What ROSCA Has to Do With Health Data: The Second Half of the Hims and Hers Complaint

Most of the coverage of the FTC's July 2026 complaint against Hims & Hers Health, Inc. has focused on the tracking allegations. The complaint has a second half. Alongside the privacy counts, the FTC pleads a violation of Section 4 of the Restore Online Shoppers' Confidence Act, 15 U.S.C. 8403, the federal statute that governs how companies may bill consumers on a recurring basis after an online sign-up. In the government's framing these are not two unrelated grievances. They are one pattern: a consumer who was told the experience was private and simple, and who allegedly got neither.

Curve is a HIPAA-compliant conversion tracking platform that lets healthcare and subscription health brands measure paid campaigns without sending protected health information to ad platforms, which keeps the marketing data layer out of a complaint like this one.

If you market a subscription health product, ROSCA is probably the most consequential federal statute you have never read. It is short, it is specific, and it applies to your checkout flow regardless of whether you consider yourself a healthcare company. This article explains what it requires, why it appears beside privacy claims in this complaint, and what a marketing team should actually check.

Everything described from the complaint is an allegation. Hims has denied the allegations, has said its privacy policy makes clear that users may choose how their data is used, and has said it intends to defend the case.

The Short Version

• ROSCA governs negative option billing online: any arrangement where a consumer's silence or inaction is treated as agreement to be charged again.
• Section 4 imposes three obligations before you may charge: clear and conspicuous disclosure of all material terms, express informed consent, and a simple mechanism to stop recurring charges.
• The Hims complaint pleads ROSCA alongside FTC Act Section 5(a), California's UCL and FAL, and Utah's Consumer Sales Practices Act, in Case No. 3:26-cv-7871 in the Northern District of California.
• The billing allegations involve charging for prescription subscriptions before meaningful consent, unclear refill dates, and cancellation mechanisms the complaint alleges were difficult.
• ROSCA matters procedurally, not just substantively: its enforcement provision treats a violation as a violation of an FTC trade regulation rule, which is a route to civil penalties.
• Privacy and billing sit in one complaint because both counts run through the same conduct: what the consumer was told at sign-up versus what happened next.

What a Negative Option Actually Is

The term sounds like jargon, and the definition is simpler than it sounds. A negative option is any offer structure where the seller treats the consumer's failure to act as permission to charge. Subscriptions are the obvious form. So are free trials that convert to paid, auto-renewing plans, continuity programs that ship a new supply each month, and prenegotiated plans where the consumer must affirmatively cancel to stop the next charge.

In consumer health this structure is close to universal. Refill programs, telehealth memberships, compounded medication subscriptions, supplement continuity plans, and virtual care retainers all rely on it. The economics of direct-to-consumer health depend on the recurring charge, which is exactly why the disclosure obligations attached to it matter so much.

Why Congress singled it out

ROSCA was passed to address a specific pattern from the earlier era of online commerce: consumers who could not tell they had signed up for something, could not tell what they had agreed to pay, and could not find the exit. The statute does not prohibit negative option billing. It conditions it. That distinction matters. You may absolutely run a subscription health business. You must run it with disclosure, consent, and an exit that works.

The Three Requirements of ROSCA Section 4

Section 4 sets out three conditions, and all three must be satisfied. Failing one is enough.

1. Clear and conspicuous disclosure of all material terms

Before you take billing information, the consumer must be shown the material terms of the transaction in a way that is clear and conspicuous. Material terms in a subscription context normally include the amount to be charged, the frequency, when the first charge occurs, when subsequent charges occur, the length of any trial period, and what happens at the end of it.

The two words doing the work are "clear and conspicuous". Placement, contrast, proximity to the consent action, and whether the disclosure appears before or after billing information is collected all affect the analysis. A material term buried in a linked terms document, below a fold, or in text that competes with a large call-to-action button is where these cases tend to be won and lost.

2. Express informed consent before charging

The consumer must affirmatively agree to the specific charge structure. Express informed consent is not the same as a completed checkout. It is not a pre-checked box. It is not consent inferred from the fact that a person clicked a button labeled with something other than what they were agreeing to. If the button says one thing and the recurring charge is another, the consent question is open.

In the health context there is an additional wrinkle. The complaint's billing allegations concern charging for prescription subscriptions before meaningful consent. Prescription products introduce a sequence problem: the consumer often completes an intake, waits for a clinical decision, and then receives a product. If the charge occurs at a different point in that sequence than the consumer expected, the consent question becomes concrete rather than theoretical.

3. A simple mechanism to stop recurring charges

The statute requires a simple cancellation mechanism. In practice, regulators read simplicity in comparison to sign-up. If a consumer can subscribe in ninety seconds inside a web flow but must call during business hours, chat with a retention agent, or complete a multi-screen sequence to cancel, that asymmetry is the allegation. The Hims complaint alleges cancellation mechanisms that were difficult, and it alleges refill dates that were unclear, which compounds the problem: a consumer who cannot tell when the next charge is coming cannot cancel in time even if the mechanism works.

How Curve Fits Into a Subscription Health Stack

Curve is a conversion tracking layer, not a billing system, and it is worth being precise about the boundary. Curve does not fix your checkout disclosures or your cancellation flow, and no tracking vendor can. What Curve does is make sure that the marketing measurement wrapped around that funnel does not become its own exposure. Subscription and purchase events are captured first-party and sanitized on Curve's servers before anything is transmitted, so an ad platform receives that a conversion occurred without receiving the condition, the product, the intake responses, or the identifiers that would reveal them. Destinations are configured per platform, so the event shaped for a search network is not the same payload as the one shaped for a social network. Curve signs a Business Associate Agreement covering that tracking layer. The result is that when a regulator asks what left your site and where it went, the answer is documented and narrow.

Why Privacy and Billing Appear in One Complaint

The instinct is to read the ROSCA count as an add-on. That underestimates it. The two halves of the complaint share a structure.

Paragraph 66 quotes published promises about privacy, including "100% online, private, and secure", treating conditions "privately", "totally private" and "discreet", and notes those promises also ran in television, radio and podcast advertising. The privacy counts allege the reality of the data flows did not match those promises. The billing counts allege the reality of the charges did not match what consumers understood they were agreeing to. Both are gap claims. Both compare a representation made during acquisition against what the company did afterward.

That is why the FTC treats them as one pattern of conduct rather than two files. For an enforcement narrative, a company that made one kind of acquisition-time promise it did not keep is more plausibly a company that made another. Each count strengthens the story around the other.

The procedural reason ROSCA carries weight

There is also a mechanical reason ROSCA appears. The statute's enforcement provision directs that a violation be treated as a violation of a trade regulation rule under the FTC Act. That characterization is what opens the door to civil penalties, which the complaint requests alongside a permanent injunction and a monetary judgment. A privacy theory built purely on Section 5(a) does not carry the same penalty mechanism on its own. Adding a ROSCA count changes the remedial arithmetic of the case, independent of how strong the billing facts turn out to be.

What a Marketing Team Should Actually Check

Most of the ROSCA surface area sits in places the marketing team controls, not the legal team.

• The paid landing page, not just the checkout. If your ad promises a price and the recurring structure only appears two steps later, the disclosure sequence starts on the ad, not on the payment screen.
• Trial-to-paid transitions. Every free or discounted first period needs the conversion date, the post-trial price, and the cancellation path stated before billing information is collected.
• Button copy. The label on the consent action should describe what is being agreed to. "Start my plan" and "Get started" carry different amounts of information than a label that names the recurring charge.
• Refill visibility. If the product ships on a clinical cadence, the consumer should be able to see the next charge date without contacting anyone.
• The cancel path, timed. Count the clicks and minutes to cancel and compare them to the clicks and minutes to subscribe. If the ratio is embarrassing to say out loud, it is the finding.
• Intake forms. Health intake sits between the ad and the charge, and it is simultaneously the highest-risk surface for both counts. Our writeup on tracking leak points in telehealth intake forms covers the privacy half of that surface in detail.

ROSCA in the Broader Health Enforcement Picture

Subscription health has been on the FTC's radar for years, and the privacy actions and the billing actions have been converging for most of that time. Earlier telehealth advertising matters traced the same line, and the mid-2026 roundup of healthcare pixel settlements shows how much of the docket now sits at the intersection of acquisition marketing and consumer protection law.

The convergence is sharpest in categories where clinical eligibility and subscription economics collide. Weight management is the clearest example, and our guide to GLP-1 telehealth marketing compliance covers a funnel that is almost always a subscription, almost always condition-specific, and almost always heavily paid. A company operating there has both halves of this complaint present in a single flow.

One more overlap deserves attention. Consent is a word that does different work in each half. ROSCA consent is consent to be charged. Privacy consent is consent to data use. They are collected at different moments, they cover different things, and a single checkbox that claims to do both satisfies neither well. Our comparison of consent management versus HIPAA authorization explains why the distinction matters, and if you capture leads inside ad platforms, the PHI-safe configuration of lead ad forms is where the two consent questions most often get collapsed by accident.

Frequently Asked Questions

Does ROSCA apply to my company if we are a healthcare provider, not a retailer?

ROSCA applies to the sale of goods or services online through a negative option feature. Nothing in it exempts health products or clinical services. If a patient signs up online and is charged on a recurring basis unless they cancel, the statute is in scope regardless of how the organization describes itself.

Is a checkbox enough for express informed consent?

It depends on what is next to the checkbox and what happened before it. Express informed consent requires that the material terms were clearly and conspicuously disclosed first, so a checkbox attached to an unclear or incomplete disclosure does not cure the underlying problem. A pre-checked box is worse, because it removes the affirmative act entirely.

Why would the FTC pair a billing claim with a privacy claim in the same case?

Because both allege the same shape of conduct: a promise made to acquire a customer that the complaint says was not honored afterward. The FTC treats them as one pattern. There is also a remedial reason. ROSCA's enforcement provision routes a violation through the trade regulation rule framework, which supports the civil penalty relief the complaint requests.

Does using a compliant tracking setup protect us from ROSCA exposure?

No, and any vendor claiming otherwise is overselling. Tracking tools address what data leaves your site. ROSCA addresses what you told the consumer before you charged them and how easily they can stop. Both need attention, and they are handled by different teams with different fixes.

What is the fastest way to reduce ROSCA risk in a paid funnel?

Put the full recurring terms adjacent to the consent action, before billing information is collected, and make cancellation available in the same channel where sign-up happened. Those two changes address the disclosure requirement and the simple mechanism requirement directly, which covers two of the three statutory conditions.

Are the Hims allegations proven?

No. The complaint was filed in July 2026 and the case is being litigated. Hims has denied the allegations, has said its privacy policy makes clear that users may choose how their data is used, and has said it intends to defend the case. Every characterization in this article is of what the complaint alleges.

This article reflects the public record as of July 2026 and describes the redacted complaint as filed, available at ftc.gov. It is not legal advice, and ROSCA questions about a specific funnel belong with counsel.

The billing half of your funnel needs a lawyer. The measurement half needs an architecture that never sends protected health information to an ad platform in the first place. Curve provides that layer with server-side sanitization before egress, per-destination configuration, and a signed BAA. See how it works, and pair it with a compliant tracking setup across Google, Meta and Microsoft, at curvecompliance.com.