Five states — Arizona, Florida, Nebraska, Ohio and Wisconsin — have joined the Federal Trade Commission's lawsuit against telehealth company Hims & Hers Health, alleging the company engaged in deceptive and unlawful privacy practices. The FTC announced the additions on Oct. 10. The core allegation is serious and specific: that the company shared consumers' sensitive health information with third-party advertising platforms, including Meta Platforms and Snap, while telling customers its services protected their privacy.
The case matters to anyone who has used a telehealth service for weight loss, hair loss, erectile dysfunction or mental health treatment. Those services involve prescriptions shipped directly to your door and health details tied to your name and payment account. The suit also alleges a second problem on the money side: that Hims & Hers charges users for prescription drugs before they meet with healthcare providers and makes subscriptions difficult to cancel. According to Insurance Journal, the company says it will "vigorously defend" itself.
This case is also a window into how privacy enforcement actually works in the United States, where the rules are a patchwork of federal agencies and state laws, as we mapped in The U.S. state privacy law patchwork, mapped for normal people. A single company can face a federal agency, a county and a growing list of state attorneys general at the same time — each armed with a different statute. Readers following this should also see The U.S. state privacy law patchwork, mapped for normal people.
What exactly is the FTC alleging?
The lawsuit makes two separate sets of claims, and it helps to keep them apart.
The privacy claim alleges that Hims & Hers shared consumers' sensitive health information with third-party advertising platforms, including Meta Platforms and Snap. The FTC says the company did this despite claiming its services maintain consumers' privacy. In plain terms: the allegation is not just that data moved, but that what the company said about its privacy practices did not match what it did.
The billing claim alleges that the company charges users for prescription drugs before they meet with healthcare providers, and that it deceives users about its billing and cancellation practices. The FTC contends this makes subscriptions hard to cancel. These are allegations, not findings. The case has not been decided, and Hims & Hers disputes the claims.
Who is suing, and when did they join?
The sequence matters for understanding how the case grew.
- July: the FTC initiated the lawsuit. Los Angeles County and Utah joined at that stage.
- Oct. 10: the FTC said five more states — Arizona, Florida, Nebraska, Ohio and Wisconsin — had joined.
- Nov. 12: Insurance Journal reported the amended complaint, filed in the US District Court for the Northern District of California.
The amended complaint alleges violations of the five states' consumer protection laws in addition to federal laws. That is the structural point a newcomer should grasp: state consumer protection statutes let state attorneys general bring their own claims in the same federal case, rather than filing separately. Los Angeles County joined as a local government, which is why it appears alongside a state.
What is Hims & Hers, and why does this case reach so many people?
Hims & Hers is one of the largest telehealth players in the market for weight-loss drugs. It also treats erectile dysfunction, hair loss and mental health conditions, and it ships prescriptions directly to customers. That business model is what puts the privacy allegation in front of a large customer base: the people allegedly affected are patients who trusted the service with some of the most personal health questions a person can have.
The company has also hit a rough patch financially. It cut its full-year core profit forecast on a Monday in November, as higher costs tied to a pivot to branded weight-loss drugs and international expansion pressured margins, according to Insurance Journal. The report does not draw a line between the lawsuit and the forecast cut, and neither should a reader; the two facts sit side by side in the record, unconnected by any stated cause.
What does the company say?
Hims & Hers has responded through a spokesperson, who said: "We will vigorously defend ourselves against these follow-on claims, which rely on the same flawed allegations advanced in the government's lawsuit." This connects to our earlier piece, Revolut confirms customer data breach through fake government requests.
Two things are worth noting in that sentence. The company calls the state claims "follow-on," characterizing them as derivatives of the FTC's original case rather than independent investigations. And it calls the underlying allegations "flawed," disputing them outright. Both characterizations are the company's own. The court has not ruled on them.
What happens next, and what should a consumer take from this?
The case now sits in the US District Court for the Northern District of California, with the FTC, two states, one county and five newly joined states on one side and Hims & Hers on the other. Litigation of this kind typically takes months or years, and the available record does not say when a ruling might come.
For consumers, the practical lesson is about what a privacy promise is worth before it is tested. The FTC's theory in this case turns on a gap between what a company said about privacy and what it allegedly did with health data. That is a pattern worth watching in any telehealth service, because the data involved — prescriptions, conditions, treatment for stigmatized health issues — carries weight far beyond an ordinary marketing profile. Readers who want the broader context on how health and consumer data moves through ad platforms can follow our ongoing privacy coverage, and our Tech News section tracks enforcement actions as they develop.
What the record establishes is narrow and worth stating plainly: five states have joined a federal suit with specific allegations about data sharing and billing, the company denies the claims, and no court has yet decided anything. Everything beyond that — outcomes, penalties, changes to how telehealth companies handle ad data — remains unsettled until the docket says otherwise.
