FTC Sues Hims & Hers Over Health Data Sharing and Dark Patterns

What happened

The US Federal Trade Commission has filed suit against telehealth company Hims & Hers, alleging that the firm shared sensitive patient health data with Meta and Snap without adequate disclosure, and deliberately obscured the process for cancelling subscriptions. The complaint, reported by The Register, marks one of the most direct regulatory challenges yet to the data practices of direct-to-consumer health platforms.

According to the FTC's allegations, Hims & Hers transmitted personal health information — including details about conditions patients had disclosed during consultations — to the two social-media giants, ostensibly for advertising purposes. Separately, the regulator claims customers were hit with unexpected charges for prescriptions and found it unreasonably difficult to cancel their subscriptions, a pattern the FTC characterises as a "dark pattern" designed to trap paying users.

The lawsuit is part of a broader FTC push to hold health-tech companies accountable for both privacy violations and manipulative subscription mechanics, areas that have drawn increasing scrutiny as telehealth has moved from fringe convenience to mainstream primary care.

Why it matters

For anyone working in customer experience or service design, this case is a sharp reminder that the architecture of a cancellation flow is not a neutral UX decision — it is a trust signal. When a customer cannot easily exit a relationship, the implicit message is that the company does not believe its service can retain them on merit alone. In healthcare, where vulnerability and information asymmetry are already elevated, that dynamic is especially corrosive. Patients who feel trapped or surveilled do not simply churn; they disengage from care altogether, a behavioural outcome with consequences far beyond a single brand.

The data-sharing allegation adds a second, distinct layer. Behavioural economics tells us that disclosure fatigue is real — customers routinely click through consent screens without reading them. Regulators are increasingly unwilling to treat that fatigue as informed consent, particularly when the data involved is health-related. Brands that have quietly relied on broad consent language to justify rich data flows to ad platforms should treat this filing as a direct warning shot.

By the numbers

• 2 major platforms — Meta and Snap — are named as recipients of the allegedly improperly shared patient data.
• 1 active FTC lawsuit filed as of late July 2026, representing a significant escalation in regulatory action against health-tech subscription businesses.

The Renascence take

Most commentary on this case will focus on the privacy violation, but the cancellation dark pattern is arguably the more instructive failure for operators to study. Deliberately burying an exit is a short-term retention tactic that destroys the very thing subscription health services depend on: sustained, trust-based engagement.

The companies most likely to repeat Hims & Hers' mistakes are those that measure retention without measuring resentment. A customer who stays because they cannot leave is not a loyal customer — they are a liability waiting to become a regulator's exhibit. The service-design principle here is straightforward: make leaving as frictionless as staying, because the willingness to let someone go is precisely what earns the right to keep them. Customer-obsessed operators should audit every exit flow this quarter, not because the FTC might come calling, but because a patient who trusts you enough to return voluntarily is worth ten who are simply stuck.