions dangerous. It turns healthcare platforms into surveillance infrastructure.

The complaint documents consumer after consumer describing the same experience: betrayal. They trusted Hims with sensitive health information during vulnerable moments. That trust was exploited to extract money they didn’t agree to pay and sold to advertisers for profit.

These are the injuries that matter most: the erosion of informed consent in healthcare, the normalization of surveillance in medical treatment, the weaponization of dark patterns against vulnerable populations seeking help.

Hims built a system designed to make it difficult for consumers to exercise their rights. The company profited from that friction. Every confused consumer who gave up trying to cancel was revenue Hims wouldn’t have earned in a fair system.

Legal Receipts: What the Court Documents Actually Say

The following passages are taken verbatim from the complaint filed in the United States District Court for the Northern District of California, Case No. 3:26-cv-7871:

“Contrary to Hims’ representations, Hims routinely charges consumers for prescription treatments and enrolls them in subscription plans for those treatments almost immediately after receiving consumers’ medical intake forms. Consumers have virtually no opportunity to review the provider’s recommended treatment, much less consent to it.” (Paragraph 5)

“Despite years of receiving complaints from consumers about their lack of consent, Hims has continued to use misleading language in its advertising and intake forms and has continued to immediately charge consumers without their express informed consent.” (Paragraph 6)

“Hims spent years unlawfully refusing to provide most consumers with simple mechanisms for consumers to stop recurring charges for medications they no longer want.” (Paragraph 6)

“Instead of honoring its privacy promises, Hims opted to grow the company and increase its revenue streams [redacted] with advertising platforms such as Meta and Snap.” (Paragraph 7)

“By submitting their Intake Flow, most consumers are unknowingly agreeing to pay for and subscribe to an as-yet-undetermined prescription treatment without having a chance to review the proposed treatment.” (Paragraph 27)

“Hims has been aware that consumers are often misled about whether and when Hims will charge them for their first order and enroll them in a subscription for prescription treatment. For example, the company received numerous complaints about this issue from customers directly as well as through organizations such as the Better Business Bureau.” (Paragraph 33)

“Despite Hims’ awareness that many consumers do not understand they are purchasing a subscription by submitting their Intake Flow, Hims has continued to make misleading representations to consumers in its advertising, on its websites, and in its Intake Flows.” (Paragraph 39)

“When Hims required most consumers to contact customer service to cancel, [redacted section].” (Paragraph 46)

“Despite promising to keep consumers’ health information private, [redacted section describing specific data sharing practices with advertising platforms].” (Paragraph 69)

The complaint contains extensive redactions related to Hims’ internal business strategies and data-sharing arrangements. What remains visible, however, establishes a clear pattern: Hims executives were aware of the problems, received complaints documenting consumer harm, and chose to continue the practices because they generated revenue.

Societal Impact Mapping

Digital Health Surveillance Infrastructure

The Hims case exposes how telehealth platforms have become nodes in the surveillance capitalism ecosystem. When consumers seek medical treatment, they expect doctor-patient confidentiality. Hims weaponized that expectation by embedding advertising trackers in the intake process itself.

This isn’t a privacy violation in the abstract sense. It’s the transformation of healthcare into an advertising funnel. Every medical question becomes a data point. Every condition becomes a targeting category. The most intimate health information becomes inventory in the attention economy.

The Meta Pixel deployment was particularly sophisticated. The tool didn’t just track page visits. It captured granular behavioral data that allowed Meta to identify which specific mental health symptoms consumers reported, which medications they were prescribed, and how their treatment progressed over time. This data fed back into Meta’s advertising systems, enabling hyper-targeted campaigns that exploited medical vulnerabilities.

The societal cost is the erosion of medical privacy as a norm. When telehealth platforms normalize surveillance, seeking treatment becomes participation in data harvesting. Consumers who need help for stigmatized conditions must choose between getting care and protecting their privacy.

Dark Patterns in Healthcare Delivery

The cancellation obstruction system Hims deployed represents a case study in dark pattern design applied to medical services. Dark patterns are user interface choices that trick people into doing things they don’t want to do. In e-commerce, that might mean adding items to a cart without consent or making unsubscribe buttons hard to find.

In healthcare, the stakes are higher. Hims designed its cancellation flow to exploit the cognitive load patients experience when trying to manage medical treatment. The company hid the cancellation option behind misleading labels, forced users to uncheck boxes before revealing the actual cancellation button, and then required completion of multi-page surveys before processing the request.

This isn’t user experience optimization. It’s systematic obstruction. The complaint presents evidence that Hims tracked cancellation attempt failure rates and chose not to simplify the process despite knowing consumers were struggling. The friction was the business model.

The societal impact is the normalization of hostile design in healthcare. When the largest telehealth platforms deploy dark patterns, smaller competitors follow. The entire industry shifts toward interfaces designed to extract rather than serve. Patients become marks to be retained rather than individuals to be helped.

Consent Theater in Medical Transactions

The most fundamental violation the complaint describes is the corruption of informed consent. Informed consent is the legal and ethical foundation of medical treatment. Hims reduced informed consent to theater: screens that looked like they were asking for permission but were actually just announcing charges that had already been authorized.

The “Pay $0 today” button is the perfect symbol of this corruption. It communicated clearly that no payment was being made. But in the fine print below (in small, low-contrast text that most users wouldn’t read), Hims disclosed that clicking the button constituted agreement to immediate charges and subscription enrollment once a provider wrote a prescription.

This is consent laundering. The company created the appearance of consumer choice while structuring the transaction to eliminate actual choice. Consumers couldn’t review the provider’s recommendation before being charged because they were charged before the recommendation was communicated to them.

The societal impact is the erosion of informed consent as a meaningful protection. When companies can satisfy legal consent requirements through deliberately misleading interface design, consent becomes a formality rather than a safeguard. This is especially dangerous in healthcare, where the power imbalance between providers and patients makes genuine informed consent essential.

What Now? Accountability and Resistance

The complaint names Hims & Hers Health, Inc. as the defendant corporate entity. The company is incorporated in Delaware with its principal place of business at 2269 Chestnut Street, #523, San Francisco, California.

The case is being prosecuted jointly by:

• The Federal Trade Commission
• The People of the State of California (through Los Angeles County Counsel)
• The Utah Division of Consumer Protection

The complaint alleges violations of:

• Section 5(a) of the FTC Act (15 U.S.C. § 45(a)) – prohibiting unfair or deceptive acts or practices
• Section 4 of the Restore Online Shoppers’ Confidence Act (ROSCA) (15 U.S.C. § 8403) – requiring clear disclosure, express informed consent, and simple cancellation mechanisms for negative-option subscriptions
• California Business and Professions Code § 17200 et seq. (Unfair Competition Law)
• California Business and Professions Code § 17500 et seq. (False Advertising Law)
• California Business and Professions Code § 17600 et seq. (Automatic Renewal Law)
• Utah Consumer Sales Practices Act (Utah Code § 13-11-4(1))

The complaint seeks:

• Permanent injunction preventing future violations
• Monetary relief for harmed consumers
• Civil penalties up to $2,500 per violation under California law
• Civil penalties under Utah CSPA
• Disgorgement of unlawfully obtained revenue
• Restitution for affected consumers

What Consumers Can Do

If you were charged by Hims without your consent or had difficulty canceling your subscription, you may be entitled to relief if the plaintiffs prevail in this case. Monitor the case docket at Case No. 3:26-cv-7871, United States District Court for the Northern District of California.

You can also:

• File a complaint with the FTC at ReportFraud.ftc.gov
• File a complaint with your state attorney general’s consumer protection division
• Report HIPAA violations to the HHS Office for Civil Rights
• Contact your state medical board if you believe a provider violated standards of care
• Dispute unauthorized charges with your credit card company or bank

Broader Resistance

The Hims case is not isolated. It represents systemic problems in how digital health platforms are regulated, how informed consent is enforced, and how consumer protection laws are applied to healthcare services.

Demand stronger enforcement of existing HIPAA protections. The tracking pixel deployments Hims used may violate HIPAA’s restrictions on disclosing protected health information to third parties without authorization. HHS has been slow to enforce HIPAA against telehealth platforms.

Support comprehensive federal privacy legislation. The United States lacks a general consumer privacy law equivalent to Europe’s GDPR. This regulatory gap allows health platforms to share medical data with advertisers in ways that would be illegal in other countries.

Advocate for “right to delete” protections in healthcare data. Consumers should have the right to demand deletion of health information shared without proper consent, including data already transmitted to advertising platforms.

Push for transparency in telehealth platform data practices. Platforms should be required to disclose all third parties with whom health data is shared, including advertising platforms, data brokers, and analytics providers.

Organize locally to support mutual aid alternatives to predatory telehealth. Community health clinics, sliding-scale mental health cooperatives, and harm reduction organizations provide care without surveillance or dark patterns.

The fight against surveillance capitalism in healthcare is the fight for medical privacy itself. When seeking treatment requires submitting to tracking, healthcare becomes a tool of social control rather than a human right.