The federal case against telehealth company Hims & Hers has grown from three plaintiffs to eight. On November 10, 2026, the Federal Trade Commission said it had filed an amended complaint adding Arizona, Florida, Nebraska, Ohio and Wisconsin as co-plaintiffs alongside Utah and the People of California, who are represented by Los Angeles County Counsel. The core allegations are unchanged: that Hims promised a private service while sharing information about customers’ medical conditions with advertising platforms such as Meta and Snap, and that it charged people for prescription subscriptions before they had a real chance to say yes. Hims denies the claims and has called the new state claims “follow-on” allegations it will fight. What the expansion shows is how quickly one federal privacy case can turn into a multistate enforcement action.
TL;DR
- Arizona, Florida, Nebraska, Ohio and Wisconsin joined the FTC’s lawsuit against Hims & Hers in an amended complaint filed in the U.S. District Court for the Northern District of California; the Commission vote to file it was 2-0.
- The complaint alleges that Hims shared consumers’ health information with Meta, Snap and other ad platforms despite privacy promises, and that its billing and cancellation practices violated the FTC Act, the Restore Online Shoppers’ Confidence Act and state consumer protection laws.
- These are allegations; Hims has moved to dismiss, with a hearing set for January 14, 2027, and it recorded an accrual of about $60 million for the matter as of September 30, 2026.
What changed on November 10
The FTC, the Utah Division of Consumer Protection and Los Angeles County first filed the case on July 29, 2026, in FTC v. Hims & Hers Health, Inc., No. 3:26-cv-07871. We covered the original FTC complaint against Hims & Hers when it was filed. The FTC’s announcement of the amended complaint adds five states and their consumer protection statutes to the federal claims. The Commission vote authorizing staff to file it was 2-0.
One point of precision is worth making, because some summaries have described the case as being brought under state privacy acts. The original complaint pleads California’s claims under the Unfair Competition Law and False Advertising Law, Business and Professions Code sections 17200 and 17500, and Utah’s under the Utah Consumer Sales Practices Act. It does not plead the California Consumer Privacy Act or the Utah Consumer Privacy Act. The FTC describes the five new states’ claims the same way, as violations of their consumer protection laws. In other words, this is a deception and unfairness case about health data, not a case under a comprehensive privacy statute.
That framing matters for other companies. Consumer protection statutes in every state reach misleading privacy claims, whether or not the state has passed a privacy law, and many carry per-violation civil penalties. California’s UCL, for example, allows penalties of up to $2,500 per violation, a theory that private plaintiffs have also used in UCL lawsuits over the Meta Pixel.
What the complaint alleges
The allegations fall into two groups. Neither has been proven, and the court has not ruled on any of them.
On privacy, the plaintiffs allege that Hims told consumers their “medical records and sensitive information are only accessed by the medical providers managing your care,” and advertised a “100% online, private, and secure process,” while customers sought treatment for conditions such as erectile dysfunction, premature ejaculation and mental health conditions. According to the complaint, Hims:
- uploaded lists of customers to Meta and Snap to match them to their social media accounts for advertising;
- placed the Meta Pixel and Meta’s Conversions API on its platforms, which the plaintiffs say transmitted website events to Meta;
- placed pixels from at least 13 other advertising platforms on its website, including Google, Microsoft, Pinterest, Reddit, TikTok, Criteo, the Trade Desk and X; and
- did not clearly and conspicuously disclose that it shared health information with those platforms.
Much of the detail in the July complaint is redacted. Press accounts of the amended complaint report figures such as roughly 14 million email addresses uploaded to Meta between 2020 and 2023. We have not been able to check those numbers against an unredacted filing, so treat them as reported allegations.
On billing, the FTC alleges that Hims enrolled consumers in prescription subscriptions and charged them almost immediately after they submitted an intake form, even though its marketing suggested they could first consult a provider about whether a treatment was “right for them.” It also alleges that cancellation was hard to find. Those counts arise under the FTC Act and the Restore Online Shoppers’ Confidence Act, which requires clear disclosure of material terms, express informed consent before charging, and simple cancellation for negative option plans.
The company’s position
Hims has denied wrongdoing. In its quarterly report filed with the SEC on November 9, the company said the FTC first issued a civil investigative demand in October 2023, that settlement talks failed, and that it filed a motion to dismiss on October 22, 2026, now set for hearing on January 14, 2027. It said it believes it has meritorious arguments and intends to defend itself vigorously. It also disclosed a legal contingency accrual of about $60 million for the matter as of September 30, while warning that the amount could rise or fall materially. A company spokesperson told reporters the new state claims “rely on the same flawed allegations advanced in the government’s lawsuit.” An accrual is an accounting estimate, not an admission or a settlement.
Why more states keep joining
States have practical reasons to join a federal case rather than file their own. They share the FTC’s investigative record, add their own penalty and restitution remedies, and get a seat at the table in any settlement. For a defendant, every new co-plaintiff adds another statute, another set of remedies and another negotiator. Four lessons for health and wellness brands follow.
- Your privacy marketing is evidence. The case rests as much on what Hims allegedly promised as on what it shared. Taglines like “private” and “discreet,” FAQ answers and influencer scripts should be reviewed by the same people who know what your tags and audience uploads do.
- Customer-list uploads are a disclosure. Uploading hashed emails to build ad audiences sends information to the platform. When the list is defined by a medical condition, the list itself can reveal health information.
- Pixels on intake flows are the highest-risk placement. Regulators and plaintiffs keep returning to tags on sign-up and medical intake pages. Our analysis of CVS’s web tracker settlement makes the same point for pharmacy.
- Privacy and billing problems travel together. Subscription design and data sharing both sit in the growth stack, and enforcers increasingly plead them side by side. Pre-checked enrollment and buried cancellation buttons are dark patterns in the same family as deceptive consent banners.
The case is also a reminder that HIPAA is not the boundary of health privacy risk. Direct-to-consumer telehealth and wellness brands often sit partly or wholly outside HIPAA, which is why the FTC uses Section 5 against them and why the gap between HIPAA and sensitive health advertising keeps widening. Businesses facing pixel claims under the FTC Act’s deception standard can review how Section 5 theories show up in Meta Pixel demand letters.
Frequently asked questions
Is the case brought under the CCPA?
No. California participates through Los Angeles County Counsel under the Unfair Competition Law and False Advertising Law. Utah sues under its Consumer Sales Practices Act. The five new states add their own consumer protection laws.
Has a court found that Hims shared health data unlawfully?
No. The FTC files a complaint when it has “reason to believe” the law is being violated. The court will decide the case, and Hims has moved to dismiss.
What do the plaintiffs want?
The July complaint seeks a permanent injunction, monetary relief, civil penalties and other relief under the FTC Act, ROSCA and the state laws.
Does the $60 million accrual mean a settlement is close?
Not necessarily. It is the company’s estimate of a probable loss under accounting rules, and Hims says it may change materially as the case proceeds.
Eight plaintiffs, one record
The amended complaint does not add new allegations about what Hims did. It adds more governments willing to argue about it. That is the trend health brands should plan for: a single federal investigation can now arrive with a coalition of states attached, each bringing its own statute. The best defense is a privacy promise that matches, tag for tag and upload for upload, what the marketing stack actually does.
