The Hims FTC lawsuit filed Wednesday accuses Hims & Hers of giving sensitive customer health information to advertising platforms while telling patients their care process was private and secure.
The Federal Trade Commission said Hims & Hers shared information about customers’ medical conditions with Snap, Meta and other third-party platforms. Utah and California joined the agency in bringing the case, according to the FTC.
Hims & Hers, based in San Francisco, sells direct-to-consumer prescription medications and telehealth services. Its customers seek treatment for sexual health, mental health and other conditions that can carry obvious privacy stakes. Before treatment, customers fill out an online form that is reviewed by a medical provider, according to the FTC’s description of the service.
Why did the FTC sue Hims & Hers?
The FTC alleges Hims & Hers violated the FTC Act, which prohibits unfair or deceptive practices. The agency says the company promised tight limits on access to patients’ health information, then disclosed that information through customer lists and tracking tools used for advertising.
In a press release, the FTC said Hims & Hers shared customer lists with advertising companies. The agency also said third-party tracking technologies on the company’s website transmitted details about what visitors did there.
The FTC’s complaint points to privacy claims on the Hims website, including language that said consumers’ “medical records and sensitive information are only accessed by the medical providers managing your care.” The agency also cited marketing that described the service as a “100% online, private, and secure process.”
According to the complaint, those statements told consumers, in effect, that Hims would not disclose their health information to outside companies. The FTC alleges the company instead chose practices meant to grow the business and increase revenue.
Online tracking in this context generally means code from outside companies placed on a website or app. That code can report events such as pages visited, forms started, purchases made, or other actions back to the third party that supplied the tool. The FTC’s claim is that, for a telehealth service, those signals can reveal health-related information even if the transfer does not look like a traditional medical record handoff.
What does Hims & Hers say?
Hims & Hers rejected the FTC’s allegations. In a statement posted by the company, a spokesperson said the lawsuit “disregards substantial evidence we provided the FTC during its nearly three-year investigation, ignores established state laws and industry standards in telehealth, and contorts the law to try to manufacture claims.”
The company also said the case was “not enforcement grounded in consumer protection” and accused the FTC of trying to generate headlines at its expense.
Hims & Hers said customers have the information they need to make informed decisions about their care. The company said its privacy policy tells users how they can control the handling of their information.
The FTC’s case is not limited to data sharing. The agency also alleges Hims & Hers made subscription cancellations too difficult and misled customers about billing practices.
The lawsuit puts a familiar ad-tech privacy fight into a higher-risk setting: telehealth. The FTC’s theory, as stated in its complaint, is that health-related web behavior and customer lists can become sensitive health information when they identify people seeking treatment for specific conditions.
This story draws on original reporting from The Record.
