Five States, Including Nebraska, Join FTC Privacy and Billing Suit Against Hims & Hers

Five more states have joined the Federal Trade Commission's lawsuit against telehealth provider Hims & Hers Health, Inc. The FTC filed an amended complaint on November 10, 2026, in the U.S. District Court for the Northern District of California. It adds Arizona, Florida, Nebraska, Ohio and Wisconsin as co-plaintiffs. Nebraska Attorney General Mike Hilgers publicized his state's participation on November 12.

The case is FTC v. Hims & Hers Health, Inc., No. 3:26-cv-07871. The FTC opened it in July, according to the agency's case page. Utah and California, acting through Los Angeles County Counsel, were the original state partners. The Commission voted 2-0 to authorize the amended filing, according to the FTC's announcement.

What the complaint alleges

The allegations have not been proven in court. According to the FTC, Hims & Hers shared consumers' sensitive health information with third-party advertising platforms, including Meta and Snap, while claiming its services maintain consumers' privacy. The agency also alleges the company does not clearly disclose that it charges consumers for prescriptions almost immediately after they submit an intake form. That allegation sits alongside the company's statements that consumers can consult a medical provider to determine the appropriate treatment, KOLN reported. The complaint further alleges Hims & Hers made it difficult to cancel subscriptions.

The amended complaint alleges violations of the FTC Act and the Restore Online Shoppers' Confidence Act (ROSCA). It also alleges violations of California and Utah consumer protection laws, and of the laws of the five new states. Trade publication PPC Land, which reviewed the 68-page filing, reports that it raises the count total from nine to sixteen. It also reports that Nebraska's claim is brought under the state's Uniform Deceptive Trade Practices Act, with penalties of up to $2,000 per violation. Florida's counts cite a statute on selling sensitive personal data without consent, which PPC Land says carries penalties of up to $50,000 per violation.

PPC Land also reports that the November filing includes figures not in the redacted public July version. These include about 14 million customer email addresses allegedly uploaded to Meta and roughly 8 million tracking events tied to medical treatments. PPC Land reports that the FTC seeks a permanent injunction and monetary relief under FTC Act Sections 13(b) and 19 and ROSCA Section 5.

Company response and next steps

A Hims & Hers spokesperson told Reuters on November 10: "We will vigorously defend ourselves against these follow-on claims, which rely on the same flawed allegations advanced in the government's lawsuit." According to TIKR, the company asked the California federal court last month to dismiss the case. A hearing on that motion is set for January 7, TIKR reports.

The expanded suit landed the same day the company's shares fell 17% after its third-quarter report, according to TIKR.

What this means for in-house counsel

The amendment shows how a federal enforcement action can grow into a multistate case. The new plaintiffs bring their own statutes and penalty structures, and attorneys general can pursue ROSCA injunctive relief for their residents, according to PPC Land's reading of the complaint. A company facing an FTC inquiry on privacy or subscription practices should plan for state follow-on claims. The state counts rest on the same underlying facts, so a single set of disclosures and a single data flow can carry exposure under several regimes at once.

For companies that run health-related advertising, the allegations focus on what was sent to ad platforms and what the privacy statements said. Legal teams should map what customer lists, pixel events and server-side events go to Meta, Snap and similar vendors. They should check whether any of that data reveals a health condition or treatment. They should also compare those flows against the privacy policy, in-product statements and marketing copy. Florida's reliance on a sale-of-sensitive-data provision is a reminder that state law may treat these transfers as more than a misleading-statement issue.

For subscription businesses, the billing claims turn on when a customer is charged, what the sign-up flow says beforehand, and how many steps it takes to cancel. Counsel should review checkout and cancellation flows against ROSCA's disclosure, consent and cancellation requirements. They should also confirm that terms like "free" are used consistently with state rules, since Ohio's claims include one on that point. Finally, consider how internal testing and customer-service communications about cancellation friction might read if produced in discovery.