FTC sues Hims & Hers over sharing sensitive health data

The Federal Trade Commission sued Hims & Hers on Wednesday, accusing the telehealth company of sharing customers’ sensitive health information with Meta and Snap without consent while promising to protect privacy. The complaint, filed in federal court in the Northern District of California, puts a popular direct-to-consumer health brand at the center of a fight over whether discreet care can stay private once patient data enters digital advertising systems.

The agency said Hims & Hers funneled information about users into third-party platforms in ways that could expose health-related behavior, turning the company’s ad-driven growth model into the core of the case. Hims & Hers has built its business around online consultations and prescriptions in areas such as sexual health, mental health, dermatology and weight-loss treatment, where users often expect a higher level of discretion than standard consumer apps provide.

The complaint also broadened the case beyond privacy. It accused Hims & Hers, along with the states of California and Utah, of deceptive billing and cancellation practices, including charging patients before they met with providers and making subscriptions difficult to cancel. The dual claims suggest regulators are targeting both the company’s handling of intimate data and the mechanics of its subscription business.

Hims & Hers pushed back in a statement posted on its investor relations site, saying, “This lawsuit disregards substantial evidence we provided the FTC.” The company said it looked forward to presenting its case. Investors reacted quickly: Hims and Hers shares fell 10% after the lawsuit became public.

The case adds to a longer regulatory squeeze. The FTC had already been investigating Hims & Hers over advertising and cancellation practices last year, and the new suit raises the stakes by pairing those concerns with alleged privacy violations. For telehealth companies that market convenience and discretion, the filing makes clear that privacy promises will be measured against actual data flows, not just customer-facing language.