Telehealth Apps Skip the Exam and Share Health Data

The Federal Trade Commission sued Hims & Hers on July 29, 2026, alleging the telehealth company sent customers’ health data to Meta and Snap. Utah and Los Angeles County joined the case in the Northern District of California.

Hims & Hers Health, Inc. says the claims are baseless. The filing still maps a pipeline a lot of weight-loss and men’s-health apps now use: a questionnaire, a fast charge, a refill that is hard to stop, and tracking code that tells ad platforms what just happened.

Hims Charged Patients Before They Met a Doctor

San Francisco-based Hims sells prescription care online for sexual health, hair loss, mental health, and weight loss. Shoppers fill out an intake form. Ads and the site, the FTC says, told them they would connect with a medical provider and find a treatment that was “right for them.”

The complaint says most people never get that consult. By sending the form, they are charged for a prescription plan and enrolled in refills, with almost no chance to review the treatment, let alone accept it. The agency says this has misled hundreds of thousands of customers. Commissioners voted 2-0 to file. The court still has to decide the facts.

Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection, said the complaint describes people locked into recurring subscriptions and the sharing of their most private health information without consent. One customer quoted in the release said they were told a doctor would be in touch in a few days and that the card would not be charged that day, then saw an immediate charge before any clinician conversation.

WHAT WE KNOW

• The docket: Case 3:26-cv-7871 is pending in the Northern District of California, last updated September 10, 2026.
• The claims: The FTC alleges violations of the FTC Act and the Restore Online Shoppers’ Confidence Act, which covers online negative-option billing.
• The partners: California, through Los Angeles County Counsel Dawyn R. Harrison, alleges false-advertising and unfair-competition violations; Utah alleges violations of its Consumer Sales Practices Act.
• The data path: The complaint says Hims sent customer lists to ad platforms and used tracking tools that automatically shared website “Events” with those companies.

WHAT IS UNCONFIRMED

• Liability: No court has ruled that Hims broke the law, and the company says it will fight the case.
• Money: The FTC asked for an injunction, civil penalties, and other relief; no penalty amount has been set.
• Current pixels: The complaint describes past sharing. It does not, in the pages made public, prove what code is on the live site now.

Hims launched ForHims.com around November 2017 and added Hers around November 2018. The growth pitch was speed and discretion. The FTC says that pitch included a privacy line the tracking stack did not match.

Why HIPAA Does Not Cover These Apps

HIPAA, the 1996 federal health-privacy law, generally binds health plans, most clinics and hospitals that bill electronically, and the vendors those groups hire. A direct-to-consumer telehealth site that takes a card, sends a questionnaire, and mails a drug often sits outside that list, even when the answers are as sensitive as a clinic chart.

Andrew Crawford, an attorney with the Center for Democracy and Technology, said there is an entire universe of companies collecting huge amounts of consumer health data every day that are not covered by current health-sector laws. Justin Brookman, Consumer Reports’ director of technology policy, put the gap more bluntly: there is no clear federal statute that simply says “don’t do this,” only a body of FTC cases that many firms may not even track.

That is why the FTC keeps using its unfair-and-deceptive-practices power, and why a separate rule for personal health records now matters for apps. Under HIPAA, a covered clinic needs a signed authorization, in plain language, before it uses protected health information for marketing. Many telehealth storefronts never enter that system at all.

WHO THE RULES ACTUALLY COVER

The FTC’s own business guidance says health information is broader than a diagnosis. Browsing a condition page, a location ping at a cancer center, or a purchase such as a home pregnancy test can all convey health status. If a site’s tracking tools share that material after a privacy promise, the agency treats it as deception. Health apps that are not HIPAA-covered can also fall under the Health Breach Notification Rule for health apps, which treats an unauthorized disclosure by the company itself as a breach and, after an April 26, 2024 update, speaks more directly to apps and similar tools.

California, Connecticut, Maryland, and other states have passed online privacy laws with extra health-data protections. Enforcement against telehealth brands under those statutes has been thin. The practical result is a questionnaire that feels like a doctor visit and a legal wrapper that often looks like e-commerce.

Weight-Loss Sites Skip the Eating-Disorder Screen

The same intake-first model now moves GLP-1 drugs, including compounded copies that the FDA has not approved. Nearly 1 in 5 adults taking a GLP-1 say they got the prescription online. Yale researchers tested how that actually works.

Ashwin K. Chetty, a Yale medical student, posed as an eligible 27-year-old patient and ran a secret shopper study of 49 websites between August and December 2025. The research letter, with Dr. Reshma Ramachandran, Dr. Joseph S. Ross, and colleagues, ran in JAMA on July 6, 2026. Forty-five sites (91.8%) wrote a prescription. Thirty-four (69.4%) mailed the drug. Every site used a questionnaire.

WHAT THE 49 SITES ASKED

Nine sites prescribed after the shopper sent only an upper-body photo when a full-body or scale photo was supposed to be required. Two prescriptions went out in 5 minutes or less. Three clinicians, on different sites, prescribed to the same simulated patient more than once. One site reversed an initial denial and issued a prescription after a refund request. 75.6% of the prescribing sites charged and shipped without a further confirmation step.

Among compounded prescriptions, 60.0% added a supplement such as vitamin B12 or glycine, and 44.9% of sites asked “personalizing” questions about formula or dose, a pattern the authors tie to keeping compounding going after shortage rules eased. Ramachandran, an assistant professor of medicine at Yale School of Medicine, told colleagues that it was incredibly easy to get access to the GLP-1s, and that most of the time the prescription was automatically sent without a chance to stop the dispensing. She has also urged pharmacists to ask whether patients are buying from telehealth or IV-hydration spas, because if clinicians do not ask, they will not know.

On March 3, 2026, the FDA sent 30 warning letters to telehealth companies over false or misleading claims about compounded GLP-1s, including copy that made the products sound the same as approved brand drugs. FDA Commissioner Marty Makary said compounders should not try to compound drugs in a way that circumvents the approval process. The agency has also warned that dosing errors with compounded injectable semaglutide have sent some patients to the hospital.

Medical groups that back GLP-1s for obesity still want a real talk about goals, prior attempts, and eating disorders, because the drugs can induce or worsen those conditions. A form that never asks the question cannot have that talk. A charge that fires when the form is submitted makes the talk optional.

The Cancel Button Hid Behind Extra Clicks

People who defend the Hims checkout path say the first charge is the fee for a clinician to read the form, that a second charge lands only if a drug is approved, and that canceling is two clicks. The FTC’s complaint describes a different sequence, one it says left customers paying for treatment they never agreed to buy.

WHAT THE COMPLAINT SAYS HIMS DID

• The pitch: Ads and intake pages offered a consult to decide whether a treatment was right, and asked for a card with the impression that billing waited on a prescription.
• The charge: Hims routinely billed for treatments and subscription plans almost immediately after the intake form arrived, the FTC says, before most people reviewed a plan.
• The refill: The company did not clearly tell people the dates of recurring refill charges, so some missed the window to stop a shipment they no longer wanted.
• The old cancel path: Before 2023, most customers could cancel only by phone, email, or chat, with extra hurdles that led to failed attempts and more charges.
• The 2023 button: Even after an online cancel option arrived for most users in 2023, the complaint says the control was hidden. It appeared only after someone chose “add/remove items from order” and moved through several steps before the word “cancel” showed up.

That design is the point of ROSCA. A negative option treats silence, a failure to reject the next box, as a yes. The statute requires clear disclosure, consent, and a simple way out. The FTC says Hims offered the opposite: a form that felt like the start of care and a bill that treated the form as the sale.

The privacy piece uses the same moment. The complaint says Hims told people the process was “100% online, private, and secure” and that sensitive health information would be accessed only by Hims medical providers. Instead, the agency says, the company shared lists of certain customers with ad platforms, including Meta and Snap, and installed trackers that fired Events, the actions a visitor took on the site, to those companies.

Erectile dysfunction, hair loss, anxiety, ADHD, and weight-loss intent are exactly the conditions people take online to avoid saying out loud at a pharmacy counter. If those answers become custom-audience fuel, the discretion that sold the app is the product being sold a second time.

BetterHelp Paid $7.8 Million for the Same Pixel Play

Hims is not the first telehealth brand to hear this from the FTC. It is the one still in court.

On February 1, 2023, the agency announced its first Health Breach Notification Rule case against GoodRx Holdings. The telehealth and drug-discount company agreed to pay a $1.5 million civil penalty and to stop sharing user health data with third parties for advertising. The FTC said GoodRx had promised it would never share personal health information with advertisers, then used pixels and related tools to send prescription and condition data to Facebook, Google, Criteo, and others, and failed to notify people of those disclosures.

In March 2023 the FTC announced a $7.8 million order against BetterHelp, the online counseling service, and made the order final on July 14, 2023. The agency said BetterHelp promised to keep health data private, then sent email addresses, IP addresses, and questionnaire answers to Facebook, Snapchat, Criteo, and Pinterest for ads, including lookalike audiences. About 800,000 people later got refund notices for accounts paid between August 1, 2017, and December 31, 2020. The order bars BetterHelp from sharing health data for advertising and from retargeting with personal information.

THREE FTC HEALTH-DATA CASES

The pattern is stable. A brand sells a private, clinical-feeling intake. Tracking tags on the same pages tell an ad network who converted, what they clicked, and, in the BetterHelp and GoodRx files, enough to infer a condition. Settlements then ban the sharing and, sometimes, send modest checks. They do not rebuild HIPAA around the app. They also do not put a clinician on the call the questionnaire skipped.

Hims says this latest complaint ignores state telehealth rules and industry practice after a nearly three-year investigation. The BetterHelp and GoodRx files are the industry practice the FTC already wrote down.

Intake Answers Still Reached Meta and Snap

Hims answered the same day the suit dropped. The company said the case disregards substantial evidence we provided the FTC during a nearly three-year investigation, ignores established state laws and industry standards in telehealth, and contorts the law to manufacture claims.

This is not enforcement grounded in consumer protection; it is an effort to generate headlines at our expense. We are confident in our position and will vigorously defend ourselves against these baseless claims.

Hims & Hers Health, Inc., July 29, 2026 statement

The same note says customers have the information they need to decide, and that the privacy policy makes clear they may choose how their data is used, with information shared with clinicians used only in providing care. It also says millions of people have used the service since 2017. That is the live dispute: a policy page versus a pixel log, a promised consult versus an immediate charge.

Our response to the lawsuit filed today by the Federal Trade Commission (FTC):

This lawsuit disregards substantial evidence we provided the FTC during its nearly three-year investigation, ignores established state laws and industry standards in telehealth, and contorts the law…

— Hims & Hers Comms (@HimsHersComms) July 29, 2026

Ad blockers and private browser windows can cut some tracking, which is why privacy lawyers still recommend them on telehealth domains. They do not stop a company from uploading a hashed customer list. They do not unread a questionnaire that already went to a clinician network and a marketing stack. They do not add an eating-disorder question that was never on the form. Crawford’s warning still holds: the system asks consumers to do a ton of work to understand each tool, and even then they often have little agency. Declining the terms of service, usually the first tap required to use the app, remains the only sure way to keep that particular company from collecting the file.

The court in San Francisco will sort the Hims counts. The second cost is already in the Yale letter and in the older FTC orders. A generation of health apps learned to sell a private visit, bill like a subscription box, and advertise like a shop. HIPAA was written for the clinic that already had your chart. It was not written for the form that writes the script, ships the pen, and still has a line open to Meta.

Disclaimer: This article is news reporting and analysis for general information. It is not medical advice, not legal advice, and not a recommendation to start, stop, or buy any prescription, telehealth plan, or supplement. Readers who have questions about a drug, an eating-disorder history, or a billing dispute should talk with a licensed clinician, a pharmacist, or a consumer-protection attorney before they act. Figures, case statuses, and company practices reflect the public complaints, orders, and studies cited here and can change as the Hims case moves and as sites update their forms and tracking code.