Hims & Hers’ Privacy Case Now Includes Five More States
Matthew Leo · Published November 11, 2026 · Business & Policy
News analysis
Five more U.S. states have joined the Federal Trade Commission’s lawsuit against Hims & Hers, expanding a case that puts the privacy promises of online healthcare alongside its subscription practices.
Arizona, Florida, Nebraska, Ohio and Wisconsin were added through an amended complaint filed November 10. The FTC and its original partners allege that Hims shared sensitive health information with advertising platforms despite representations about privacy, and misled consumers about billing and cancellation.
These remain allegations. Reuters reports that Hims & Hers disputes the claims and intends to defend itself. The court has not decided that the company violated the law.
Three permissions that should not be bundled together
The FTC announcement describes more than a dispute over one privacy notice. It raises three separate consumer questions:
- Health information: Does information supplied to seek treatment also reach advertising businesses, and what has the person been told about that?
- Payment: When does submitting an intake form become authorization to charge for a prescription?
- Renewal: Can the person understand and stop a continuing subscription without unnecessary obstacles?
Consent to receive care is not, by itself, an explanation of an advertising disclosure. Nor does entering a payment card make the timing and conditions of every later charge obvious. Each decision needs its own intelligible terms.
The case docket identifies the amended complaint and the proceeding’s pending status. Adding states expands the parties and state-law claims; it does not turn the original accusations into a judgment.
The Canadian comparison is consent, not a transplanted lawsuit
The U.S. case does not decide a Canadian customer’s rights. Canadian health and privacy obligations depend on the organization, activity and jurisdiction involved.
But the Office of the Privacy Commissioner’s meaningful-consent guidance offers a useful benchmark. It says express consent is generally needed for sensitive information, uses outside reasonable expectations or a meaningful residual risk of significant harm. Health information is generally sensitive, and non-essential disclosures should come with a clear choice.
For someone evaluating a telehealth service, the practical questions are therefore specific: who receives the intake information, whether advertising use is optional, when the first payment occurs, whether treatment is conditional on approval and how renewal ends. Save the terms shown at enrolment and any cancellation confirmation.
Organizations buying or operating digital-health services face the same separation of responsibilities. Mapletechie’s coverage of Canada’s proposed health-data governance specification examines who should own those decisions. A reassuring privacy slogan is not a substitute for identifying the recipients, purposes and choices attached to the data.
Cover illustration: a conceptual scene, not a photograph of the people, location or event described.
Tags: privacy, consumer protection, digital health, Hims & Hers