The FTC just sued Hims & Hers, and if you sell anything on a recurring basis online, you should read the complaint before your next growth sprint.
On July 29, the FTC teamed up with the Los Angeles County Counsel (on behalf of the People of California) and the Utah Division of Consumer Protection to file suit against Hims & Hers Health in the Northern District of California. The company runs the telehealth subscription platforms you’ve seen advertised everywhere for hair loss, ED, anxiety, and weight loss. The government’s theory is not exotic. It’s the same set of consumer-protection rules that apply to any online seller running a subscription.
Here’s what the regulators say Hims did, and what you should take from it.
Three problems, one playbook
The complaint breaks down into three buckets: how customers got signed up, how hard it was to get out, and what happened to their data.
The signup was a bait-and-switch, according to the government. Hims advertised a “free consult” where you’d “connect with a vetted provider” to see if treatment was “right for you.” At the end of the intake questionnaire, the checkout button said “Pay $0 today,” reassured customers they “won’t be charged until prescribed,” and told them in bold, “You will only be charged if prescribed.” The reality, the FTC alleges, is that most customers never got a consultation at all. A provider reviewed the form, wrote a prescription, and Hims charged the card and enrolled the person in a subscription before they even knew what had been prescribed. The one honest disclosure (“you are purchasing an automatically-renewing subscription”) sat in small, low-contrast font underneath the button.
Getting out was engineered to be hard. Hims allegedly charged the first refill ten days before the cadence customers picked, and required them to cancel two full days before that to avoid the charge, so a “monthly” plan effectively billed on day 20 with a day-18 deadline nobody was told about. When customers tried to cancel online, the word “cancel” didn’t appear on the subscription page. They had to guess that “Add/remove items from order” was the path, uncheck everything, and then click through three to ten survey screens and retention offers before the cancellation took. Tellingly, the complaint alleges Hims built simple one-click cancel buttons for California and Colorado, then rolled out the older, friction-heavy flow everywhere else.
The privacy promises didn’t hold. Hims told customers the process was “100% online, private, and secure,” that their records were “only accessed by the medical providers managing your care,” and had influencers call it “discreet. Meanwhile, the FTC says, Hims shared sensitive health information with Meta and Snap through customer-list uploads and pixel tracking, and had pixels from more than a dozen other ad platforms, including Google, TikTok, Pinterest, Reddit, Microsoft, and X, firing on its site. This is health data about erectile dysfunction, mental health, and the like, allegedly going out to ad networks while the marketing promised discretion.
The legal hooks
The FTC is leaning on Section 5 of the FTC Act (deception) and ROSCA, the Restore Online Shoppers’ Confidence Act, which governs online subscriptions with a “negative option” feature. ROSCA’s requirements are worth understanding: disclose all material terms clearly and conspicuously before you collect billing information, get the customer’s express informed consent before charging, and give them a simple way to stop the charges. California piled on with its False Advertising Law, Unfair Competition Law, and the Automatic Renewal Law; Utah added its Consumer Sales Practices Act.
One more detail regulators love to highlight: the complaint says Hims knew. It points to direct complaints, BBB and Trustpilot reviews, a Civil Investigative Demand back in October 2023, and the company’s own SEC filings flagging consumer-protection risk, and then argues Hims only cleaned things up after the FTC came knocking. Awareness plus inaction is often turns a compliance gap into an enforcement priority.
What to actually do with this
You don’t have to sell prescriptions to be in the FTC’s crosshairs here. If you run a subscription, a free trial that converts, or any auto-renewing offer, the same rules apply. A few things I’d put on the list:
- Fix your checkout disclosures. Every material term, price, billing timing, renewal, and cancellation deadline, needs to be clear and conspicuous and appear before the customer hands over payment info. Not in gray 10-point type where it’s hard to read or could be missed. And ensure you are obtaining consent to to those subscription terms in a way that complies with ROSCA’s requirements and state laws like California’s ARL (which gets more specific than ROSCA does and is frequently the subject of consumer class litigation).
- Kill the “free” claim if it isn’t. “Free consult,” “free trial,” “$0 today” are all fine only if the customer can actually walk away without paying. If the free thing funnels straight into a charge they can’t dodge, that’s a deception claim waiting to happen.
- Make canceling as easy as signing up. If a customer can subscribe in two clicks, cancellation shouldn’t take a scavenger hunt and a survey gauntlet. Put the word “cancel” where people look. Retention offers are subject to limitations under state laws like California’s ARL.
- Audit your pixels and data sharing. Walk your own site with the developer tools open and see what’s firing. If Meta, TikTok, or anyone else is receiving data tied to sensitive categories (health, sexual, financial), and your privacy policy or ads say otherwise, you have a problem.
- Remember your ads are promises. “Private,” “secure,” “discreet” are representations you have to back up. And the influencer content you review and approve is your speech, legally, so the same standard applies to it.
- Don’t sit on complaints. If customers, chargebacks, or your own reviews are telling you people feel tricked, pay attention. In an enforcement action or consumer case, they often become Exhibit A that you knew and kept going.
The through-line is simple. Regulators are focused on the gap between what your marketing implies and what your billing and data practices actually do. Close that gap now, on your own terms, rather than later on theirs.
This post is general information about a pending case and isn’t legal advice. The allegations against Hims & Hers are unproven. If you’re wondering whether your own flows hold up, that’s worth a real conversation.