What the complaint says
The FTC's press release of July 29, 2026 describes the case in the Northern District of California with the State of Utah and California, through Los Angeles County counsel, as co-plaintiffs. Three allegations carry it. First, that Hims charged consumers "immediately upon intake form submission" while telling them they could consult a provider first, so that most were "unknowingly charged for and subscribed to a prescription treatment without having a chance to review or approve it." Second, that cancellation was available only by phone, email or chat before 2023, and that after an online option arrived the company "hid the cancellation button from consumers" behind multiple steps. Third, that health information was shared with Meta and Snap through customer lists and through tracking technologies that sent website "Events" automatically. The laws cited are the FTC Act, the Restore Online Shoppers' Confidence Act, Utah's Consumer Sales Practices Act and California's false advertising and unfair competition statutes; the Commission voted 2-0 to file (FTC).
Hims & Hers responded the same day that the suit "disregards substantial evidence we provided the FTC during its nearly three-year investigation, ignores established state laws and industry standards in telehealth, and contorts the law to try to manufacture claims," and that the company "will vigorously defend" itself (Hims & Hers). Its shares fell about 10% on the news. We have no view on who wins. We have a strong view on what a checkout should do, because every one of the three allegations is a product decision that a founder makes in week two of a build, usually without noticing.
Decision one: when the charge happens
The intake-then-charge pattern exists because it converts. A patient who has just spent six minutes answering medical questions is at peak intent, and asking for a card before the provider reviews the case captures that intent. The complaint's theory is that a charge taken before any clinician has approved treatment, presented as if a consultation comes first, is a deceptive subscription enrollment. The design answer does not require giving up the moment.
Collect the payment method at checkout. Authorize, do not capture. Tell the patient in one sentence what happens next: a licensed provider reviews the case, and the card is charged only if treatment is approved; if it is not, nothing is charged. Capture the payment and start the subscription clock at the moment of clinical approval, and send the receipt with the approval message. Every patient then has exactly the experience the marketing described, and the brand keeps the card on file it needed. Turbopills is built this way: the subscription starts when the provider approves, not when the form is submitted, and the failed-payment retries and refunds run from that event. Question 13 on the platform demo scorecard asks every vendor to show it live; if the answer is "patients are charged at checkout regardless of outcome," you have found the complaint's fact pattern in your own stack.
The refund policy follows from the same rule. If a provider declines treatment there should be nothing to refund, because the capture never happened; a refund in that situation is a bug in the billing flow. The billing UX post covers what the patient should see before the first renewal.
Decision two: how cancellation works
ROSCA has required since 2010 that a negative-option seller disclose the material terms before obtaining billing information, obtain express informed consent, and provide "simple mechanisms" to stop recurring charges. The FTC's click-to-cancel rule, which would have made "as easy to cancel as to sign up" explicit, was vacated by the Eighth Circuit on July 8, 2025, and the Commission opened a new pre-rule proceeding in March 2026. None of that changed ROSCA, which is the statute in the Hims complaint and in the FTC's $2.5 billion Amazon Prime settlement.
The spec is short. A patient who subscribed online can cancel online, from the account page, in one step that is visible without scrolling, without a phone call, without a retention script that blocks the button. Offer a pause or a dose change on the same screen if you like; the cancel must still complete there. Confirm by email with the effective date and the last charge. Clinically, cancellation should also trigger the right message: for a GLP-1 patient, information about stopping and about maintenance options, which is a retention tool that happens to be good care. The subscription design post has the patterns that retain without hiding anything.
Decision three: what your pixels send
The third allegation is the one most brands are exposed to without knowing it. A Meta pixel or Snap tag on an intake page fires events with the page URL, the button text, form fields, and the user's identifiers. If the URL is /weight-loss/checkout and the event is Purchase, Meta now knows a named user bought a weight-loss prescription. The complaint calls that sharing health information; so does Washington's My Health My Data Act, Connecticut's and Nevada's health data laws, and the wave of pixel class actions that has run through health systems since 2022, with Advocate Aurora's $12.2 million settlement as the benchmark. HHS narrowed its own tracking-technology guidance after a 2024 court ruling, which is exactly why the FTC and the states are the enforcers now.
The design answer is not "no analytics." It is: no third-party advertising tags on any page that reveals a health condition, treatment, or intent, which means intake, checkout, the portal and any URL containing a condition or drug name. Measure conversions server-side from your own systems with hashed identifiers and a consent record, send the ad platforms the minimum they need to attribute a campaign, and keep the event names generic. Landing pages that describe a program without capturing anything can carry standard tags. First-party conversion infrastructure is the architecture; Turbopills' built-in analytics and the API exist so that a brand can measure its funnel from its own data instead of from a pixel.
The 12-point checkout audit
Run it against your own storefront, or send it to the vendor you are evaluating.
| # | Check | Pass looks like |
|---|---|---|
| 1 | When is the card charged? | Authorized at checkout, captured on clinical approval |
| 2 | What does the patient read at the card step? | One sentence: reviewed by a licensed provider, charged only if approved |
| 3 | What happens if the provider declines? | No capture, automatic message, no refund needed |
| 4 | Are the subscription terms shown before the card field? | Price, interval, renewal date, how to cancel, all above the button |
| 5 | Is consent recorded? | Timestamped consent to the terms, stored with the order |
| 6 | Can a patient cancel online in one step? | Visible button on the account page, completes without a call |
| 7 | Is there a retention screen? | Optional pause or dose change; cancel still completes on the same page |
| 8 | Is cancellation confirmed in writing? | Email with effective date and last charge |
| 9 | Which tags load on intake and checkout? | None from ad platforms; first-party analytics only |
| 10 | What do server-side events contain? | Hashed identifiers, generic event names, no condition or drug in the payload |
| 11 | Do URLs reveal conditions? | Program pages fine; intake and checkout paths neutral |
| 12 | Who can see the answers to 1 to 11? | Written down, owned by someone, reviewed quarterly |
A brand that passes all twelve has not guaranteed itself against a complaint. It has removed the three fact patterns in this one, and it has a better checkout: patients who understand when they will be charged convert at least as well and dispute far less, which matters under Visa's 1.5% dispute threshold in force since April 1, 2026.
Why this is a platform question
Each of the three decisions is trivial to describe and awkward to retrofit. Capture-on-approval needs the billing system to listen to the clinical workflow, which a stitched stack of a form tool, a Stripe account and an EHR does not do without engineering. One-step cancellation needs a patient portal that owns the subscription, not a support inbox. Pixel-free measurement needs the funnel's events to come from the platform, not from the browser. That is why we built billing, provider review, portal and analytics as one system in Turbopills, and it is also why the honest advice for anyone on a stitched stack is to audit the three decisions this week, before someone else does.
FAQ
What did the FTC accuse Hims & Hers of? In a complaint filed July 29, 2026 with Utah and Los Angeles County, the FTC alleged that Hims charged consumers upon intake submission before any provider consultation, hid the cancellation option behind multiple steps, and shared health information with Meta and Snap through customer lists and tracking technologies, in violation of the FTC Act, ROSCA and state consumer laws. Hims denies the allegations and says it will defend the case.
Can a telehealth company charge before the provider approves treatment? The safer design is to authorize the payment method at checkout and capture it only when a licensed provider approves treatment, telling the patient exactly that. Charging at intake while describing a consultation first is the fact pattern in the FTC's complaint.
Does the click-to-cancel rule apply to telehealth subscriptions? The FTC's click-to-cancel rule was vacated by the Eighth Circuit on July 8, 2025, and a new rulemaking began in March 2026. ROSCA still applies: clear disclosure of terms before billing information, express consent, and a simple cancellation mechanism. Online sign-up should mean online, one-step cancellation.
Can I use the Meta pixel on my telehealth site? On general program pages, with care. On intake, checkout and portal pages, or any URL that reveals a condition or treatment, the FTC complaint, Washington's My Health My Data Act and pixel litigation all point the same way: no. Measure conversions server-side from your own systems with hashed identifiers and generic event names.