When you hand a company your medical history, you expect honesty about what happens to it next. Hims & Hers, the popular telehealth and prescription delivery platform, apparently did not hold up its end of that deal. The FTC, joined by several state attorneys general, has acted against the company for deceptive and unlawful privacy practices, accusing it of misleading users about how their personal and health data was being handled.
The core allegation is straightforward and damning. Hims & Hers told users one thing about their data and did another. For a company selling prescription treatments for sexual health, hair loss, mental health conditions, and other deeply personal concerns, that is not a minor compliance slip. It is a betrayal of exactly the kind of user who has the most to lose if their data ends up somewhere unexpected.
This case fits into a pattern that regulators have been watching for years. Telehealth companies exploded in popularity during and after the COVID-19 pandemic, pulling in millions of users who needed fast, discreet access to medical care. Many of those companies built their growth on aggressive data collection. The pitch was convenience. The business model, often quietly, involved data. Hims & Hers is not the first company in this space to draw regulatory fire, and it almost certainly will not be the last.
What makes this enforcement action notable is the multi-state involvement. When the FTC teams up with state attorneys general, it signals that regulators are treating this as more than a paperwork problem. It also means the company faces pressure from multiple directions at once, which tends to produce more significant outcomes than a federal action alone.
For users, the practical takeaway is uncomfortable. Health data is among the most sensitive information anyone can share. It can affect insurance, employment, and personal relationships. Platforms that collect it have real power over people’s lives, and privacy policies written in vague or optimistic language are not protection. They are cover.
The broader question this case raises is one regulators have been slow to answer with real force: should companies handling medical information be held to stricter, clearer standards than a buried terms-of-service page allows? The FTC action against Hims & Hers suggests the answer might finally be moving toward yes. But the proof will be in the penalty, not the press release.