By Chuck Gallagher — Business Ethics Keynote Speaker and Trainer
TL;DR: Chuck Gallagher, AI ethics speaker and author, examines the FTC’s July 2026 lawsuit against Hims & Hers and argues the failure alleged there was not malice but automation — a set of shortcuts that felt like standard practice right up until the consequence arrived all at once.
It is 11:40 at night. A man sits on the edge of his bed with his phone. He answers a few questions about hair loss, then twenty-five more about his medical history, then types his card number, because the screen tells him “Due Now – $0.” Right above the button, in bolder text: “You will only be charged if prescribed.” He taps it. He goes to sleep believing a doctor will look at his file and get back to him.
According to a federal complaint filed on July 29, 2026, that is not what happened next.
What Does the FTC Actually Allege Against Hims & Hers?
The Federal Trade Commission, the People of the State of California acting through Los Angeles County Counsel, and the Utah Division of Consumer Protection sued Hims & Hers Health, Inc. in the Northern District of California. Case No. 3:26-cv-7871. Nine counts. It asks for a permanent injunction, monetary judgment, and civil penalties.
The allegations fall into two piles. The billing pile: plaintiffs allege most consumers never received the promised consultation, that a contracted provider unilaterally wrote a prescription, and that the company charged the card and enrolled the customer in a recurring subscription before that customer knew what had been prescribed. The complaint says this misled hundreds of thousands of people.
The privacy pile: plaintiffs allege the company advertised a “100% online, private, and secure” process and told consumers their records were only accessed by the medical providers managing their care — then shared customer lists and website event data with Meta and Snap. The complaint further alleges pixels from at least thirteen other advertising platforms sat on the site — Google, Microsoft, TikTok, Reddit, Pinterest, the Trade Desk. This is a company selling treatment for mental health, erectile dysfunction, and hair loss. Discretion was not a feature. Discretion was the product.
None of this is proven. These are allegations. A court decides.
Why Does Automation Make Rationalization So Cheap?
As an AI ethics speaker and author, I have watched this same sequence run in a dozen industries, and the machinery underneath it barely changes. Need. Opportunity. Rationalization. Put those three in a room together and somebody is about to make a choice they will spend years explaining.
Automation doesn’t invent the need. What it does is widen the opportunity and make the rationalization sound reasonable. Nobody stands up in a growth meeting and says, let’s hand our customers’ depression diagnoses to an ad network. What gets said is that measurement is broken and conversion signal is weak. Pixels are standard. Everybody runs them. All of that is true. All of it is beside the point.
Here is the thing about a tracking pixel. It doesn’t know it is carrying a secret. The Conversions API described in the complaint is not a person weighing discretion — it is a pipe that fires when a visitor does something on a page. Automate the pipe and the moral weight of the decision front-loads into one configuration screen somebody touched once, four years ago, and nobody has opened since. The choice happens one time. The consequence accrues every second after that.
What Does a Cancellation Button Say About a Company?
More than the code of conduct does. Trust me.
Read the cancellation allegations. Before April 2023, most customers could only cancel by calling, emailing, or opening a chat. In June 2022, plaintiffs allege, the company built a simple one-click cancel button — and shipped it to California and Colorado only. When it rolled cancellation out to the rest of the country, it allegedly reached for the older flow. The one it had refined to obstruct cancellations.
Then look at the flow itself. To cancel, a customer had to find a button labeled “Add/remove items from order.” The word cancel appeared nowhere on the subscription page. Uncheck every item. Reach a cancel button. Then answer somewhere between three and ten survey questions, each on its own screen, before the cancellation would take.
And the refills. The complaint alleges the first refill charge landed ten days before the cadence the customer selected, with a cancellation deadline two days before that. Pick monthly, get charged on day twenty, and you had until day eighteen to stop it.
Every one of those steps survives a meeting. Retention surveys are normal. Early shipping prevents gaps in treatment. It all sounds downright reasonable — right up until you stack the steps end to end and ask what the stack was built to accomplish.
When Does the Consequence Chain Snap Back?
Later than you want. That is exactly the problem.
The FTC issued a Civil Investigative Demand in October 2023. Plaintiffs allege the company did not meaningfully change the screen consumers saw after submitting their intake until late 2025, after learning of the investigation. Roughly two years of knowing and continuing. The complaint cites that delay as one reason to believe the conduct will continue.
I made my own version of that calculation once. [CHUCK: one or two sentences of your own here — your words, not mine.] The consequence took years to show up, and when it did, it showed up all at once. As an AI ethics speaker and author, the point I work hardest to land in a boardroom is this: the gap between the choice and the consequence is not evidence you got away with anything. It is just the gap.
Hims sells trust. A federal complaint alleging it fed sensitive health signals to ad platforms does not damage a product line. It damages the premise.
What Should Leaders Do Differently on Monday?
Three things.
Map the data before you defend it. The GOVERN function sits at the center of the NIST AI Risk Management Framework for a reason — you cannot manage what nobody owns. Put a named human owner on every tracking technology on your property, and make that person write down what leaves the building and where it lands.
Second, prohibit sensitive-category signals from advertising platforms unless the customer affirmatively opts in. Not buried consent. Not a low-contrast paragraph under a button.
Third, test your cancellation path the way a regulator will. Count the clicks. Count the screens. Then ask whether you would read that count out loud in a courtroom.
You already know the answer. You usually do.
Frequently Asked Questions
What is the FTC suing Hims & Hers over?
On July 29, 2026, the FTC — joined by the Utah Division of Consumer Protection and the People of the State of California acting through Los Angeles County Counsel — filed a nine-count complaint in the U.S. District Court for the Northern District of California. It alleges deceptive privacy practices, deceptive intake and billing practices, and violations of the Restore Online Shoppers’ Confidence Act, along with state law claims. The complaint seeks a permanent injunction, monetary judgment, and civil penalties. The allegations have not been proven, and the case will be decided by the court.
Did Hims & Hers share health information with Facebook?
The complaint alleges the company shared consumers’ health information with Meta in two ways: by uploading lists of certain customers for matching, and through automated tracking technologies including the Meta Pixel and the Conversions API. It makes similar allegations regarding Snap and lists pixels from at least thirteen additional advertising platforms placed on the company’s website. These remain allegations, and no finding of liability has been made.
Is it illegal to make a subscription hard to cancel?
Under the Restore Online Shoppers’ Confidence Act, a seller charging consumers online through a negative-option feature must clearly and conspicuously disclose material terms before collecting billing information, obtain express informed consent before charging, and provide a simple mechanism to stop recurring charges. Failing any one of those is treated as a deceptive act under Section 5 of the FTC Act. State automatic-renewal laws, including California’s, add their own disclosure requirements and civil penalties on top of that.
What does this case mean for other telehealth and subscription companies?
It signals that regulators are reading the interface itself as evidence. As an AI ethics speaker and author, I would tell any leadership team in this position to assume the click path, the font size of the disclosure, and the internal decision to ship a simple cancel button in two states but not the rest will all be read back to them in open court. Companies moving sensitive health data through automated advertising tools carry the most exposure here.
How can a company avoid a dark pattern or health privacy claim?
Start with a written inventory of every tracking technology on your properties and a named owner for each one. Prohibit sensitive-category data from reaching advertising platforms without affirmative opt-in, and audit that prohibition on a schedule rather than only at launch. Then measure your cancellation path in clicks and screens and compare it honestly against your signup path. If canceling takes longer than subscribing, you already have your answer.
Where This Goes Next
None of this is a technology problem. The pixel did what it was configured to do. The billing system charged what it was told to charge. Every one of those instructions came from a person who had a reason, and the reason sounded fine at the time. That is the part I work on with organizations — not the tooling, but the moment somebody decides the shortcut is defensible. If your team is building automated systems that touch customer trust, and you want that conversation had out loud before a regulator has it for you, that is the work Chuck Gallagher does. You can start it at ChuckGallagher.com.
Five Questions for Reflection
1. Where in our own product is a customer agreeing to something they do not know they are agreeing to?
2. Which automated system running on our property has no named human owner right now?
3. If a regulator counted the clicks between our customer and a cancellation, what number would they get — and how does it compare to the number of clicks it takes to sign up?
4. The last time somebody in a meeting said “everybody in the industry does this,” what were we actually protecting?
5. What have we already known for two years and still not changed?
