Hims and Hers lawsuit: the FTC's case on pixels, billing and cancelling

Yes, there is a Hims and Hers lawsuit. On 29 July 2026 the FTC, joined by Utah and California, sued Hims & Hers in federal court in California. The complaint alleges three things: that the telehealth company sent customers’ health information to ad platforms through tracking tools and customer lists, that it charged people and signed them up for recurring plans without clear consent, and that it made cancelling hard. These are allegations. The company disputes them, and on 22 October it asked the court to throw the case out.

If you searched for the hims lawsuit as a customer or an investor, that’s the short answer. This piece is for the person who runs a sign-up flow. Take the medicine out and the complaint describes three things plenty of smaller sites do: an ad pixel on pages about a health condition, a card charged right after a form, and a cancel button behind a menu. Below: what the FTC says about each, the rule behind it, the company’s reply, and a phone check for your own flow.

What the Hims and Hers lawsuit says

The case is FTC v. Hims & Hers Health, Inc., number 3:26-cv-07871, in the US District Court for the Northern District of California. It’s assigned to Judge Vince Chhabria. The Commission voted 2-0 to file it.

Three plaintiffs share it, each under its own law. If you came here looking for “hims ftc” or “hims and hers ftc”, this is the table you want:

Plaintiff	Laws it relies on
Federal Trade Commission	FTC Act section 5 and the Restore Online Shoppers’ Confidence Act
Utah Division of Consumer Protection	Utah Consumer Sales Practices Act
California, through Los Angeles County Counsel	False Advertising Law and Unfair Competition Law, including the state’s Automatic Renewal Law

The complaint has nine counts. Three are under the FTC Act (privacy promises, what wasn’t disclosed, and the intake flow), three under ROSCA (terms, consent and cancelling), two for California and one for Utah. Christopher Mufarrige, who runs the FTC’s Bureau of Consumer Protection, summed it up as consumers unknowingly locked into recurring subscriptions and the disclosure to third parties of consumers’ most private health information without their consent.

Hims & Hers answered the same day. Its statement says the suit ignores evidence the company gave during a nearly three-year investigation, and ends: We are confident in our position and will vigorously defend ourselves against these baseless claims. It also says its privacy policy makes clear that they may choose how their data is used. Hold on to that line. It’s the heart of the company’s defence.

Pixels on health pages: what the FTC alleges was shared

Start with the promises. According to the complaint, a question on the Hims homepage, until at least late August 2023, asked how Hims ensures patient privacy. The answer said that medical records and sensitive information are only accessed by the medical providers managing your care. Online ads offered a “100% online, private, and secure process”, and paid influencer posts called it “discreet”.

Then, the FTC alleges, the data went to advertisers in two ways, through at least May 2024.

The first was customer lists. Between September 2020 and June 2023, Hims allegedly uploaded about 14 million email addresses to Meta to build ad audiences, and Meta matched about 10 million of them to accounts. It also built 90 lookalike audiences. The audience names gave the treatment away. Some used abbreviations such as ED; others used codewords such as “Zeus”, and the complaint says Hims told Meta what the codewords meant. Five lists uploaded to Snap, named after mental health and sexual health sign-ups, held over a million addresses.

The second was the tracking tools on the site, the kind the tracking pixel guide explains. The complaint names the Meta Pixel and Meta’s Conversions API, which sent a “Complete Registration” event when someone created an account and a “Purchase” event when they submitted the intake form. Each event carried the person’s email and IP address and a parameter naming the treatment they were after, and they went to Meta about 8 million times. The complaint also lists pixels from Microsoft, Google, Pinterest, Reddit, TikTok, X and others on the same site.

Notice how the FTC frames this. Counts I and II are deception claims under section 5 of the FTC Act, so the case rests on the promises: the company said one thing about privacy, and the complaint says the data told a different story. That’s the same shape as the FTC’s 2024 case against Monument, an alcohol addiction treatment service that promised confidentiality and, the FTC alleged, shared health details with Meta and Google through pixels. A year before that, the FTC and the US health department wrote to telehealth firms that it is essential to monitor data flows of health information to third parties via technologies you have integrated into your website or app, even if someone else built the site.

This is also different from the meta pixel lawsuit you see in the news most weeks. Those are usually private class actions brought by visitors under wiretap laws like California’s Invasion of Privacy Act, and the CIPA lawsuit post covers them. An FTC case is a regulator suing over promises and practices. A site can face both, for the same pixel.

Charged after the form: the sign-up and billing allegations

The intake flow, as the complaint describes it, runs in four parts: questions about your goals, an account, a medical assessment of 25 to 50 questions, then a possible treatment with its price and shipping schedule, your card and address, and a button to send it all to a provider.

The ads and pages along the way promised a “free consult” or a “free online visit”. The last screen, as the complaint shows it, said “Due Now $0”, carried a button reading “Pay $0 today”, and told people: Save your payment details—you won’t be charged until prescribed.

Here’s what the FTC alleges happened next. Most people never got a consultation. Most states don’t require a real-time consult, so a provider reviewed the form and prescribed, and Hims charged the card, sent the prescription out and started the subscription right away. By the complaint’s account, people were usually charged and enrolled before they even learned what had been recommended.

The renewal terms were on that last screen, but the FTC says they sat only in small, low-contrast font below the final call-to-action button. And they described refills that don’t run on the schedule people chose. On a monthly plan, the complaint says, the first refill was charged on day 20, and you had to cancel by day 18 to avoid it.

This is where the Restore Online Shoppers’ Confidence Act comes in. ROSCA covers anything sold online with a negative option, where not cancelling counts as saying yes. Section 8403 lets a seller charge only if it does three things: clearly discloses all material terms before it takes billing information, gets the customer’s express informed consent before charging, and provides simple mechanisms for a consumer to stop recurring charges. Count IV lists the sharing of health data with ad platforms among the material terms that weren’t disclosed. The company’s motion pushes back hard on that.

The cancel button behind a menu

Before April 2023, the FTC alleges, most customers could cancel only by phone, email or chat. Agents first asked for a date of birth and a past order number, even by email. From late 2022, the complaint says, the phone number was taken off the help pages, including the one that explained how to cancel.

Then came online cancelling, and the route the press release describes. On the subscription page, the button to press was “Add/remove items from order”. The word “cancel” wasn’t on the page. The next screen said “Any changes will apply to your subscription going forward”. Only after unticking every item did a “Cancel subscription” button appear, and after that came three to ten survey questions before the cancellation went through.

In September 2023, the complaint says, two of the company’s own customer service agents wrote that the button was a bit of a dark pattern and unclear that this is how to cancel. In the apps, a self-serve cancel option appeared around May 2023 and was taken out again after cancellations spiked; it came back in January 2024.

The rule behind this count is ROSCA’s “simple mechanisms”. The FTC’s stricter click-to-cancel rule isn’t part of it: the Eighth Circuit vacated that rule on 8 July 2025, and the click to cancel article in the Handbook explains what’s left. ROSCA itself is a statute and still applies.

Where the Hims and Hers lawsuit goes next

On 22 October 2026 the company filed a motion to dismiss. At this stage the judge doesn’t weigh evidence. The motion itself states the test: To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.

Date	Step
29 July 2026	Complaint filed
22 October 2026	Hims & Hers files its motion to dismiss
25 November 2026	Plaintiffs’ response due
17 December 2026	Company’s reply due
7 January 2027	Hearing in San Francisco

Those dates are from the court docket. The company’s arguments:

• On privacy, it points to its privacy policy, which people acknowledge when they create an account. The policy says the company may provide personal information to marketing and advertising partners, and links to ad settings for Meta and Google. That’s the July statement’s line about choosing how data is used, now with the policy text behind it.
• On billing, it says the checkout screen the FTC reproduces spells out the price, the renewal and the early refill. In the motion’s words, A free medical assessment is not a promise of free medication.
• On ROSCA, it argues the law doesn’t apply at all, because these are instalment payments under fixed-term plans rather than a negative option, and that a billing statute can’t be stretched to police privacy.
• On cancelling, it says phone, email and chat were always offered, online cancelling came in April 2023 and the apps followed. That there may be easier ways, the motion says, doesn’t make these unlawful.

Its summary line: Plaintiffs cannot manufacture deception by ignoring what H&H told consumers, or create liability by rewriting ROSCA. The plaintiffs answer in November. Nothing gets decided before January.

The question I’d most like answered is the one in Count IV: can a privacy practice be a “material term” of a subscription under a billing law? The FTC says yes, the company says ROSCA was never written for that, and I honestly can’t tell you which way the judge will go.

What this means for a smaller subscription site

Whoever wins, the fight is about a gap. The FTC points at what people saw first, the big friendly promises. The company points at what was written down, the policy and the small print. Your site has the same gap.

Three questions cover the three patterns:

1. Do your promises match your pixels? If an ad or a page says private, confidential or discreet, the tools on your health pages have to live up to it. A sentence deep in the privacy policy is what the company is relying on here, and the FTC says it wasn’t enough.
2. Does anyone pay before they’ve agreed to what they’re paying for? “$0 today” next to a card form matches what happens only if nothing is charged until the customer says yes to a specific product and price. If the charge follows on its own, ROSCA wants the terms clear before the card goes in.
3. Is your way out labelled as a way out? A cancel button should say cancel and sit where people look for it.

State law adds to this. In Washington, the My Health My Data Act says consumer health data can’t be shared without consent that is separate and distinct from the consent obtained to collect consumer health data, unless sharing is needed to provide what the person asked for, and that consent comes before the sharing. For California’s opt-out rules, see the CCPA fines post and the CCPA checklist. If you run a health or wellness site, it’s worth a short talk with a lawyer about which of these reach you.

Check your sign-up and cancel flow from a phone

No tool needed. Use your phone, a private tab and a test card if your payment provider offers one.

1. Sign up as a new customer. Note the screen where the price, the renewal period and the date of the first charge first appear. Is that before or after the card form?
2. Read the text around the final button. Is the renewal term in the same size and contrast as the button, or in grey small print below it?
3. Check when the card is charged. If it’s charged before any service starts, or before the customer confirms a specific product, write down what the screen said at that moment.
4. Compare your stated renewal schedule with the real one. If a monthly plan bills early, say so in the same place you say “monthly”.
5. Open the account area and count the taps from home to a finished cancellation. Does the word “cancel” appear on the first screen you need?
6. On a health, symptom or treatment page, list the ad and analytics tools you installed, from your ad accounts and your tag manager. Then read your privacy policy’s list of advertising partners and see if the two lists match.
7. Search your ads and landing pages for private, confidential or discreet, and check them against step 6.

Peeky reads the public pages of your site and writes down what he saw. For ad and analytics tools on pages about health, symptoms, treatment or appointments, the check is US-12. For subscriptions it’s US-09: clear terms before billing, and a way to cancel that a visitor can find. And for promises like “we never share your data”, it’s US-07.

Questions people ask

Did Hims have a lawsuit?

Yes. On 29 July 2026 the FTC, Utah and California sued Hims & Hers in the US District Court for the Northern District of California. The FTC alleges the company shared health information with ad platforms, charged people without clear consent and made cancelling hard. The company disputes the claims, and on 22 October 2026 it asked the court to dismiss the case. Nothing has been decided.

What is the FTC suing Hims and Hers for?

Three things, as alleged. Sharing customers' health information with Meta, Snap and other ad platforms through customer lists and tracking pixels, after promising privacy. Charging for prescriptions and starting a subscription almost right after the intake form, without clear disclosure. And making cancellation hard, with an online route that started at a button labelled Add/remove items from order. The FTC relies on the FTC Act and ROSCA.

What is the Restore Online Shoppers' Confidence Act?

ROSCA is a 2010 federal law for anything sold online with a negative option, where silence or not cancelling counts as saying yes. A seller has to disclose all material terms clearly before taking billing details, get the customer's express informed consent before charging, and offer simple ways to stop recurring charges. The FTC enforces it, and a violation counts as a violation of the FTC Act.

Is it legal to put the Meta Pixel on a health website?

There's no single US rule that bans it, but it's risky. The FTC and the US health department warned in 2023 that tools like the Meta Pixel can send health information to third parties. HIPAA applies to covered entities, the FTC Act holds everyone to their privacy promises, and Washington requires separate consent before sharing health data. Private wiretap suits are a further risk.

What did Hims & Hers say about the FTC lawsuit?

On the day it was filed, the company said the suit disregards evidence it gave during a nearly three-year investigation and that it will vigorously defend itself. Its motion to dismiss of 22 October 2026 argues that its privacy policy disclosed sharing with advertising partners, that its checkout screen disclosed the charges, and that ROSCA doesn't apply.