FTC Sues Hims & Hers for Sharing Health Data with Meta and Snap

FTC Charges Hims & Hers With Health Data Sharing and Dark Patterns

On July 29, the Federal Trade Commission filed a lawsuit against telehealth company Hims & Hers, alleging it illegally shared consumers’ sensitive health data with advertising platforms Meta and Snap while trapping customers in difficult-to-cancel recurring subscriptions. The complaint, joined by the states of Utah and California, marks a significant escalation in the FTC’s crackdown on health apps that profit from user data.

The FTC says Hims & Hers transmitted details about customers’ medical interests—including treatments for hair loss, erectile dysfunction, and mental health conditions—to third-party advertisers through customer lists and automatic tracking tools that fired off user actions. These practices allegedly occurred without adequate consent, despite the company’s promises to safeguard personal information.

Beyond the data allegations, the suit accuses the company of charging customers the moment they submitted an intake form, before they could consult a provider, and automatically enrolling them in subscription plans. Cancelling was equally frustrating: prior to 2023, users could only cancel by contacting customer service, and even after an online button was introduced, the FTC says it was buried behind multiple steps—a classic dark pattern.

Hims & Hers shares fell roughly 10% on the news. The company has not publicly commented on the lawsuit. The case now heads to federal court in Northern California.

The Regulatory Reckoning Behind the Hims & Hers Data-Sharing Case

A Business Built on Sensitive Data

Hims & Hers has grown into a telehealth giant by making it easy to obtain treatments for stigmatized conditions. The company’s subscription model relies on collecting deeply personal health information—the very data the FTC alleges was shared with ad platforms. If proven, the case shows how a company’s core growth engine can turn into a legal liability when privacy claims are contradicted by the flow of data to advertising partners.

The Regulatory Gap Between HIPAA and Ad Tech

Federal health-privacy law, HIPAA, was designed for hospitals and insurers, not for direct-to-consumer telehealth platforms that often sit outside its scope. The FTC is stepping into that void, using its broad authority to police unfair and deceptive acts. The case could set a precedent that sharing health-related data with ad platforms—even through commonplace tracking technologies like Meta’s pixel—violates consumer protection laws when companies promise confidentiality.

Dark Patterns as a Competitive Strategy

The FTC has made hard-to-cancel subscriptions a priority, and the Hims & Hers case pairs that grievance with the privacy breach, making it a high-profile test. The allegation that customers were charged on form submission and then funneled into a cumbersome cancellation process mirrors tactics the agency has targeted across the web. For telehealth, where convenience is the selling point, such practices undermine the trust essential to the business.

What the FTC Is Really Trying to Prove

By joining with state attorneys general and citing multiple laws, the FTC is signaling that it views the case as a vehicle to establish broader norms for health apps. If successful, the suit could force a sweeping reassessment of how telehealth companies handle data, consent, and subscription management. It also puts advertising platforms on notice: while Meta and Snap are not defendants, the case draws attention to their role in the ecosystem and may accelerate demands for tighter controls on health-related data flowing into ad networks.

What the FTC’s Case Means for Telehealth Companies and Their Customers

For telehealth companies: Audit all customer data flows to advertising platforms, especially those involving Meta’s pixel or Snap’s analytics. Even aggregated or de-identified data may invite regulatory scrutiny if it can be linked to health interests. Review sign-up flows to ensure consent is obtained before any payment, and provide a one-click cancellation option—expect the FTC to scrutinize these elements.

For investors in digital health: The 10% share drop reflects real financial risk. Look for exposure to similar data-sharing practices across other telehealth platforms. Legal costs, potential fines, and reputational damage could impact valuations if similar suits proliferate. The case may also slow customer acquisition if ad-targeting capabilities are curtailed.

For consumers: Before providing health data to any online service, read the privacy policy for third-party sharing. Ask whether the platform uses ad-tracking tools. When signing up for a telehealth subscription, check cancellation procedures—ideally, they should be online and clearly accessible. If you are a Hims & Hers customer, watch for company communications about changes to data practices.