Five More States Join FTC Suit Over Hims and Hers Privacy Claims

Five more states joined the Federal Trade Commission's lawsuit against telehealth company Hims & Hers Health, Inc. on November 10, 2026, through a first amended complaint in the Northern District of California. The pleading now runs 16 counts under the FTC Act, ROSCA and seven state consumer-protection regimes. Nothing in it has been proven.

Information last verified on November 11, 2026. This is a developing story; we update it as the record changes.

Status: This is an amended complaint, meaning a pleading filed by the plaintiffs in FTC v. Hims & Hers Health, Inc., No. 3:26-cv-07871-VC (N.D. Cal.), docketed as Document 67 on November 10, 2026. The allegations in it have not been tested in court, the FTC's public case page lists no response from Hims & Hers to the amended pleading as of November 11, 2026, and there is no finding of liability against the company as of that date. The FTC's own notice on the filing states that the Commission files a complaint when it has reason to believe the law is being or about to be violated, and that the court decides the case.

Jurisdiction scope: This article covers a federal civil enforcement action in the U.S. District Court for the Northern District of California brought under the FTC Act and ROSCA, together with state-law counts under California, Utah, Arizona, Florida, Nebraska, Ohio and Wisconsin consumer-protection statutes. It does not cover private class actions against the same company, state medical-licensing or pharmacy regulation, or HIPAA enforcement by the Department of Health and Human Services.

What Happened

On November 10, 2026 the FTC announced that Arizona, Florida, Nebraska, Ohio and Wisconsin had joined its existing lawsuit against Hims & Hers Health, Inc. as co-plaintiffs. The vehicle was a first amended complaint filed in the U.S. District Court for the Northern District of California, Case No. 3:26-cv-07871-VC, stamped Document 67 on the court's electronic docket and posted on the FTC's case timeline as a First Amended Complaint for Permanent Injunction, Declaratory Judgment, Monetary Judgment, Civil Penalty Judgment, and Other Relief. The FTC matter number is X260029. The Commission vote to authorize filing was 2-0.

The plaintiff list now has eight entries. The FTC appears alongside the People of the State of California, acting by and through Los Angeles County Counsel Dawyn R. Harrison; the Utah Division of Consumer Protection; the State of Arizona ex rel. Kristin K. Mayes, Attorney General; the Office of the Attorney General, State of Florida, Department of Legal Affairs; the State of Nebraska ex rel. Michael T. Hilgers, Attorney General; the Attorney General of the State of Ohio; and the State of Wisconsin. The defendant is described in the pleading as a Delaware corporation with its principal place of business in San Francisco that sells prescription and non-prescription treatments on a negative-option basis (para. 26).

The action is not new. We covered the original FTC and state complaint when it was filed. The FTC announced the original case on July 29, 2026 with Utah and California as its only state partners, and the FTC case page lists a redacted complaint e-filed July 29, 2026 and a further complaint dated August 31, 2026 before the November 10 amendment.

Three groups of allegations run through all 16 counts. First, the intake and charging allegations: the complaint alleges that Hims advertising and intake flows told consumers no payment was due at submission, including a final call-to-action button reading "Due Now - $0" and bolded text stating "You will only be charged if prescribed," while in practice most consumers were charged and subscribed almost immediately after submitting an intake form and without a provider consultation (paras. 38 to 39). Second, the billing and cancellation allegations: that the first refill was routinely charged 10 days before the cadence a consumer selected, with some later refills processed up to two days early, requiring cancellation two days before the refill date to avoid the charge, and that this policy was not clearly and conspicuously disclosed (paras. 53 to 54); that before April 2023 most consumers had to contact customer service and first supply a date of birth and a past order number before any help with cancelling (paras. 56 to 58); and that the online cancellation flow added in April 2023 placed the cancellation path behind an "Add/remove items from order" button, used the word cancel nowhere on the subscription page, and then required roughly three to ten survey screens (paras. 62 to 66).

Third, the privacy allegations, which the FTC's announcement put at the front of the filing. The complaint alleges that until at least late August 2023 the company's homepage answered the question "How does Hims ensure patient privacy?" by assuring consumers their "medical records and sensitive information are only accessed by the medical providers managing your care," that its online advertising promised a "100% online, private, and secure process," and that influencer advertising it approved described the service as discreet (paras. 74 to 76). Against those representations, the pleading alleges that between September 2020 and June 2023 roughly 14 million consumer email addresses were uploaded to Meta to build custom audiences, that Meta matched about 10 million of them to Meta user IDs, that 90 lookalike audiences were created between March 2020 and September 2023, and that audience names such as "All Time Hims ED Purchasers" and "Churned_ED_Customers" revealed the condition being treated even where internal codewords were used (paras. 80 to 81). It makes parallel allegations about Snap, where five named uploaded lists are alleged to have held more than a million email addresses tied to mental-health and sexual-health treatment categories (para. 88), and it lists advertising pixels from Microsoft, Google, Criteo, Pinterest, Reddit, TikTok, The Trade Desk, X and others (para. 89).

The pleading's central privacy allegation, which Hims and Hers has not yet had the chance to answer, reads:

"Despite promising privacy and discretion, Hims shared consumers' sensitive health information with third-party advertising companies and platforms (“Advertising Platforms”) such as Meta Platforms, Inc. (“Meta”) and Snap Inc. (“Snap”) through at least May 2024. During this time period, Hims did not clearly and conspicuously disclose to consumers that it would share their health information with Advertising Platforms." Source: First Amended Complaint, FTC v. Hims & Hers Health, Inc., No. 3:26-cv-07871-VC (N.D. Cal. filed Nov. 10, 2026), para. 78

Counts I through III are FTC Act Section 5(a) counts brought by the FTC alone: deceptive privacy practices, failure to disclose the sharing of health information with advertising platforms, and deceptive intake practices. Counts IV through VI are ROSCA counts brought by the FTC together with California, Arizona, Florida, Nebraska, Ohio and Wisconsin. Counts VII and VIII are California False Advertising Law and Unfair Competition Law counts, with the UCL count resting on predicate violations that include the FTC Act, ROSCA, California's Automatic Renewal Law at Business and Professions Code section 17600 et seq., and California common-law and constitutional privacy claims (paras. 127 to 131). Count IX is the Utah CSPA count, Count X the Arizona Consumer Fraud Act count, Counts XI and XII the deceptive and unfair prongs of the Florida Deceptive and Unfair Trade Practices Act, Count XIII the Nebraska Uniform Deceptive Trade Practices Act count, Counts XIV and XV the Ohio Consumer Sales Practices Act counts (including the Limitations and Exclusions Rule at Ohio Admin. Code 109:4-3-02 and the Misuse of the Word "Free" Rule at 109:4-3-04), and Count XVI the Wisconsin Deceptive Trade Practices Act count under Wis. Stat. 100.18(1).

What the Law Actually Says

ROSCA is short, and the operative section is worth reading in full because the three counts track it clause by clause. Section 4, codified at 15 U.S.C. 8403, makes it unlawful to charge or attempt to charge a consumer for goods or services sold in an internet transaction through a negative option feature unless the seller does three things: "(1) provides text that clearly and conspicuously discloses all material terms of the transaction before obtaining the consumer's billing information; (2) obtains a consumer's express informed consent before charging the consumer's credit card, debit card, bank account, or other financial account for products or services through such transaction; and (3) provides simple mechanisms for a consumer to stop recurring charges from being placed on the consumer's credit card, debit card, bank account, or other financial account."

Those three clauses map exactly onto Counts IV, V and VI. A negative option feature, as the complaint cites it, is the Telemarketing Sales Rule definition at 16 C.F.R. 310.2(w): an arrangement in which the seller treats the consumer's silence or failure to cancel as acceptance. Two mechanics follow. Under Section 5(a) of ROSCA, 15 U.S.C. 8404(a), a ROSCA violation is treated as a violation of a rule promulgated under Section 18 of the FTC Act, which in turn makes it an unfair or deceptive act under Section 5(a) of the FTC Act and opens the door to monetary remedies. Under 15 U.S.C. 8405(a), a state attorney general or other authorized state officer alleging a ROSCA violation that affects the state or its residents may sue in federal district court "to obtain appropriate injunctive relief." That provision is the authority the six state plaintiffs invoke for the federal counts (para. 9). Readers tracking the broader subscription-law picture may want to compare how federal and state auto-renewal rules treat subscriptions that are hard to get out of, because ROSCA is the statute doing the work here while the FTC's separate negative option rulemaking has been reopened: the FTC's rule page lists a February 12, 2026 Federal Register notice revising the Negative Option Rule to conform to federal court decisions and a March 13, 2026 advance notice of proposed rulemaking.

The FTC Act counts rest on an older and broader provision. Section 5(a)(1), 15 U.S.C. 45(a)(1), provides that "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful." There is no separate federal statute here making a broken privacy promise illegal. The legal theory is that a privacy representation is an advertising claim like any other, so a specific assurance about who can see health information is material, and sharing that information with advertising platforms while the assurance stays up is alleged to make the claim deceptive. That is the same structure as Count II's omission theory: once a company volunteers assurances about privacy, the complaint alleges, failing to disclose that it shares the same data with advertising platforms is itself deceptive.

The state counts carry remedies the federal counts do not, chiefly civil penalties and forfeitures. Several of the state statutes are also expressly keyed to federal interpretation. Ohio Revised Code 1345.02(A) prohibits any supplier from committing "an unfair or deceptive act or practice in connection with a consumer transaction," and subsection (C) instructs courts construing it to "give due consideration and great weight to federal trade commission orders, trade regulation rules and guides, and the federal courts' interpretations" of FTC Act Section 5. Arizona Revised Statutes 44-1522(A) reaches "any deception, deceptive or unfair act or practice, fraud, false pretense, false promise, misrepresentation, or concealment, suppression or omission of any material fact with intent that others rely on such concealment, suppression or omission," in connection with the sale or advertisement of any merchandise "whether or not any person has in fact been misled, deceived or damaged thereby." Subsection (C) is softer than Ohio's: it says courts construing subsection A "may use as a guide" interpretations given by the FTC and the federal courts to 15 U.S.C. sections 45, 52 and 55(a)(1). Florida's statute incorporates the federal standards by definition: section 501.203(3), Florida Statutes, defines a violation of FDUTPA to include violations of "(a) Any rules promulgated pursuant to the Federal Trade Commission Act" and "(b) The standards of unfairness and deception set forth and interpreted by the Federal Trade Commission or the federal courts." California's UCL count borrows the federal violations outright as predicate acts. The amendment adds state remedies and state penalty schedules, and, because the original pleading's ROSCA counts were brought by the FTC alone, six states now suing under 15 U.S.C. 8405(a) on behalf of their residents. Where a reader wants the state-by-state picture of privacy obligations rather than the enforcement picture, our state privacy law tracker and the detail on California's layered privacy regime cover the statutory baseline.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

What is notable about this filing is how conventional its legal tools are. There is no new health-privacy statute at work in Counts I and II. The claim is deceptive advertising under a 1914 statute, with the advertisement being a privacy assurance rather than a price or a performance claim. That framing has a consequence worth sitting with: under this theory, the legal exposure comes from the promise, not from the data sharing in the abstract. A company that said nothing about privacy and shared the same information would not be exposed to a Section 5 deception count on these facts, though a Section 5 unfairness theory, which does not depend on any representation, would remain available to the FTC, along with state-law and common-law claims.

The second structural point is ROSCA's state-enforcement clause. 15 U.S.C. 8405(a) has been on the books since December 29, 2010, and it gives state officers a federal cause of action limited to injunctive relief. That limitation is why the amended complaint reads the way it does: the states that joined the ROSCA counts also pleaded their own statutes, where the penalty authority lives. An enforcement action structured this way lets a single pleading in a single district court carry both a federal injunctive theory and seven state penalty schedules, which is a materially different posture for a defendant than a federal case alone.

Third, the privacy allegations are about advertising infrastructure rather than a breach. Nothing in the complaint alleges an intrusion by an outsider. The alleged mechanism is ordinary marketing plumbing: customer-list uploads, custom and lookalike audiences, and event pixels. The pleading's own detail about internal codewords is the interesting part, because it goes to whether obfuscating an audience name changes what the recipient platform can infer. That question, not the existence of the pixel, is where a case like this is actually contested.

All of that said, this is a pleading. The allegations are the plaintiffs' account of the record, drawn in part from internal documents they describe but which are not public in full. A defendant's answer, a motion to dismiss, or discovery can change the picture substantially, and we take no position on how any count resolves.

How This Affects You

Nothing in this filing changes anyone's legal rights today. It is a complaint, and complaints allocate claims, not outcomes.

For a reader who sells subscriptions online, the operative text is the statute rather than the news. ROSCA requires clear and conspicuous disclosure of all material terms before billing information is collected, express informed consent before the charge, and a simple mechanism to stop recurring charges, per 15 U.S.C. 8403. The sequencing in that first clause is part of the requirement: the disclosure must come "before obtaining the consumer's billing information," so a disclosure that surfaces only after billing details have been captured does not meet the clause on its own terms.

For a reader who used a telehealth or health-adjacent service and is concerned about where their information went, the most useful correction is about HIPAA's reach, which is narrower than most people assume. HIPAA's administrative-simplification standards apply, by statute, to three categories of persons: a health plan, a health care clearinghouse, and "a health care provider who transmits any health information in electronic form in connection with a transaction" covered by the statute, under 42 U.S.C. 1320d-1(a). A company that handles health-adjacent information but falls outside those categories is not thereby regulated by HIPAA, which is part of why consumer-protection statutes and the FTC's separate Health Breach Notification Rule for vendors of personal health records and related entities exist at all. Our explainer on what the HIPAA breach rules require of the entities they actually cover sets out that boundary in more detail. As a general matter, a person who believes a company misrepresented its privacy practices can report it to the FTC at ReportFraud.ftc.gov, the intake site the FTC names in this press release, or to their state attorney general's consumer-protection unit, and a person in a state with a comprehensive privacy statute may have statutory access, deletion or opt-out rights independent of any enforcement action.

What Happens Next

The procedural path from here is ordinary federal civil litigation. Under Federal Rule of Civil Procedure 15(a)(3), unless the court orders otherwise, any required response to an amended pleading is due within the time remaining to respond to the original pleading or within 14 days after service of the amended pleading, whichever is later. A defendant in this posture may answer the amended complaint or move to dismiss under Rule 12, and Rule 12(b) permits a motion directed at some counts while others are answered.

Beyond the response, a litigated case of this kind typically involves a ruling on any threshold motion, then discovery, then summary-judgment briefing on the counts that survive, with the possibility of settlement at any stage. The plaintiffs' prayer for relief asks the court for a permanent injunction against future violations of each statute pleaded, a declaratory judgment under the Ohio CSPA, monetary relief under the FTC Act and ROSCA and the state acts, an equitable accounting and disgorgement of money received in violation of the Utah CSPA, civil penalties and forfeitures under each state's own schedule, and costs and attorney's fees. Whether any of that is awarded is for the court.

We are watching the FTC case page for the company's response and for any order on a threshold motion, and we will update this article when the docket moves.

This is general legal information, not legal advice. It covers a federal enforcement action in the U.S. District Court for the Northern District of California under the FTC Act and ROSCA, plus state-law counts under California, Utah, Arizona, Florida, Nebraska, Ohio and Wisconsin consumer-protection statutes, and reflects sources verified on November 11, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• Click to cancel laws and the state auto-renewal rules behind them
• A state-by-state comparison of US privacy statutes
• California data privacy laws under the CCPA and CPRA
• Reporting a HIPAA breach: who must report, and when
• Our coverage of the original July 2026 FTC and state complaint

---

Last updated: 2026-11-11. This is a developing story; details verified as of 2026-11-11.

Frequently Asked Questions

Has a court found that Hims & Hers violated privacy or subscription laws?

No. The November 10, 2026 filing is a first amended complaint, which is a pleading setting out the plaintiffs' allegations in FTC v. Hims & Hers Health, Inc., No. 3:26-cv-07871-VC (N.D. Cal.). There is no finding of liability as of November 11, 2026, and the FTC's notice on the filing states that the court decides the case.

Which states are now suing Hims & Hers with the FTC?

Eight plaintiffs appear on the amended complaint: the FTC, the People of the State of California (acting through Los Angeles County Counsel), the Utah Division of Consumer Protection, Arizona, Florida, Nebraska, Ohio and Wisconsin. Arizona, Florida, Nebraska, Ohio and Wisconsin joined on November 10, 2026; California and Utah were already plaintiffs when the case was announced on July 29, 2026.

What is ROSCA and what does it require?

The Restore Online Shoppers' Confidence Act took effect December 29, 2010. Its Section 4, at 15 U.S.C. 8403, makes it unlawful to charge a consumer for goods or services sold online through a negative option feature unless the seller clearly and conspicuously discloses all material terms before obtaining billing information, obtains express informed consent before charging, and provides simple mechanisms to stop recurring charges.

Can a state attorney general sue under a federal statute like ROSCA?

Under 15 U.S.C. 8405(a), a state attorney general or other authorized state officer alleging a ROSCA violation that affects the state or its residents may bring an action in federal district court to obtain appropriate injunctive relief. The statute limits the state remedy under that section to injunctive relief, which is why the states in this case also pleaded their own consumer-protection statutes for penalties.

Is sharing health information with Meta or Snap illegal by itself?

The complaint does not plead it that way. Counts I and II are deception counts under Section 5(a) of the FTC Act, 15 U.S.C. 45(a), alleging that the company's affirmative privacy assurances were false or misleading and that it failed to disclose the sharing. The theory turns on the representations made to consumers, not on data sharing as a standalone violation.

Does HIPAA cover telehealth companies like this one?

Not automatically. HIPAA's standards apply by statute to health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with covered transactions, under 42 U.S.C. 1320d-1(a). A health-adjacent company outside those categories is not regulated by HIPAA on that basis, and no HIPAA count appears in this complaint.

What counts does the amended complaint actually plead?

Sixteen. Counts I to III are FTC Act Section 5(a) counts; Counts IV to VI are ROSCA Section 4 counts; Counts VII and VIII are California False Advertising Law and Unfair Competition Law counts; Count IX is Utah; Count X is Arizona; Counts XI and XII are Florida; Count XIII is Nebraska; Counts XIV and XV are Ohio; and Count XVI is Wisconsin.

What relief are the plaintiffs asking for?

The prayer for relief seeks a permanent injunction, a declaratory judgment under the Ohio Consumer Sales Practices Act, monetary relief, an equitable accounting and disgorgement as to Utah, civil penalties and forfeitures under each plaintiff state's schedule, and costs and attorney's fees. Whether any relief is granted is for the court to decide.

Can a consumer join this lawsuit?

No. This is a government enforcement action brought by the FTC and seven state plaintiffs, not a class action, so there is no consumer class to join. Consumers can report conduct to the FTC at ReportFraud.ftc.gov or to their state attorney general's consumer-protection unit.