On November 10, 2026, the Federal Trade Commission announced that it had filed an amended complaint adding Arizona, Florida, Nebraska, Ohio, and Wisconsin as co-plaintiffs in its lawsuit against telehealth provider Hims & Hers Health, Inc.1 The newcomers join Utah and California (acting through Los Angeles County Counsel), which supported the FTC when it initially filed suit in the U.S. District Court for the Northern District of California on July 29, 2026.2 The case now combines claims under the FTC Act and the Restore Online Shoppers’ Confidence Act (“ROSCA”) with claims under the consumer protection laws of seven states.3 Think of it as a group chat nobody wants to join: every new member arrives with their statute, their investigators, and no intention of leaving early.
The allegations fall into two categories. Regarding privacy, the FTC alleges that Hims marketed its services as private while sharing customers’ health information, including their medical conditions, with Meta, Snap, and other advertising platforms.4 The original complaint identifies two channels familiar to every e-commerce and lead-generation team: customer lists shared with platforms and tracking technologies that automatically transmitted website visitor activity to them.5 Regarding billing, the complaint alleges that Hims collected payment details through its intake form, assured consumers that they would not be charged until a provider issued a prescription, and then charged most consumers and enrolled them in recurring subscriptions shortly after submission, without any provider consultation at that point.6 Consumers seeking to cancel allegedly had to contact customer service before 2023. After that, they had to locate a cancellation button that appeared only after navigating through several steps in an “add/remove items” menu option.7 Hims denies the allegations and states that the lawsuit “contorts the law to try to manufacture claims.”8
None of the tools at issue is unusual. Pixels, server-side conversion APIs, and audience-list uploads are used within the marketing operations of nearly every online retailer and lead generator in the country. The FTC’s theory does not rely on HIPAA or a data breach; it requires only a privacy representation and a data flow that contradicts it. Lead generators face an additional layer of exposure because an intake form requesting information about a medical condition, debt balance, or insurance need may disclose that response as soon as a pixel fires upon submission. Online retailers should review the billing allegations with equal care: a checkout process that captures a card “just to hold your spot,” a recurring charge that begins before the customer sees what they purchased, and a cancellation button concealed at the end of a burdensome process all correspond directly to the ROSCA theory in this case. The seven-plaintiff roster also affects settlement calculations, since resolving the matter with the FTC alone may not close the file when state co-plaintiffs retain independent claims. Your privacy policy and tag manager should present a consistent account, as regulators now review both.
The good news is that every issue raised in this complaint can be addressed through measures within your control, and implementing those measures is far less costly than defending a lawsuit brought by seven plaintiffs. Begin by inventorying every pixel, SDK, conversion API, and audience upload. Then identify which events are triggered on each page and the parameters they transmit. Remove health, financial, and other sensitive information from any data shared with an advertising platform, and ensure that your privacy policy, advertising materials, and influencer scripts accurately describe your code’s actual functionality. Regarding commerce practices, assess your checkout and cancellation processes for compliance with ROSCA: disclose material terms before collecting billing information, obtain express and informed consent before charging customers, and provide a straightforward method for stopping recurring charges. Organizations that address these matters now can focus next year on improving conversion rates rather than responding to civil investigative demands. If your organization uses tracking technologies, purchases or sells leads, or charges customers on a recurring basis, please contact the Troutman Amin compliance team to discuss how we may assist in addressing the concerns raised in this post.
Disclaimer: This article provides general informational and educational content only and does not constitute formal legal advice. The information contained herein may not reflect the most current legal developments, verdicts, or settlements. Reading this article, transmitting information through related platforms, or contacting the author does not create an attorney-client relationship. Readers should not act or refrain from acting based on any information in this article without seeking professional legal counsel tailored to their specific jurisdiction, facts, and circumstances. The author expressly disclaims all liability with respect to actions taken or not taken based on any or all contents of this publication.
Endnotes
1. “Five States Join FTC Lawsuit Alleging Hims and Hers Engaged in Deceptive and Unlawful Privacy Practices.” Federal Trade Commission, November 10, 2026, www.ftc.gov/news-events/news/press-releases/2026/11/five-states-join-ftc-lawsuit-alleging-hims-hers-engaged-deceptive-unlawful-privacy-practices.
2. “FTC and States Act Against Hims & Hers for Deceptive and Unlawful Privacy Practices.” Federal Trade Commission, July 29, 2026, www.ftc.gov/news-events/news/press-releases/2026/07/ftc-states-act-against-hims-hers-deceptive-unlawful-privacy-practices.
3. “FTC and States Act,” supra; “Five States Join,” supra.
5. “FTC and States Act,” supra.
6. “FTC and States Act,” supra.
7. “FTC and States Act,” supra.
8. Report on the FTC lawsuit against Hims & Hers Health. Quartz, July 29, 2026, qz.com/ftc-sues-hims-hers-health-data-billing-subscriptions-072926.