Hims Sued Over Alleged Unwanted Prescription Subscriptions and Health Data Sharing

Federal and state regulators have sued Hims & Hers Health, alleging the telehealth company charged hundreds of thousands of consumers for prescription subscriptions without their informed consent and shared sensitive health information with advertising platforms despite promises that its service was private and discreet.

The Federal Trade Commission, California, and the Utah Division of Consumer Protection filed the complaint July 29 in the U.S. District Court for the Northern District of California. Regulators claim Hims used advertisements and online intake forms that led consumers to believe they could receive a free medical assessment and discuss a proposed treatment before deciding whether to buy it. Many customers were instead charged and enrolled in recurring plans as soon as a medical provider wrote a prescription, according to the complaint.

Hims offers online treatment for sexual health, hair loss, skin care, mental health and weight loss through medical providers and partner pharmacies. The company acts as an intermediary, operating the platform through which consumers submit health information, communicate with providers and obtain medication. Its prescription products are sold as subscriptions.

Consumers generally complete an online intake form about their treatment goals and medical history, enter billing information and submit the form for provider review. The complaint points to screens that displayed statements including “Due Now $0,” “Pay $0 today” and “You will only be charged if prescribed.”

Regulators argue the language did not clearly explain that submitting the form could trigger a charge and subscription once a prescription was written. Many consumers allegedly had no opportunity to review the medication, ask about alternatives, or confirm that they wanted to proceed before the prescription was sent for fulfillment.

The consent issue centers on whether consumers knowingly agreed to the purchase and recurring plan. It is separate from the medical judgment behind the prescription or the information a provider must give a patient before treatment.

The government also challenges how Hims disclosed refill dates. Customers could select refill intervals of one, three, six, or 12 months, but regulators allege the company routinely processed the first refill 10 days before the selected interval had passed.

A monthly customer could therefore be charged on day 20 and would need to cancel by day 18 to avoid the payment. The complaint claims that the schedule appeared in small, low-contrast text and was not reinforced through advance notices.

The Restore Online Shoppers’ Confidence Act requires online businesses using automatically renewing plans to disclose important terms before collecting billing information, obtain informed consent before charging customers, and provide a simple way to stop recurring payments. Those terms must be noticeable and understandable, not merely placed somewhere on the page. The FTC argues Hims violated those rules by obscuring when the first payment and subscription would begin.

The cancellation process forms another part of the case. Before April 2023, many customers allegedly had to contact customer service to end a subscription. Hims later added an online process, but regulators claim the option was difficult to find.

Customers allegedly had to select “Add/remove items from order,” uncheck every treatment item and continue through several screens before a cancellation option appeared. Even after selecting it, consumers could be required to answer between three and 10 questions and confirm their decision again.

The complaint also accuses Hims of advertising its service as private, secure and discreet while stating that sensitive information would be accessed only by providers managing a customer’s care.

Regulators allege Hims nevertheless shared health-related information with Meta and Snap through customer lists and tracking technologies, including the Meta Pixel and Conversions API. The lawsuit does not allege a HIPAA violation. It relies instead on federal consumer protection law and California privacy protections, which regulators say apply because the company’s privacy promises were material to consumers deciding whether to use the service.

California’s claims also rely on its False Advertising Law, Unfair Competition Law and Automatic Renewal Law. The automatic renewal statute requires subscription terms to appear clearly and near the request for consent. The state seeks civil penalties of up to $2,500 per violation under its false advertising and unfair competition statutes. Utah separately accuses Hims of deceptive conduct under its Consumer Sales Practices Act.

The complaint seeks an injunction, restitution, other monetary relief, and state civil penalties but does not state a total amount. The case remains pending in the U.S. District Court for the Northern District of California.