FTC v. Hims & Hers: The Subscription and Consent Lessons

Here is the sentence from the complaint that I keep rereading: a patient says they never agreed to be charged before they spoke to a clinician.

On July 29, 2026 the FTC, joined by Utah and California, sued Hims & Hers. Most of the early coverage focused on health data and ad platforms. This one is about the money: when the card gets charged, what the patient agreed to, and how hard it is to leave.

Educational content only. This is not legal advice. Everything below describes allegations, and a court will decide the case.

What did the FTC allege about billing and consent?

That the checkout told patients one thing and the billing system did another.

The FTC says Hims asks for billing information on its intake form despite assurances that consumers "will not be charged unless and until medications are prescribed." It alleges that most consumers are charged and subscribed without a provider consultation or a chance to review the treatment, and that Hims enrolls them in recurring plans shortly after receiving intake forms.¹ It also alleges that Hims does not clearly disclose when monthly refills occur, which makes it hard to cancel before the next billing cycle.¹

The complaint was filed with Utah and California in the Northern District of California, after a 2-0 Commission vote.¹ The legal claims named in the release are the FTC Act, the Restore Online Shoppers' Confidence Act, Utah's Consumer Sales Practices Act and California's False Advertising and Unfair Competition Laws.¹ The release is explicit that the case will be decided by the court.¹

Hims strongly denies the allegations, according to Subscription Insider's coverage. It says the FTC ignored evidence from a nearly three-year investigation and "contorts the law," and it says it will defend itself.²

What does ROSCA actually require?

Three things, and the order matters: disclose, get consent, offer an easy exit.

The FTC summarizes ROSCA as banning online negative options unless the seller clearly discloses all material terms of the deal before obtaining the consumer's billing information, gets the consumer's express informed consent before making the charge, and provides simple mechanisms for stopping recurring charges.³

Read those against a telehealth flow. A card requested at intake is "billing information." A refill schedule is a "material term." A cancel button is the "simple mechanism." The complaint is, in effect, an argument that each of these was weaker in practice than on paper.

What happened to click-to-cancel?

The Eighth Circuit vacated the FTC's click-to-cancel rule on July 8, 2025, days before enforcement was to begin, on procedural grounds. The court said it did not endorse unfair and deceptive practices in negative option marketing.⁴ The firm that reported it noted the FTC would continue regulating how subscriptions are offered.⁴ This lawsuit is the proof. I walked through the rule's life in Click-to-Cancel Was Vacated. Build the Easy Exit Anyway.

Where does a telehealth checkout go wrong?

At three moments, according to the allegations: intake, approval and refill.

Moment one: intake

Subscription Insider's reading of the complaint says intake screens allegedly presented the step as submitting medical information for review, not as agreeing to a future charge, with phrases such as "Pay $0 today" and "You will only be charged if prescribed." It also says the subscription disclosure was allegedly in small, low-contrast text below the final button.² I cannot see the screens, so treat that as a secondhand account of allegations.

Moment two: approval

In most states, the complaint alleges, a provider could prescribe without another interaction with the patient, so customers were charged without a meaningful chance to approve the specific treatment.² The operational question for you is simple: after the clinician decides, does the patient get a clear moment to say yes before the card is charged?

Moment three: refill

Subscription Insider reports the FTC alleges the first refill was processed 10 days before the selected schedule, so a patient on a monthly plan would have had to cancel by day 18 to avoid a day-20 charge, with this disclosed in small text.² Whatever a court decides, the lesson holds: put the actual charge date next to the plan, in plain type.

What about cancellation?

The FTC alleges it was harder than signing up.

The release says that before 2023 most consumers could cancel only by phone, email or chat with added hurdles, and that after online cancellation arrived, the button allegedly appeared only after a consumer chose "add/remove items from order" and went through several steps.¹ Subscription Insider adds that the word "cancel" allegedly did not appear on the subscription page and that customers faced three to 10 questions on separate screens. It also reports that single-click cancellation was introduced in California and Colorado in June 2022 while other states got a different process.²

California's amended automatic renewal law now sets the bar: consumers must be able to cancel as easily as they signed up, and the law requires express affirmative consent to the renewal terms, effectively as two separate consents.⁵ It took effect July 1, 2025. If you serve patients in California, that is the standard to design for, and it is a sensible one for everyone else.

What should a clinic do this week?

Walk your own flow, then close the gaps between words and behavior.

A charge the patient did not expect becomes a refund request, then a chargeback, then possibly an exhibit. I covered the dispute side in Telehealth Chargebacks and Disputes and the compliance checklist in the subscription compliance checklist.

Is this only a problem for the giants?

No. The tools are the same and the logic is the same. A small clinic with a clean flow has one advantage a large company lacks: it can fix its billing screens in an afternoon.

A good billing flow is not a legal shield, and your attorney decides what applies to your states and your model. But the clinics that read the complaint as a design brief will be ahead of those that read it as news. If you want help walking your funnel, start on the telehealth page.

Consent has to be visible at the moment of charge, not buried in a footer.

Keep building.Ekai