FTC Alleges Massive Privacy Violations and Deceptive Practices
The U.S. Federal Trade Commission (FTC) filed a landmark lawsuit against telehealth platform Hims & Hers Health Inc. (NYSE: HIMS) on Wednesday, alleging the company systematically shared users’ highly sensitive health information with major online advertisers—including Meta Platforms (NASDAQ: META) and Snap Inc.—despite explicit promises to keep such data private. The complaint, filed jointly with the Los Angeles County District Attorney and the State of Utah, also accuses the company of deceptive billing practices and making subscription cancellations deliberately difficult for consumers.
Stock Reaction and Market Impact
Shares of Hims & Hers plunged approximately 12% in intraday trading following the announcement, wiping out significant market capitalization. The sell-off reflects investor concern over potential regulatory fines, class-action litigation, and reputational damage that could impair customer acquisition in the highly competitive telehealth sector. As one of the largest direct-to-consumer telehealth providers—offering treatments for erectile dysfunction, hair loss, mental health conditions, and the booming GLP-1 weight-loss drug market—Hims & Hers sits at the intersection of fintech, healthcare delivery, and consumer data monetization.
Core Allegations: Data Sharing and Dark Patterns
According to the FTC complaint, Hims & Hers transmitted users’ health intake responses, prescription details, and treatment histories to third-party advertising platforms to fuel targeted marketing campaigns. This practice allegedly violates the FTC Act’s prohibition on unfair and deceptive acts, as well as HIPAA-adjacent state privacy statutes. Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection, stated: “The FTC will not hesitate to act on behalf of consumers deprived of their ability to choose which products they want and whether to keep their most sensitive health information private.”
The complaint further details “dark pattern” billing tactics: customers were charged for subscription prescriptions before any clinical consultation occurred, and most users never received a live provider interaction—only an automated intake form review. Cancellation flows were allegedly designed with excessive friction, including mandatory phone calls and hidden account settings, violating the FTC’s recent Negative Option Rule guidance.
Company Response and Legal Outlook
Hims & Hers dismissed the allegations as “baseless” in a post on X (formerly Twitter), characterizing the action as “an effort to generate headlines at our expense” rather than genuine consumer protection. Legal analysts note the case could set precedent for how telehealth platforms handle protected health information (PHI) under evolving state privacy laws like CCPA/CPRA and Washington’s My Health My Data Act. Potential remedies include civil penalties, disgorgement of profits derived from data sharing, and mandatory structural changes to data governance and subscription cancellation workflows.
Broader Implications for Fintech and Digital Health
This enforcement action signals heightened regulatory scrutiny on the data monetization models underpinning many venture-backed digital health companies. Investors should monitor: (1) whether peers like Ro, Thirty Madison, or Lemonaid Health adjust privacy policies proactively; (2) potential impact on HIMS valuation multiples as compliance costs rise; and (3) the FTC’s appetite for pursuing similar cases against fintechs that blur lines between financial services, healthcare, and advertising technology.
Frequently Asked Questions
- What specific health data did Hims & Hers allegedly share? The FTC alleges the company shared users’ responses to medical intake questionnaires, prescribed medications (including for ED, hair loss, mental health, and weight loss), treatment histories, and associated personally identifiable information with Meta, Snap, and other advertising partners for ad targeting purposes.
- How might this affect Hims & Hers financially? Beyond the ~12% stock drop, the company faces potential civil penalties (up to $50,120 per violation under the FTC Act), restitution to affected consumers, mandatory compliance program costs, and possible damage to customer lifetime value if trust erodes. Analysts may lower price targets pending legal clarity.
- What should current Hims & Hers subscribers do? Subscribers should review their account privacy settings, request data deletion under applicable state laws (CCPA for California residents), monitor billing for unauthorized charges, and consider whether the platform’s data practices align with their privacy expectations. The FTC has not yet ordered service cessation.
