The Federal Trade Commission issued 27 enforcement actions related to consumer data privacy in 2024, a 45% increase from the previous year. Between September 2025 and August 2026, the Food and Drug Administration sent 113 warning letters to telehealth companies. The figures point to wider regulatory attention on a sector that has expanded alongside demand for remote medical services.
Several of the FTC’s cases have centred on whether companies gave consumers a clear account of how personal health information would be used. Civil penalties under FTC enforcement can reach up to $50,120 per violation, adjusted annually for inflation.
OmniHealth Systems, an Atlanta-based startup with over 3 million user profiles, promoted “ironclad privacy” and said “data never shared without your explicit consent”. Its terms of service, however, allowed for user health data to be anonymised and aggregated with third-party pharmaceutical companies for research and development.
The company’s consent process consisted of one checkbox stating: “I agree to the Terms of Service and Privacy Policy.” The FTC announced an investigation into OmniHealth’s data handling, citing alleged misrepresentations about sharing information and inadequate security. The available information does not establish whether the investigation led to penalties.
The distinction between anonymised data and identifiable information is also under scrutiny. A Pew Research Center study published in March 2025 found that 87% of people in a publicly available “anonymized” dataset could be identified again with three demographic data points.
Samuel Chen, the FTC’s director of the Bureau of Consumer Protection, said: “The era of burying critical data practices in obscure legal documents is over. We expect transparency and accountability from companies handling sensitive consumer information.”
The agency has already secured penalties in cases involving mental health and prescription-related services. It fined mental telehealth company Cerebral more than $7 million over charges that it disclosed users’ sensitive personal health information to third-parties for advertising.
The FTC said: “Cerebral and its former CEO, Kyle Robertson, repeatedly broke their privacy promises to consumers and misled them about the company’s cancellation policies.” Cerebral had described its services as “safe, secure, and discreet”, according to the FTC, while failing to clearly disclose that user information would go to third-parties for advertising. The agency accused the company of placing those practices in dense privacy policies.
On February 1, 2023, the FTC acted against GoodRx over disclosures of health information to Facebook, Google, Criteo, Branch, and Twilio without notice. The case resulted in a $1.5 million civil penalty. On March 2, 2023, the FTC barred BetterHelp from disclosing consumer data, including sensitive mental health information, to Facebook and imposed a $7.8 million penalty.
The most recent major case named in the available material involves Hims & Hers Health, Inc. The FTC, the Utah Division of Consumer Protection and the People of the State of California sued the company on July 29, 2026.
The suit alleges that Hims uploaded approximately 14 million customer email addresses to Meta between September 2020 and June 2023. Meta matched about 10 million of those addresses to user accounts, according to the allegations.
Hims allegedly sent advertising platforms email addresses and other identifiers alongside labels identifying the treatment users had signed up for, including erectile dysfunction, premature ejaculation or mental health care. The company is also alleged to have used the information to build “Lookalike Audiences” aimed at potential customers based on existing users’ health conditions.
Until at least late August 2023, the Hims homepage said that medical records and sensitive information were only accessed by providers managing a patient’s care. The FTC alleges that sharing with advertising platforms continued through at least May 2024. No settlement, class certification or claim forms existed as of September 18, 2026.
Privacy concerns have been compounded by cybersecurity incidents. Veradigm, a health-record technology provider serving thousands of hospitals, reported that hackers entered a vendor’s systems and stole customer information including Social Security numbers. The Gentlemen ransomware gang said it had taken the health records of 3.5 million patients, a claim that has not been independently established in the available information.
In December 2025, Veradigm reported a cybersecurity incident to the U.S. Department of Health and Human Services, saying that 2,672,036 people had health data exposed in a breach in December 2024. The company had also been attacked by the SamSam ransomware gang in 2019. The available facts do not establish whether that earlier attack was connected to the later breach or whether Veradigm changed its defences after 2019.
The cases set out a common regulatory concern: health companies’ public assurances can differ sharply from the data practices described in lengthy terms or alleged by regulators. The available enforcement record does not show what share of telehealth providers have engaged in undisclosed data sharing, nor whether any company has demonstrated an effective consent process for such sharing.
Comments (0)