FTC and states file enforcement action against digital healthcare provider challenging adtech & subscription practices

Key allegations and legal theories

The complaint sets out three principal categories of alleged misconduct:

1. Deceptive privacy practices

Provider advertised its telehealth services as “100% online, private, and secure” and assured consumers that their “medical records and sensitive information are only accessed by the medical providers managing your care.” The complaint alleges these representations were false or misleading. Despite these promises, Provider allegedly shared consumers’ sensitive health information—including information about conditions, such as mental health, erectile dysfunction and weight loss—with third-party advertising platforms. Provider purportedly did this through two primary mechanisms: (a) uploading customer lists to advertising platforms to match consumers to their social media accounts; and (b) deploying automated tracking technologies (such as cookies, pixels and beacons) on its websites that automatically transmitted consumer “Events” (i.e., actions taken on the Provider website) to these platforms. 

2. Deceptive billing and subscription enrollment practices

Provider advertised “free consultations” and represented that consumers could “connect” with a medical provider to determine whether prescription treatment was “right for them.” The complaint alleges that these representations were misleading because, for most consumers, Provider did not provide an actual consultation. Instead, after consumers submitted an online intake form—which required entering billing information—Provider’s medical providers unilaterally prescribed treatment, and Provider immediately charged consumers and enrolled them in recurring subscription plans, often before consumers even learned what treatment had been recommended, according to the complaint. The intake flow allegedly displayed reassuring statements, such as “Due Now $0,” “Pay $0 today,” and “You will only be charged if prescribed,” while critical subscription terms were buried in small, low-contrast text below the call-to-action button. Additionally, Provider allegedly failed to clearly disclose its refill processing policy, routinely charging consumers for refills 10 days earlier than the selected cadence and requiring cancellation two days before the refill date to avoid charges.

3. Failure to provide simple cancellation mechanisms

The complaint alleges that from at least 2019 through early 2025, Provider imposed technological hurdles that made it unreasonably difficult for consumers to cancel subscriptions. Before April 2023, most consumers could only cancel by contacting customer service via phone, email or chat, all of which presented significant obstacles. After Provider introduced an online cancellation flow in April 2023, the process remained intentionally confusing: the word “cancel” did not appear on the subscription page, and consumers had to click an “Add/remove items from order” button, navigate through multiple screens, uncheck all items and then answer three to ten survey questions before cancellation was accepted. Provider’s mobile applications initially did not permit cancellation at all, and when mobile cancellation was later added, the flow allegedly mirrored the same confusing process.

4. Authority for enforcement action and relief sought

The enforcement action asserts claims under both federal and state law. Three counts are brought under Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices affecting commerce. Counts IV, V and VI are brought under the Restore Online Shoppers’ Confidence Act (ROSCA), which prohibits charging consumers for goods or services sold through a “negative option feature” unless specified conditions are met. Additional claims are alleged under California and Utah state laws, including California’s False Advertising Law and Automatic Renewal Law, among others. 

The complaint seeks permanent injunctive relief, monetary relief (including restitution and disgorgement) and civil penalties of up to $2,500 per violation under both California and Utah law.

Practical takeaways for telehealth and digital health companies

This enforcement action underscores the heightened regulatory scrutiny facing telehealth and digital health platforms. Companies operating in this space may want to explore possible risk mitigation strategies including:

1. Review third-party data sharing and ad-tech integrations. Conduct a comprehensive review of all tracking pixels, SDKs and server-side integrations (e.g., pixels, beacons and cookies) deployed on consumer-facing platforms. Provider may consider caution when sharing health information—including information that reveals a consumer’s interest in or treatment for specific medical conditions—with advertising platforms absent disclosures and obtaining affirmative and informed consents where required. Companies may consider periodically examining if their current privacy policies and consent mechanisms accurately reflect data-sharing practices.
2. Consider whether billing disclosures are clear, conspicuous and unambiguous. Any subscription-based or negative-option offering may consider clearly disclosing all material terms—including the timing and amount of the initial charge, when recurring charges will occur, and the conditions triggering enrollment—before collecting billing information. Companies may want to confirm that disclosures are not buried in small font below call-to-action buttons or rely on conditional language (e.g., “if prescribed”) that obscures when a binding commitment arises. Companies may want to test whether a reasonable consumer would understand when and why they will be charged.
3. Evaluate the simplicity, transparency and ease of cancellation mechanisms. Under ROSCA and analogous state laws, companies may face scrutiny where consumers do not have access to simple, straightforward mechanisms for canceling recurring charges. Cancellation flows can use clear language (including the word “cancel”), be easy to locate and not require consumers to navigate multiple screens, complete surveys or contact customer service through burdensome channels. Companies may consider benchmarking their cancellation processes against the FTC’s Click-to-Cancel Rule and state-specific requirements.
4. Align marketing claims with actual consumer experience. If a company advertises “free consultations,” provider interactions, or the ability to determine whether treatment is “right for you,” companies may want to verify that the actual consumer experience delivers on those promises. Advertisements and intake processes could avoid creating a reasonable expectation of a provider dialogue if, in practice, the consumer is immediately charged and enrolled in a subscription without a meaningful opportunity to review or consent to the recommended treatment.
5. Verify whether existing compliance monitoring and complaint-response protocols are as robust as may need to be for the company. The complaint highlights that Provider was aware of widespread consumer complaints—including through the Better Business Bureau, Trustpilot and the Apple App Store—yet continued the challenged practices. Companies may want to update or establish systems to track, escalate and address consumer complaints related to billing, cancellation and privacy, and may wish to treat patterns of consumer confusion as a signal of potential compliance gaps rather than isolated incidents.

We will continue to monitor developments in this matter. For questions or to discuss how this enforcement action may affect your business, contact Brandi Taylor, Melissa Fox, Leslie Bender or your regular Eversheds contact. For information on the FTC’s prior digital health enforcement action, please see https://www.eversheds-sutherland.com/en/united-states/insights/ftc-diagnoses-common-digital-practices-as-both-udap-and-breach.

This client alert is for informational purposes only and does not constitute legal advice.

__________

If you have any questions about this Legal Briefing, please feel free to contact any of the attorneys listed or the Eversheds Sutherland attorney with whom you regularly work.