Five more states join FTC suit against Hims & Hers over health data and billing

The Federal Trade Commission has added five states to its lawsuit against telehealth company Hims & Hers Health. The suit alleges the company shared sensitive health information with advertising platforms and used deceptive billing and cancellation practices. The allegations have not been tested in court.

The amended complaint now includes Arizona, Florida, Nebraska, Ohio and Wisconsin, in addition to Utah and California, which is represented by Los Angeles County Counsel. It was filed in the U.S. District Court for the Northern District of California. The Commission vote authorizing staff to file it was 2-0. The FTC announced the filing on November 10.

What the plaintiffs allege

The case was first filed on July 29. The FTC and its initial state partners alleged then that Hims misled consumers about keeping their health information private and shared it with Meta, Snap and other third parties. According to the original complaint as reported by The Register, Hims shared lists of certain customers with advertising platforms and sent health information through online tracking technologies. The complaint also says Hims assured consumers its platform was a "100 percent online, private, and secure" process, and the FTC alleges that assurance was false or misleading.

On billing, the complaint alleges Hims fails to clearly disclose that it charges consumers for prescriptions almost immediately after they submit an intake form. It says this happens even though Hims tells consumers they can consult a medical provider to find the right treatment. It also alleges the company made cancelling subscriptions difficult.

New state-law counts

The amended complaint alleges Hims violated the consumer protection laws of Arizona, Florida, Nebraska, Ohio and Wisconsin. It also keeps the claims under the FTC Act, the Restore Online Shoppers' Confidence Act (ROSCA), and California and Utah consumer protection laws.

Hims & Hers responds

A Hims & Hers spokesperson said Tuesday, as reported by Reuters: "We will vigorously defend ourselves against these follow-on claims, which rely on the same flawed allegations advanced in the government's lawsuit."

The FTC's release says the court will decide the case.

What this means for in-house counsel

The amendment shows how a federal case can pick up state plaintiffs after filing. Each new state brings its own consumer protection statute, and so its own standards, remedies and enforcement priorities. Counsel at any consumer-facing health or subscription business should map exposure state by state and not assume that one federal theory sets the ceiling. Companies that receive an FTC civil investigative demand should also consider that state regulators may follow, and plan communications and any settlement strategy accordingly.

The privacy allegations turn on a gap between what a company says publicly and what its marketing stack does. The complaint, as reported, targets both customer-list uploads and website tracking tools. Legal teams should work with marketing and engineering to inventory every pixel, SDK and audience-matching feed on pages where users enter health information. They should then compare each against the privacy policy and any promises such as "private" or "secure" in ads and onboarding flows. Legal review of marketing copy and data flows should happen together, because the alleged deception sits where the two meet.

The ROSCA counts are a separate checklist. Review when and how customers are charged relative to the disclosures they see, whether renewal and refill timing is stated clearly, and how many steps cancellation takes compared with sign-up. Keep records showing how these flows were tested and approved. Hims has said it will "vigorously defend" itself and calls the allegations flawed, and the court has made no findings. Counsel may want to track the docket for rulings on any motion to dismiss.