The recent FTC complaint against Hims & Hers highlights a common issue for compliance teams: companies building digital health services based on faulty assumptions about consent, data sharing, and subscription transparency. These aren't just technical oversights; they're systematic misconceptions about how privacy and consumer protection laws apply to telehealth platforms.
These myths persist because they seem plausible. Marketing teams aim for seamless user experiences. Engineering teams integrate standard advertising pixels. Product teams design easy signup flows. Each decision seems reasonable alone, yet together they create the compliance failures now facing Hims & Hers in federal court.
Myth 1: "Advertising pixels don't count as health data sharing"
Reality: When you embed Meta Pixel or Snap Pixel on pages where users disclose medical conditions, you're sharing health information with third parties, regardless of whether you call it "analytics" or "marketing optimization."
The FTC alleges that Hims shared consumers' health information with Meta, Snap, and other advertising platforms through customer list uploads and tracking technologies that automatically transmitted user actions. Your privacy policy's promise to "protect patient privacy" doesn't override what your tracking code actually does.
Under the Health Insurance Portability and Accountability Act, protected health information includes individually identifiable health data. Under the FTC Act, your representations about privacy must match your actual practices. The mechanism doesn't matter. If a pixel fires when someone selects "erectile dysfunction treatment" or "hair loss medication," you've created a data flow that contradicts most privacy promises.
What your team should verify: Run a complete inventory of every third-party script on pages where users submit intake forms, select conditions, or view treatment recommendations. Document exactly what data each script collects and where it goes. If you can't explain the data flow in a deposition, you shouldn't have the pixel.
Myth 2: "Consumers consent when they submit the intake form"
Reality: Collecting billing information early in the flow doesn't transform an intake questionnaire into purchase authorization, especially when you tell users they'll consult with a provider first.
The complaint describes consumers who believed they would "connect" and consult with a medical provider before any charges occurred. Instead, Hims enrolled most consumers in recurring subscriptions shortly after receiving intake forms, without giving them a chance to review or approve the prescribed treatment.
The Restore Online Shoppers' Confidence Act requires clear and conspicuous disclosure of all material terms before charging consumers. "Material terms" includes the fact that you'll charge them immediately, not after a consultation. One consumer complaint cited in the case states: "I was told that I would be able to speak with a doctor in a few days and that nothing would be charged to my card that day. Him's & Her's [sic] charged me immediately!"
Your intake form might technically mention charges in paragraph seven of the terms, but if your marketing promises a consultation first, you've created a deceptive sequence. The legal standard isn't whether the information exists somewhere in your flow. It's whether a reasonable consumer would understand what they're agreeing to before you charge them.
Myth 3: "Making cancellation available online is enough"
Reality: Offering cancellation doesn't satisfy your obligations if users can't reasonably find it or must navigate a deliberately obscure process.
According to the FTC's allegations, even after Hims introduced online cancellation in 2023, the company hid the cancellation button from consumers. Users had to select "add/remove items from order," then navigate several additional steps before seeing the word "cancel." Prior to 2023, most consumers could only cancel via phone, email, or chat, with additional hurdles imposed during those interactions.
This pattern demonstrates a fundamental misunderstanding of negative option rules. The standard isn't merely providing a cancellation path. It's ensuring consumers can cancel as easily as they subscribed. If signup takes three clicks and cancellation requires navigating a hidden menu structure, you've failed the test.
For subscription services, your cancellation mechanism should be:
- Accessible from account settings without requiring contact with support
- Clearly labeled as "cancel subscription" rather than buried under ambiguous menu options
- Completable in fewer steps than the original signup
- Confirmed immediately without retention offers that function as additional obstacles
Myth 4: "Privacy promises are marketing language, not binding commitments"
Reality: Every statement you make about data handling creates an enforceable representation under Section 5 of the FTC Act.
The complaint alleges that Hims promised to protect patient privacy while simultaneously sharing consumer health information with advertising platforms. This isn't a technical violation of a specific privacy regulation. It's a core deception claim: you said one thing and did another.
Your privacy policy, marketing copy, FAQ answers, and customer service scripts all create obligations. When you tell users "your health information stays private," you can't later argue that "private" means "private except for our advertising partners and their data brokers." The FTC evaluates your practices against your representations, not against what you wish you'd disclosed.
This applies regardless of whether you're covered by the Health Insurance Portability and Accountability Act. The FTC Act reaches deceptive practices in commerce. If you're a telehealth provider making privacy claims to consumers, those claims must be accurate and substantiated.
Myth 5: "We can fix consent issues with a policy update"
Reality: Retroactive policy changes don't cure consent violations for data you've already shared.
Some teams believe they can resolve third-party sharing issues by updating their privacy policy to disclose current practices. That approach fails for two reasons.
First, you can't retroactively consent to data sharing that already occurred. If you shared health information with Meta last year while promising privacy protection, updating your policy this year doesn't fix last year's deception.
Second, the General Data Protection Regulation and similar frameworks require that consent be freely given, specific, informed, and unambiguous before processing begins. If you're operating in California, the California Consumer Privacy Act requires opt-in consent before selling or sharing sensitive personal information, which includes health data. A policy update that says "we now disclose that we share your data" isn't the same as obtaining affirmative consent.
The correct sequence: stop unauthorized data flows immediately, assess what data you've already shared and with whom, determine your notification obligations, then rebuild your consent mechanisms before resuming any third-party data sharing.
What to do instead
Start with your actual data flows, not your documented policies. Map every instance where user-submitted health information moves to a third party, whether through APIs, pixels, list uploads, or analytics integrations. Compare those flows against every privacy representation you've made in the past 24 months.
For subscription mechanics, implement a cancellation process that mirrors your signup flow in complexity and accessibility. If users can subscribe with three clicks, they should cancel with three clicks.
For consent, treat health information disclosures as high-risk data processing that requires explicit, informed opt-in before any sharing occurs. "Agreeing to terms of service" doesn't constitute informed consent to share medical conditions with advertising platforms.
The FTC's complaint against Hims & Hers was filed in the U.S. District Court for the Northern District of California. The case will be decided by the court, but the compliance lessons don't require a verdict. Your telehealth platform's privacy practices must match your privacy promises, your billing practices must match your billing disclosures, and your cancellation process must actually let people cancel.
