The FTC Hims & Hers lawsuit, filed July 29, 2026, alleges three things: consumers were charged and subscribed as soon as a provider approved an intake form they thought was a request for a consultation, cancellation was made hard, and condition-level customer data went to ad platforms. As of October 1, 2026 the case is pending and nothing has been proved. Read it anyway, because the pleaded conduct is the standard direct-to-consumer funnel.
The FTC Hims & Hers lawsuit pleads eight counts in three groups
The plaintiffs are the Federal Trade Commission, California acting through Los Angeles County Counsel, and the Utah Division of Consumer Protection. The case is No. 3:26-cv-07871 in the Northern District of California.
| Count | Law | Alleged conduct |
|---|---|---|
| I, II | FTC Act § 5, 15 U.S.C. § 45(a) | Privacy promises contradicted by sharing health information with advertising platforms; failure to disclose the sharing |
| III | FTC Act § 5 | Intake screens implied a dialogue with a provider and no charge until the consumer confirmed |
| IV | ROSCA § 4, 15 U.S.C. § 8403 | Material terms not clearly disclosed before billing information was taken |
| V | ROSCA § 4 | No express informed consent before the charge |
| VI | ROSCA § 4 | No simple mechanism to stop recurring charges |
| VII, VIII | Cal. Bus. & Prof. Code §§ 17500 and 17200 | False advertising and unfair competition, including the Automatic Renewal Law |
Utah separately pleads its Consumer Sales Practices Act.
We found no count under HIPAA, the Health Breach Notification Rule or any medical practice act. This is a consumer protection case about what the customer was told.
ROSCA sets three conditions for a telehealth subscription
The Restore Online Shoppers’ Confidence Act applies to anything sold online with a negative option feature, which the Telemarketing Sales Rule at 16 CFR 310.2 defines as a term under which the customer’s silence or failure to cancel is treated as acceptance. An auto-refill prescription plan fits.
Under 15 U.S.C. § 8403, it is unlawful to charge a consumer through such a feature unless the seller:
- “provides text that clearly and conspicuously discloses all material terms of the transaction before obtaining the consumer’s billing information”;
- “obtains a consumer’s express informed consent before charging”; and
- “provides simple mechanisms for a consumer to stop recurring charges.”
The first condition is what catches a telehealth funnel. Disclosure has to come before the card field.
Charging before a provider consultation is pleaded as deception, and asynchronous review is left alone
The complaint describes the flow this way. A consumer completes an online intake, is asked to save payment details with an assurance that they “won’t be charged until prescribed,” and submits. A provider reviews the form and may prescribe “without any subsequent interaction with the consumer.” The charge and the subscription follow almost immediately.
The FTC does not plead that prescribing from an asynchronous intake is unlawful. That question belongs to state law. The FTC’s theory is that the advertising and the screens told consumers they could talk to a provider and decide, and the billing system treated submission as the purchase.
The complaint concedes a disclosure existed: “if prescribed medication, you are purchasing an automatically-renewing subscription.” It alleges the line sat in small, low-contrast type below the final button, and that “if prescribed” left the timing unclear.
If your clinical model is asynchronous, say so in the funnel. If the card will be charged when the prescriber signs, say that, above the button.
Customer lists and Meta Pixel events are pleaded as disclosures of health information
The privacy counts rest on promises such as “100% online, private, and secure.” Against those, the complaint alleges two channels of disclosure “through at least May 2024.”
- Customer lists. The complaint alleges the company uploaded approximately 14 million consumer email addresses to Meta to build custom audiences, plus further lists to build lookalike audiences, and named those audiences by treatment category. It alleges internal code names for conditions did not conceal anything because the platform had been told what they meant.
- Automated events. It alleges the Meta Pixel and Conversions API sent registration and purchase events carrying an identifier, such as an email address, together with a parameter for the treatment sought.
The customer-list allegation reaches a practice many marketing teams treat as routine: exporting every buyer of one program into an ad account.
Telehealth subscription cancellation is its own count
According to the FTC, before 2023 most consumers could cancel only by phone, email or chat. After online cancellation arrived, the button allegedly appeared only after a consumer chose “add/remove items from order” and went through several steps. The complaint also alleges refill charge dates were not clearly disclosed, so consumers missed the window to stop a shipment.
The argument for the standard funnel deserves a fair statement
Nothing here has been adjudicated, and we have not reviewed the defendant’s response. The industry’s position: collecting a card before asynchronous review is how nearly every online brand works, the consumer is told a subscription follows a prescription, and a prescriber’s approval is a real clinical event, so charging on approval is charging for something the customer asked for. A second confirmation adds friction, and friction loses patients who wanted the treatment.
That argument has force on the clinical side. It is weaker under ROSCA, which asks about disclosure and consent at the moment of billing.
Where our position differs from market practice
We supply the provider network behind online brands, so this is our funnel too. Our position:
- The prescriber’s decision and the customer’s purchase are two events. The customer should see what was prescribed and confirm before the recurring plan starts.
- The funnel should describe the review as it is. If no live visit will occur, do not advertise a conversation. Where a state requires a synchronous encounter or an in-person good faith exam, the flow has to deliver one.
- No audience, event or list sent to an ad platform should carry a condition, a drug or a program name next to an identifier.
A court may find the confirmation unnecessary where the disclosure is clear. We would still build it, because it is the cheapest evidence of express informed consent you will ever collect.
Seven checks for your own intake flow
- Read your ads. Mark every phrase that implies a conversation with a provider.
- Find the screen where the card is entered. Confirm the price, the renewal interval and the charge trigger appear above the submit button in normal type.
- Identify the exact event that fires the first charge.
- Check whether the customer sees the prescribed drug and dose before that charge.
- Count the clicks from account home to a completed cancellation.
- Confirm the next refill charge date is shown in the account and in a reminder.
- Export your ad-platform audience names and event parameters. Remove anything that encodes a condition, including internal code names.
What this means for you
Run the seven checks this week on every program you sell by subscription, including weight management and hormone therapy. Fix the card-screen disclosure first, because it is the fastest change and the first ROSCA condition. Then delete condition-level audiences. If you hold or want LegitScript certification, expect the same questions there. If you are unsure your clinical workflow supports what the funnel promises, see how our review model is built.
Frequently asked questions
What is the FTC Hims & Hers lawsuit about?
The FTC, California and Utah sued Hims & Hers Health, Inc. on July 29, 2026 in the Northern District of California, No. 3:26-cv-07871. The complaint alleges deceptive intake and billing practices, failure to provide simple cancellation, and sharing of consumers’ health information with advertising platforms despite privacy promises. The case is pending.
Does ROSCA apply to a telehealth subscription?
The FTC pleads that it does. ROSCA, 15 U.S.C. § 8403, covers goods or services sold online through a negative option feature. It requires clear disclosure of material terms before billing information is collected, express informed consent before the charge, and a simple way to stop recurring charges.
Is it illegal to charge a patient before a provider consultation?
The complaint does not allege that asynchronous prescribing is unlawful. It alleges that consumers were told they could consult a provider and would be charged only once prescribed, then were charged and subscribed almost immediately after submitting an intake form. The theory is deception and lack of informed consent.
Can a telehealth company upload a customer list to Meta?
The complaint alleges that uploading customer email lists grouped and named by treatment category disclosed health information, contrary to privacy promises, and pleads that as a deceptive practice under the FTC Act. A list that reveals a condition or a drug carries that risk regardless of the technology used.
Has Hims & Hers been found liable?
No. As of October 1, 2026 the FTC lists the case as pending. A complaint contains allegations, and none has been proved. The FTC’s release notes that it files a complaint when it has reason to believe the law is being violated, and that the court will decide the case.
This is general information, not legal advice. Rules vary by state and change. Confirm your own facts with counsel.