Dive Brief:
- The Federal Trade Commission is suing Hims & Hers, alleging the telehealth company illegally shared sensitive health information with advertisers and misled customers about its billing practices.
- The agency says California-based Hims & Hers made it difficult for users to cancel subscriptions, charged patients for medications before they consulted with a provider and shared their health data with third-party advertising platforms like Meta and Snap.
- Hims & Hers called the FTC’s claims “baseless,” saying in a Wednesday statement that the agency “contorts the law to try to manufacture claims.”
Dive Insight:
The suit, filed in California federal court, alleges that Hims & Hers shared consumers’ health information via tracking pixels – small snippets of code embedded in websites that monitor user behavior and transmit the data to third-party vendors.
According to the lawsuit, the telehealth company, which sells prescription medications and personal care products directly to consumers, repeatedly promised privacy and discretion in advertisements for its weight loss, sexual health and hair loss medications.
Despite these promises, Hims & Hers allegedly used the pixels to share patient data with advertisers like Microsoft, Google and X.
In addition to privacy concerns, the lawsuit says that Hims & Hers made it difficult for consumers to cancel their subscriptions, forcing some patients to pay for unwanted refills. The company also failed to disclose that it charged customers for prescriptions almost immediately after submitting an intake form, despite claiming that customers could consult with a provider before committing to treatment.
“The FTC’s complaint lays out a troubling scenario — consumers unknowingly locked into recurring subscriptions and the disclosure to third parties of consumers’ most private health information without their consent,” Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection, said in a statement.
Hims & Hers denied the allegations, saying that the FTC disregarded evidence it provided during a three-year investigation into the company’s conduct.
When reached for comment, a representative for Hims & Hers declined to answer specific questions, instead pointing to its public statement and privacy commitment, which was posted on its website the same day the lawsuit was announced.
The privacy commitment said that Hims & Hers’ internal data practices were designed to protect patient information, and noted that the company excludes information that patients share with their providers from marketing activity.
Hims & Hers is not the first telehealth company to face scrutiny from regulators regarding its use of tracking pixels.
In 2023, the FTC banned telehealth company BetterHelp from sharing consumer data with third parties for marketing purposes after claiming it shared customers’ health data with Facebook.
A year later, telehealth company Cerebral paid a $7 million fine to settle allegations from the FTC that it had improperly disclosed sensitive health information through tracking pixels.
Tracking pixels are commonplace in many industries, such as e-commerce and social media. But their widespread use in healthcare — a 2023 study published in Health Affairs found that nearly all U.S. non-federal acute care hospital websites contained them — has repeatedly raised data privacy concerns.
One study published in PNAS Nexus found that hospitals that used third-party tracking pixels were 46% more likely to experience a data breach.
And Hims & Hers is no stranger to privacy and security risks. Earlier this year, a hacker gained access to its third-party customer service platform through a sophisticated social engineering scheme. The company has not disclosed how much data was compromised during the breach.
