The FTC's complaint against Hims & Hers highlights a common issue: companies often combine privacy violations with deceptive billing practices, then express surprise when regulators take action. The complaint alleges that the telehealth provider shared sensitive health information with Meta, Snap, and other advertising platforms while making it difficult for consumers to cancel subscriptions.
These aren't minor oversights. They're fundamental failures in consent, data minimization, and transparency. Here's what went wrong and how your team can avoid the same pitfalls.
Why These Mistakes Keep Happening
Telehealth companies face pressure to quickly convert website visitors into paying customers, often before a medical consultation. This urgency can lead to shortcuts in consent flows, billing disclosures, and tracking pixel use. When marketing teams add third-party analytics without consulting privacy experts, and when product managers prioritize conversion over transparency, you're building regulatory risk into your service.
The Restore Online Shoppers' Confidence Act and the FTC Act prohibit these practices. Yet companies often treat privacy notices as mere formalities rather than essential operational guidelines.
Mistake 1: Charging Before the Clinical Decision
Why it happens: Product teams collect payment information early to reduce friction, assuming the medical consultation is a formality since most applicants will receive a prescription.
The real consequence: Consumers reported being charged immediately after submitting intake forms, despite promises of a consultation first. One consumer said: "I was told that I would speak with a doctor in a few days and that nothing would be charged to my card that day. Hims & Hers charged me immediately! I never consented to charges before speaking with a healthcare professional."
This isn't just a billing issue. It's a consent failure. Charging consumers before a promised consultation invalidates the consent process.
The fix: Separate information collection from payment authorization. If you need payment details for verification, use authorization holds, not immediate charges. Clearly state: "You will be charged $X when Dr. [Name] prescribes your treatment, typically within 48 hours." Display this disclosure at the point of payment entry.
Mistake 2: Installing Tracking Pixels Without Health Data Governance
Why it happens: Marketing teams use tracking technologies like Meta Pixel and Snapchat Pixel to measure campaign performance, unaware these tools automatically transmit sensitive health information.
The real consequence: The FTC alleges Hims shared consumers' health information with advertising platforms through customer list uploads and tracking technologies that transmitted website visitor actions. When a user visits a page titled "/treatment/hair-loss" or submits a form about erectile dysfunction, that's health information. Sending that data to Meta without authorization is a privacy breach.
The fix: Implement a pre-deployment review for all third-party scripts. Before any tracking code goes live on health-related pages, your privacy team must confirm: What data does this tool collect? Where does it transmit? Is this covered in our privacy notice? Do we have a Data Processing Agreement with this vendor?
For health services, consider server-side event tracking instead of client-side pixels to control data flow. If you must use pixels, configure them to exclude URL parameters, form field names, and page titles that reveal medical conditions.
Mistake 3: Hiding Cancellation Behind Navigation Layers
Why it happens: Product teams design cancellation flows that require multiple clicks, force users through retention offers, or hide the cancel button under misleading labels.
The real consequence: The complaint states Hims made cancellation difficult. Before 2023, most consumers could only cancel via phone, email, or chat. Even after introducing online cancellation, the button was hidden under several navigation steps.
This violates the Restore Online Shoppers' Confidence Act, which requires clear cancellation mechanisms. It also destroys trust, leading to complaints and negative reviews.
The fix: Make cancellation as easy as signup. If a consumer can subscribe in three clicks, they should be able to cancel in three clicks. Clearly label a "Cancel Subscription" button in the account dashboard. Don't hide it under "Manage Items" or "Update Preferences."
Before cancellation, show what they'll lose and when it takes effect. After confirmation, send an email with the cancellation date. This transparency reduces support tickets and regulatory risk.
Mistake 4: Treating Privacy Notices as Legal Compliance Theater
Why it happens: Companies draft privacy notices to meet regulatory requirements, not to inform users. Notices may say "we may share information with third parties for analytics and advertising," which technically covers Meta Pixel. But consumers read "we protect your privacy" in marketing materials and assume their health information stays confidential.
The real consequence: The FTC alleges Hims promised to protect patient privacy while sharing health information with advertising platforms. This contradiction between marketing claims and practice can lead to deception claims.
The fix: Audit your consumer-facing communications for privacy claims. Verify that your data flows support any claims of privacy. If you share health information with advertising platforms, don't claim to maintain privacy. Either stop sharing or stop the claim.
For health data, disclose advertising partners by name. Don't say "we may share with third parties for analytics." Say "we share information about your visit with Meta and Snap for advertising purposes." Consumers deserve to know who sees their health information.
Mistake 5: Enrolling Users in Subscriptions Without Explicit Confirmation
Why it happens: Subscription models rely on recurring revenue, so companies design flows that make subscription enrollment the default, requiring users to opt out rather than opt in.
The real consequence: The complaint alleges consumers were charged and subscribed to treatments without reviewing or approving them. They didn't receive clear disclosure about when prescriptions would refill, complicating cancellation before the next billing cycle.
The fix: After a provider prescribes treatment, send a confirmation message stating: "Dr. [Name] has prescribed [Treatment]. You will be charged $X today and $X every 30 days until you cancel. Your next charge will occur on [Date]. [Cancel Subscription] [Confirm and Continue]."
Require users to click "Confirm and Continue" before processing the first charge. This creates a clear consent record. Send reminder emails three days before each recurring charge with a cancellation link to reduce disputes.
Prevention Checklist
Before launching any telehealth service or subscription product:
- Separate payment authorization from clinical decision-making; never charge before the provider prescribes.
- Inventory all third-party tracking technologies and document what health information they access.
- Require Data Processing Agreements with any vendor that receives health information.
- Configure tracking pixels to exclude URLs, form fields, and page titles that reveal medical conditions.
- Make cancellation symmetrical with signup; same number of clicks, clearly labeled.
- Audit marketing claims against actual data flows; if you share with advertisers, don't claim privacy.
- Require explicit confirmation before enrolling users in subscription billing.
- Send pre-charge reminders with cancellation links before each recurring payment.
- Test your cancellation flow quarterly to verify it remains accessible and clear.
- Name specific advertising partners in your privacy notice, not generic "third parties."
The Hims & Hers complaint shows what happens when commercial pressure overrides privacy design. Your conversion rate is meaningless if it leads to an FTC enforcement action.
