FTC, California, And Utah Target Deceptive Billing And Health Data Sharing

On July 29, the Federal Trade Commission (FTC), joined by Utah and California, filed a complaint in the U.S. District Court for the Northern District of California against telehealth provider Hims & Hers Health Inc. (Hims & Hers). The action alleges deceptive subscription billing, obstructive cancellation practices, and unauthorized sharing of sensitive consumer health data with advertising platforms. This enforcement action confirms that the FTC and state regulators are aggressively pursuing unfair, deceptive, or abusive acts or practices (UDAAP) claims and subscription-billing claims, and it signals that every company’s terms and practices must be transparent and fully aligned with consumers’ actual experiences.

The Hims & Hers Complaint

The FTC’s complaint alleges that Hims & Hers:

• Charged consumers and enrolled them in recurring subscriptions almost immediately after they submitted an online intake form, despite promising a consultation with a medical provider to find a treatment “right for them” before any charge.
• Made cancellation unreasonably difficult: Before 2023, consumers had to contact customer service through phone, email, or chat, with added hurdles; after 2023, the “cancel” button was buried multiple navigation steps deep and only appeared after selecting “add/remove items from order.”
• Shared consumers’ sensitive health information, including data about medical conditions, with Meta, Snap, and other third-party advertising platforms via customer lists and website tracking technologies, despite privacy promises to consumers.
  
  

Legal Theories at Play

The complaint invokes multiple overlapping legal bases:

• Section 5 of the FTC Act (deceptive and unfair practices)
• The federal Restore Online Shoppers’ Confidence Act (ROSCA), which prohibits deceptive negative-option/subscription billing
• The Utah Consumer Sales Practices Act
• California’s False Advertising Law and Unfair Competition Law
• California’s Automatic Renewal Law
  
  

The multi-jurisdictional approach signals coordinated federal-state enforcement and broadens the geographic reach of any resulting remedies.

Action Items for Businesses

Companies offering subscriptions, implementing recurring billing, or collecting consumer data should promptly:

• Audit subscription enrollment flows to ensure that billing disclosures are clear and conspicuous before consumers are charged and that consumers affirmatively consent to recurring charges.
• Review cancellation processes for “click-to-cancel” parity: Cancellation should be as simple as sign-up, with no hidden navigation, multistep detours, or forced contact with customer service.
• Audit all website tracking pixels, software development kits (SDKs), and data-sharing arrangements with advertising platforms against your published privacy representations. If your privacy policy promises confidentiality, your technical integrations must deliver it.
• Align marketing claims with actual practices. If you tell consumers they will consult with a provider before being charged, ensure that is operationally true.
  
  

The FTC and state regulators are sending a clear message: They are pursuing UDAAP and subscription-billing claims aggressively. Companies’ terms and practices must be transparent. Deceptive subscription practices, dark-pattern cancellation flows, and privacy promises contradicted by adtech integrations will draw enforcement actions.

Companies should treat this case as a compliance road map and act now to close any gaps between their representations and their practices.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.