Yes, you can file a class action lawsuit against a telehealth company, and consumers have been doing so with increasing frequency. The legal grounds range from privacy violations and unauthorized data sharing to deceptive billing practices and data breaches. In 2025 and 2026 alone, companies like Cerebral, BetterHelp, Lemonaid Health, and Talkspace have all faced class action lawsuits or federal enforcement actions stemming from how they handled patient data and subscription billing. The FTC has ordered BetterHelp to pay $7.8 million for sharing private patient information with advertising platforms including Facebook, Pinterest, Criteo, and Snapchat, while Cerebral agreed to a $7.1 million settlement over mishandling the sensitive health data of approximately 3.2 million consumers.
What you cannot do is sue under HIPAA itself. That federal law does not provide a private right of action, meaning individuals cannot file a lawsuit directly under HIPAA for compensation. But several other federal and state laws do give consumers legal standing to pursue class action claims against telehealth providers. This article walks through the specific legal grounds available, recent cases and their outcomes, what qualifies a lawsuit for class action status, and the practical steps involved in filing or joining one.
Table of Contents
- What Legal Grounds Allow You to File a Class Action Against a Telehealth Company?
- Why HIPAA Alone Won’t Support Your Telehealth Lawsuit
- Recent Telehealth Class Action Settlements and What They Paid
- How to Join or Start a Telehealth Class Action
- The FTC’s Growing Enforcement Against Telehealth Companies
- Tracking Pixel Lawsuits Are Reshaping Telehealth Privacy
- What Comes Next for Telehealth Class Actions
- Frequently Asked Questions
What Legal Grounds Allow You to File a Class Action Against a Telehealth Company?
The most common basis for telehealth class actions right now is unauthorized data sharing through tracking pixels. Dozens of telehealth platforms embedded Facebook, TikTok, and other advertising trackers on their websites and apps, which quietly transmitted sensitive health information to third parties without patient consent. The Electronic Communications Privacy Act provides a federal cause of action when healthcare organizations improperly access or share electronic communications without authorization. At the state level, laws like California’s Trap and Trace Law offer additional private rights of action. Talkspace, for example, is currently facing a class action for allegedly violating that specific California statute by using web trackers to share visitor data with TikTok without consent. Beyond privacy violations, deceptive billing and cancellation practices represent another fertile ground for class action claims.
The FTC approved a final order on December 3, 2025, against telehealth provider NextMed for deceptive advertising, billing, and cancellation practices tied to its GLP-1 weight-loss drug programs. Patients were paying monthly subscription costs ranging from $138 to $188, only to discover those fees did not actually include the GLP-1 medications. Data breaches form a third major category. OpenLoop Health was sued in the U.S. District Court for the Southern District of Iowa after a January 2026 security incident allegedly exposed patient data, putting class members at increased risk of medical identity theft. The California Consumer Privacy Act is particularly powerful for consumers in that state, allowing statutory damages of $100 to $750 per consumer, per incident, or actual damages if they exceed that range. When a telehealth company serves millions of users, those per-incident damages can add up to staggering potential liability, which is precisely what motivates settlements.
Why HIPAA Alone Won’t Support Your Telehealth Lawsuit
One of the most persistent misconceptions is that patients can sue a telehealth company for a HIPAA violation. They cannot. The U.S. Department of Health and Human Services has confirmed that HIPAA does not provide a private right of action. Enforcement authority rests with the HHS Office for Civil Rights and, in some cases, state attorneys general. If a telehealth company mishandles your protected health information, HIPAA violations can result in federal penalties against the company, but those penalties go to the government, not to you. However, this does not mean you are without recourse.
Attorneys bringing telehealth class actions routinely build cases on state consumer protection statutes, the Electronic Communications Privacy Act, state wiretapping laws, breach of contract, negligence, and unjust enrichment. The Cerebral pixel tracking class action, which received preliminary court approval with a final fairness hearing scheduled for March 9, 2026, was not filed under HIPAA. It was built on claims that Cerebral violated state and federal privacy laws by allowing tracking pixels to share sensitive mental health data with advertising companies. If an attorney tells you that you have no case because HIPAA does not allow private lawsuits, find a different attorney. The legal toolkit extends well beyond HIPAA. It is also worth noting that a HIPAA violation can serve as evidence of negligence or a breach of the standard of care in a lawsuit filed under other legal theories. So while HIPAA itself is not the vehicle for your claim, the fact that a company violated HIPAA standards can strengthen a case brought under state law.
Recent Telehealth Class Action Settlements and What They Paid
The dollar amounts in recent telehealth settlements vary dramatically depending on the scope of the violation and the number of affected consumers. At the higher end, BetterHelp’s $7.8 million FTC order addressed the company’s practice of sharing therapy patients’ private information with advertising platforms. Cerebral’s $7.1 million FTC settlement, which included $5.1 million in direct consumer refunds and a $2 million civil penalty, covered approximately 3.2 million consumers whose sensitive health data was mishandled. That works out to roughly $1.59 per affected consumer in direct refunds, which is a reality check on what individual payouts often look like in large class actions. Lemonaid Health agreed to a $3.25 million settlement over allegations that tracking pixels on LemonaidHealth.com shared sensitive health information with third parties.
The claim deadline for that settlement is February 23, 2026. On a smaller scale, the FTC’s final order against NextMed required $150,000 in payments for consumer refunds, reflecting the narrower scope of that case. The Mochi Health class action, filed on February 11, 2026, in the Northern District of California, takes a different angle entirely, alleging the telehealth weight-management company misclassified healthcare providers as independent contractors. That case covers a California class spanning four years and a nationwide collective. These cases reveal a pattern: the largest settlements tend to involve data privacy violations affecting millions of users, while billing and cancellation cases produce smaller but still meaningful recoveries. Worker misclassification cases benefit healthcare providers rather than patients, but they can indirectly improve patient care by addressing staffing and quality concerns.
How to Join or Start a Telehealth Class Action
If a class action has already been filed against a telehealth company you used, joining it is typically straightforward. You will receive notice by email or mail if you are an identified class member, and most settlements require only that you submit a claim form by the deadline. For the Lemonaid Health settlement, for example, eligible class members need to file before the February 23, 2026 deadline to receive compensation. For the Cerebral pixel tracking settlement, the final fairness hearing is set for March 9, 2026, and class members should watch for updates on the settlement website regarding claim submissions. Starting a new class action is a fundamentally different undertaking.
You need to retain an attorney, typically one specializing in consumer privacy or healthcare litigation, who will file a complaint in the appropriate federal or state court. The class must meet four requirements under Federal Rule of Civil Procedure 23: numerosity, meaning there are enough affected people that individual lawsuits would be impractical; commonality, meaning the claims share common questions of law or fact; typicality, meaning your claims are typical of the class; and adequacy of representation, meaning you and your attorney will fairly represent the class. The tradeoff between joining an existing class action versus filing individually is significant. Class actions spread legal costs across all members and can compel large companies to settle, but individual payouts are often modest. Individual lawsuits or small claims court filings can yield higher per-person recoveries but require you to bear the litigation costs and effort alone.
The FTC’s Growing Enforcement Against Telehealth Companies
The Federal Trade Commission has significantly increased enforcement against telehealth companies in 2025 and 2026, creating a regulatory environment that both helps and complicates consumer class action efforts. The FTC has particularly targeted deceptive GLP-1 weight-loss marketing, pixel tracking and data sharing, and dark-pattern cancellation practices. This enforcement wave means more telehealth companies are being investigated and sanctioned, which generates public findings that class action attorneys can use in private lawsuits. However, there is a limitation consumers should understand. When the FTC reaches a settlement or consent order with a telehealth company, that resolution sometimes includes provisions for consumer refunds administered through the FTC itself, which can reduce or complicate parallel class action claims.
The Cerebral case illustrates this overlap. The FTC secured $5.1 million in consumer refunds, but a separate class action over pixel tracking is also proceeding through the courts. Whether consumers can recover from both the FTC process and a private class action depends on the specific terms of each settlement and court rulings on duplicative recovery. The practical warning here is that FTC enforcement is not a substitute for private litigation, but it is not entirely separate either. If you are considering a class action against a telehealth company that is also under FTC investigation, your attorney needs to account for the regulatory proceedings and how they might affect the private case.
Tracking Pixel Lawsuits Are Reshaping Telehealth Privacy
The wave of tracking pixel lawsuits has become the defining legal issue for telehealth companies. The core allegation in these cases is essentially the same across companies: a telehealth platform embedded advertising tracking pixels from Meta, TikTok, Google, or similar companies on pages where patients entered sensitive health information. Those pixels transmitted data, sometimes including the specific health conditions patients were seeking treatment for, to advertising platforms without patient knowledge or consent.
Cerebral, BetterHelp, Lemonaid Health, and Talkspace have all faced legal action over this practice. What makes these cases particularly potent is that they often involve mental health, substance abuse, or weight-loss treatment data, categories of health information that carry significant stigma and that patients reasonably expect to remain private. Courts and regulators have shown little patience for the argument that tracking pixels are standard web technology. When they are deployed on healthcare platforms handling protected health information, the legal exposure is substantial, and more of these cases are likely to emerge as plaintiffs’ attorneys continue auditing telehealth websites for embedded trackers.
What Comes Next for Telehealth Class Actions
The trajectory of telehealth litigation points toward continued growth on multiple fronts. The FTC’s increased enforcement posture shows no sign of easing, particularly around weight-loss telehealth programs and data privacy. As more states pass comprehensive privacy laws modeled on or expanding beyond the California Consumer Privacy Act, the legal tools available to consumers will multiply.
The Mochi Health worker misclassification case filed in February 2026 signals that the litigation is also expanding beyond patient claims to address how telehealth companies treat their own healthcare providers. For consumers, the practical takeaway is that the legal landscape is increasingly favorable for challenging telehealth companies that cut corners on privacy, billing transparency, or data security. If you used a telehealth service that experienced a data breach, employed tracking pixels, or made it unreasonably difficult to cancel a subscription, there may already be a class action you can join. If there is not one yet, the legal framework to pursue one exists and is being actively used.
Frequently Asked Questions
Can I sue a telehealth company for a HIPAA violation?
No. HIPAA does not provide a private right of action, meaning you cannot file a lawsuit directly under HIPAA. However, you can sue under other federal and state laws, including the Electronic Communications Privacy Act, the California Consumer Privacy Act, and state wiretapping statutes. A company’s HIPAA violation can still serve as evidence in a case filed under these alternative legal theories.
How much money can I get from a telehealth class action settlement?
Individual payouts vary widely. In large class actions affecting millions of consumers, per-person payments can be small. The Cerebral FTC settlement provided $5.1 million in refunds across approximately 3.2 million consumers. Smaller class actions or those under the CCPA, which allows statutory damages of $100 to $750 per consumer per incident, can yield higher individual recoveries.
What is a tracking pixel lawsuit?
These lawsuits allege that a telehealth company embedded advertising tracking code from companies like Meta or TikTok on its website, which transmitted sensitive patient health data to those advertising platforms without consent. Cerebral, BetterHelp, Lemonaid Health, and Talkspace have all faced tracking pixel litigation.
How do I know if there is already a class action against my telehealth provider?
Check consumer legal news sources and settlement databases such as openclassactions.org. If a class action exists and you are an identified class member, you should receive notice by email or mail. You can also search federal court records through PACER for active cases.
Is the FTC doing anything about telehealth company abuses?
Yes. The FTC has significantly increased enforcement against telehealth companies in 2025 and 2026, targeting deceptive GLP-1 weight-loss marketing, pixel tracking and data sharing, and dark-pattern cancellation practices. The FTC has taken action against Cerebral, BetterHelp, and NextMed, among others.
Can telehealth employees file class actions too?
Yes. The Mochi Health class action, filed February 11, 2026, alleges the company misclassified healthcare providers as independent contractors rather than employees. This type of worker misclassification case is distinct from patient-focused lawsuits but represents a growing area of telehealth litigation.
You Might Also Like
- Can You File a Class Action Against a Doctor for Overprescribing
- Can You Join a Class Action Against a Pharmacy for Wrong Medication
- Can You File a Class Action for Misdiagnosis by a Diagnostic Lab