The landscape of direct-to-consumer (DTC) telehealth is facing a significant reckoning as federal regulators turn their sights toward industry giants. Hims & Hers, the popular platform known for providing prescription treatments for weight loss, sexual health, and hair loss, has been hit with a lawsuit filed in California federal court. The complaint, brought forward by the Federal Trade Commission (FTC), alleges that the company engaged in deceptive practices by sharing sensitive patient health data with third-party advertisers and trapping consumers in difficult-to-cancel subscription models.
This legal action marks a pivotal moment in the digital health sector, highlighting a growing tension between the convenience of modern telehealth and the stringent privacy protections required when handling highly personal medical information.
The Allegations: A Breach of Trust and Data
At the heart of the FTC’s complaint is the company’s alleged misuse of “tracking pixels.” These small snippets of code are embedded into websites to monitor user behavior and transmit that data to third-party vendors. While common in e-commerce, the application of this technology in a healthcare context has raised alarms among privacy advocates and regulators alike.
According to the lawsuit, Hims & Hers marketed its services by promising potential patients high levels of privacy and discretion—a key selling point for individuals seeking treatment for sensitive conditions. However, the FTC claims that while the company was making these assurances, it was simultaneously deploying tracking pixels that funneled private health data to tech giants, including Microsoft, Google, and X (formerly Twitter).
The complaint goes beyond privacy concerns, challenging the company’s core business operations. Regulators argue that Hims & Hers made it intentionally difficult for consumers to cancel their subscriptions, resulting in many patients paying for unwanted, recurring prescription refills. Furthermore, the company stands accused of failing to disclose that it charged customers for medications almost immediately after they submitted an intake form—even though it had advertised that customers would consult with a medical provider before committing to any treatment plan.
Chronology of Regulatory Scrutiny
The lawsuit against Hims & Hers is not an isolated incident; rather, it is the latest chapter in a multi-year effort by the FTC to police the digital health sector.
- 2023: The FTC took landmark action against BetterHelp, banning the platform from sharing consumer data with third parties for marketing purposes. This followed allegations that the company had misled users by sharing sensitive mental health data with Facebook.
- 2024: The telehealth provider Cerebral reached a $7 million settlement with the FTC to resolve claims that it had improperly disclosed the sensitive health information of its patients through the use of tracking pixels.
- Mid-2024: Hims & Hers fell victim to a sophisticated social engineering scheme, where hackers gained access to its third-party customer service platform. While the company has yet to disclose the full scope of the breach, the event underscored existing vulnerabilities in the firm’s data security architecture.
- Present Day: The current federal lawsuit against Hims & Hers arrives after a three-year investigation into the company’s business conduct, signaling the FTC’s commitment to enforcing strict compliance standards for telehealth companies.
The Technology of Intrusion: Understanding Tracking Pixels
To understand why this lawsuit is so significant, one must understand the ubiquity and potential danger of tracking pixels. These tools serve a dual purpose: they help companies optimize user experience and targeted advertising, but they also create a pipeline for data leakage.
A 2023 study published in Health Affairs revealed that nearly all non-federal acute care hospital websites in the United States contained at least one tracking pixel. This widespread adoption has normalized a practice that many patients find invasive. Even more concerning, research published in PNAS Nexus found that hospitals utilizing third-party tracking pixels were 46% more likely to experience a data breach.
In the case of Hims & Hers, the FTC’s Bureau of Consumer Protection alleges that the company weaponized these pixels to track users’ medical intake and site activity, effectively monetizing the most intimate details of a patient’s life without their informed consent. Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection, characterized the scenario as "troubling," emphasizing that consumers were unknowingly locked into subscription cycles while their private medical history was being siphoned off to advertisers.
Official Responses and Corporate Defense
Hims & Hers has mounted a robust defense, vehemently denying the FTC’s allegations. In a public statement released the day the lawsuit was announced, the company expressed frustration, claiming that the FTC had disregarded evidence provided by the company during the three-year investigation.
"Our internal data practices are designed to protect patient information," the company stated in a post on its website, titled Our Commitment to Privacy. The company maintains that it excludes any information that patients share directly with their healthcare providers from its marketing activities.
When approached for further comment, a representative for Hims & Hers declined to address specific questions regarding the allegations, opting instead to direct the media to their public statement. This defensive posture suggests that the company is prepared for a prolonged legal battle, betting that its internal safeguards were sufficient to meet existing regulatory standards.
The Broader Implications for Telehealth
The legal and financial risks facing Hims & Hers are emblematic of a broader crisis in the telehealth industry. As the sector matures, the "move fast and break things" mentality that fueled its explosive growth during the pandemic is colliding with the rigid regulatory framework of the Health Insurance Portability and Accountability Act (HIPAA) and the Federal Trade Commission Act.
1. Reassessing the "Subscription Trap"
The FTC’s focus on Hims & Hers’ cancellation process highlights a major consumer protection concern. Many telehealth companies operate on a recurring revenue model, but when that model involves "dark patterns"—design elements that trick users into actions they did not intend—it crosses the line into unfair business practices. This lawsuit will likely set a precedent for how subscription-based health services must structure their cancellation processes in the future.
2. The End of "Privacy-Lite"
The era of vague privacy promises is likely coming to an end. Telehealth companies will soon be required to provide granular, transparent disclosures regarding how data is collected, shared, and stored. The reliance on tracking pixels for marketing purposes will likely face tighter restrictions, forcing companies to find less invasive ways to manage their customer acquisition strategies.
3. Cybersecurity as a Patient Right
The combination of the recent social engineering attack on Hims & Hers and the ongoing pixel lawsuit places a heavy burden on the company to prove its cybersecurity competence. Investors and patients are increasingly viewing data protection not just as a technical requirement, but as a core component of the standard of care.
4. The Regulatory Roadmap
For the FTC, the Hims & Hers case is another building block in its efforts to create a clear set of “rules of the road” for the telehealth industry. By targeting high-profile players like BetterHelp, Cerebral, and now Hims & Hers, the commission is sending a clear signal: the convenience of telehealth does not exempt companies from the rigorous privacy standards that traditional brick-and-mortar medical providers must uphold.
Conclusion: A Turning Point
The lawsuit against Hims & Hers represents a critical juncture for the direct-to-consumer health industry. As consumers continue to rely on digital platforms for their medical needs, the trust they place in these companies is paramount. Whether Hims & Hers succeeds in court or is forced to overhaul its business model, the outcome of this case will undoubtedly reshape the future of digital health. For now, the message from Washington is clear: the age of unregulated data sharing and opaque subscription practices in healthcare is drawing to a close.
About the Author
