The Federal Trade Commission, joined by the states of California and Utah, has filed a lawsuit against telehealth provider Hims & Hers Inc., alleging the company shared sensitive consumer health information with advertising platforms including Meta and Snap while publicly promising a private and discreet healthcare experience.

The complaint, filed Tuesday in the U.S. District Court for the Northern District of California, alleges that Hims told consumers its services were "100% online, private, and secure" and that medical records and sensitive health information would only be accessed by healthcare providers managing their care. Regulators contend the company instead disclosed consumers' health data to third-party advertising platforms without clearly informing users.

"The FTC's complaint lays out a troubling scenario—consumers unknowingly locked into recurring subscriptions and the disclosure to third parties of consumers' most private health information without their consent," said Christopher Mufarrige, Director of the FTC's Bureau of Consumer Protection, in a statement. "The FTC will not hesitate to act on behalf of consumers deprived of their ability to choose which products they want and whether to keep their most sensitive health information private."

According to the complaint, Hims used Meta Pixel, Meta Conversions API, and other tracking technologies from Google, Microsoft, Reddit, TikTok, Pinterest, X, and additional advertising partners to transmit information about users' activity on its platforms. The FTC says these practices affected consumers seeking treatment for conditions including erectile dysfunction, premature ejaculation, mental health disorders, hair loss, and weight loss. The use of tracking pixels like Meta's has drawn scrutiny across the healthcare sector, with numerous hospitals, health systems, and pharmacies facing class-action lawsuits in recent years over similar allegations of transmitting patient data to advertising platforms.

Hims & Hers, a publicly traded company best known for its "sexual wellness" product line, promoted privacy across its website, television, radio, and podcast advertising, as well as influencer campaigns describing its services as "private" and "discreet." The company went public in early 2021 through a merger with special purpose acquisition company Oaktree Acquisition Corp. and trades on the New York Stock Exchange under the ticker HIMS.

"As with the Meta and Snap pixels, many of these pixels captured and shared Users' health information by way of similar pixel tracking events that captured [redacted]—all of which was contrary to Hims' privacy promises," the complaint stated.

The company issued a public statement on X denying the allegations. "This lawsuit disregards substantial evidence we provided the FTC during its nearly three-year investigation, ignores established state laws and industry standards in telehealth, and contorts the law to try to manufacture claims," Hims & Hers wrote. "We are confident in our position and will vigorously defend ourselves against these baseless claims."

The lawsuit also accuses Hims & Hers of deceptive subscription practices. According to the complaint, the company advertised "free consultations" and told consumers they could decide whether a treatment was right for them before purchasing medication. Regulators allege that many consumers were instead automatically charged and enrolled in recurring prescription subscriptions immediately after a provider reviewed their intake form, without an opportunity to review or approve the treatment.

Additionally, the lawsuit alleges Hims failed to clearly disclose refill dates and made subscriptions difficult to cancel by burying cancellation options behind multiple menus and retention screens.

The complaint alleges violations of the FTC Act, the Restore Online Shoppers' Confidence Act, California's False Advertising Law and Unfair Competition Law, and Utah's Consumer Sales Practices Act. The FTC and its state partners are seeking a permanent injunction, monetary relief, civil penalties, and other remedies. While federal health privacy law under HIPAA governs how covered healthcare providers and insurers handle patient data, the FTC's enforcement approach here centers on consumer protection statutes, reflecting the agency's broader strategy of policing data practices by companies that fall outside traditional health-privacy regulatory frameworks.

"The Commission files a complaint when it has 'reason to believe' that the named defendants are violating or are about to violate the law and it appears to the Commission that a proceeding is in the public interest," the FTC wrote. "The case will be decided by the court."

The action is the latest in a broader series of FTC enforcement efforts targeting privacy, deceptive marketing, and consumer protection. In 2022, Epic Games agreed to pay $520 million to settle allegations that it violated children's privacy laws. The agency has also increasingly focused on artificial intelligence, warning that AI could "turbocharge" scams and deceptive practices, while bringing enforcement actions against companies accused of exaggerating their AI capabilities.

More recently in May, the FTC reached a nearly $1 million settlement with Cox Media Group and two marketing firms over claims they falsely advertised an AI-powered service that could target ads by listening to consumers' conversations through smart devices.

Editor's note: This story was updated after publication to include comment from Hims & Hers.