Attorneys are investigating potential cases against LifeMD for alleged privacy violations in California. The question under review is narrow and unusual: not whether members’ records leaked, but whether the answers people typed into a LifeMD intake questionnaire were passed to third-party advertising networks before those people agreed to anything at all.
Status: Investigation — no complaint filed | California residents only | Questionnaires started on or before June 14, 2026 | Attorney advertising
What Is Being Investigated
LifeMD, Inc. — including its Rex MD and ShapiroMD brands — is under review over whether it shared prospective patients’ private health disclosures with third-party advertising networks without consent. The disclosures at issue are the ordinary contents of a telehealth intake: weight-loss goals, medical symptoms, treatment inquiries, and the topic a visitor selected in the first place.
The mechanism alleged is the one that has driven most of the health-privacy litigation of the last three years. A page carries advertising or analytics tags, a visitor answers questions on that page, and the argument is that what they answered travelled to the tag’s owner. What makes this review different from the usual version is when it is said to have happened.
The Timing Is the Allegation
On a telehealth site, a visitor typically clicks “Get Started” on a topic, works through a series of questions, and only at the end reaches a box asking them to agree to the Terms, the Privacy Policy, the Notice of Privacy Practices and a telehealth consent. Creating an account and paying come after that.
The investigation is aimed at everything that happens before that box. If a visitor answered questions about, say, weight loss or mental health and then closed the tab — never ticking the box, never creating an account, never buying — they never gave the consent that a privacy policy relies on. If their answers were transmitted anyway, no agreement covers it, because they never entered one.
That is why this reaches a group most privacy cases miss. Settlement classes are usually built from customer lists, because customers are who a company can identify. People who abandoned an intake form are not customers, are frequently not in any account database, and yet are the exact people whose disclosures were made with the least protection.
Who May Qualify
The criteria published on our sister site’s LifeMD data privacy investigation page are cumulative — all four have to be true:
- Location. You were in California when you visited LifeMD, on or before June 14, 2026.
- Engagement. You clicked “Get Started” on a LifeMD topic — weight loss, women’s health, men’s health, cardiovascular health, mental health, prescriptions and refills, or primary care — and answered at least one question.
- No consent, no account. You never checked the box agreeing to the Terms, Privacy Policy, Notice of Privacy Practices and telehealth consent, and you never created an account or made a purchase.
- Not already represented. You do not already have a lawyer acting for you on this claim.
The third criterion is the one people misread. Not having become a customer is not a disqualifier here — it is the qualifying fact.
Why California, Specifically
California is where this kind of claim has the most to work with. The California Invasion of Privacy Act — a 1960s wiretap statute written for telephone lines — has been applied by plaintiffs to website tracking on the theory that a third party embedded in a page is an uninvited listener to a communication between the visitor and the site. It carries statutory damages, which means a claim does not depend on proving a dollar of individual loss.
Layered on top are the CCPA as amended by the CPRA, which treats health information and precise inferences drawn from it as sensitive personal information and gives Californians rights over how it is shared; the state’s Confidentiality of Medical Information Act; and the general unfair-competition statute. None of those has been applied to LifeMD by any court — nothing has been filed — but they are why a review of this kind is drawn along a state line rather than nationwide.
The other reason to care about the state line is time. California privacy claims of this type can carry notably short limitation periods. That is what makes an investigation with no deadline and no claim form nonetheless time-sensitive: the statute runs whether or not a case has been filed.
This Is Not the Settlement That Just Paid Out
A different LifeMD privacy case has already been through court and closed, and the two are constantly confused.
In W.M.F. & Matthew Marden v. LifeMD, Inc., in Clark County, Nevada, users alleged that tracking technologies on LifeMD and RexMD websites disclosed identifiable health information to third parties including Meta, Google and TikTok. LifeMD denied wrongdoing. The parties settled with no admission of liability, claims closed on September 22, 2025, final approval came on September 30, 2025, and distributions of $10 in cash or a $25 voucher began on January 21, 2026. Our full account is in the LifeMD and RexMD privacy settlement payment report.
Three differences matter:
| Nevada settlement (closed) | California investigation (open) | |
| Who it covered | LifeMD/RexMD members and purchasers, nationwide | California visitors who started a questionnaire and never became members |
| Stage | Final approval granted; paid | No complaint filed; no class certified |
| What to do | Nothing — claims closed September 22, 2025 | A free, confidential case review |
Because the covered groups are different, missing the Nevada claim deadline does not by itself rule anyone out of the California review. Someone who never bought anything from LifeMD would likely have fallen outside the Nevada class entirely, while sitting squarely inside the group this review is aimed at.
What Nobody Has Established Yet
This is an investigation, and the word carries its ordinary meaning. No complaint has been filed against LifeMD on these allegations. No class has been certified. No court or regulator has found that anything was transmitted, and LifeMD has not been given the opportunity to answer a pleading that does not exist. There is no settlement, no fund, no claim form, and nothing to submit to an administrator.
What a case review does is a great deal smaller than that: it establishes whether a particular person’s facts fit the criteria, and puts those facts in front of the firm looking at the question.
What to Keep If You Think You Qualify
- Anything that dates the visit. A browser history entry, a bookmark, a retargeting ad you later saw for LifeMD, Rex MD or ShapiroMD, or an abandoned-cart or “finish your visit” email — ironically, the marketing follow-up is often the cleanest proof that an intake was started.
- Which topic you started. Weight loss, men’s health, women’s health, cardiovascular, mental health, prescriptions and refills, primary care.
- Where you were. California residency and physical presence in the state at the time of the visit are both threshold facts.
- Whether you ever agreed or registered. The absence of an account is the point — but be accurate about it, because a later account changes the analysis.
Do not try to reconstruct anything you are not sure about. An approximate date described as approximate is more useful to a reviewing attorney than a confident guess.
Where This Sits in the Health-Privacy Wave
Website-tracking claims against health organisations have become one of the busiest areas in consumer litigation, and the pattern rarely changes: a marketing tag sits on a page where a visitor discloses something medical, and the fight is over whether the disclosure travelled somewhere the visitor never authorised. We have covered the hospital version at Duke Health, the telehealth version in the Call-On-Doc pixel tracking settlement, and the platform-side question in our report on the Meta pixel tracking investigation.
The federal agencies have been moving on the same ground. On July 29, 2026 the FTC, joined by the State of Utah and Los Angeles County, sued Hims & Hers Health in the Northern District of California, alleging among other things that the company shared sensitive health information with advertising platforms including Meta and Snap while marketing itself as private. Hims & Hers denies wrongdoing and the case is unresolved. It does not involve LifeMD, but it is the clearest signal of where regulators think telehealth’s exposure sits — on data handling and billing, not on clinical judgement.
LifeMD is separately facing scrutiny of a completely different kind: former employees told STAT in July 2026 that clinicians were pushed to clear GLP-1 weight-loss cases at roughly two minutes each, which LifeMD strenuously denies. No patient class action exists over that. We covered it in our report on the LifeMD GLP-1 prescribing allegations.
Frequently Asked Questions
What is the LifeMD data privacy investigation about?
Attorneys are investigating whether LifeMD, Inc., including its Rex MD and ShapiroMD brands, shared prospective patients’ private health disclosures – weight-loss goals, symptoms, treatment inquiries – with third-party advertising networks without consent. The focus is on answers given in an intake questionnaire before the visitor accepted the terms or created an account.
Who may qualify for the LifeMD investigation?
California residents who were in California on or before June 14, 2026 when they visited LifeMD, who clicked “Get Started” on a topic such as weight loss, men’s health, women’s health, cardiovascular health, mental health, prescriptions and refills or primary care and answered at least one question, who never checked the box agreeing to the Terms, Privacy Policy, Notice of Privacy Practices and telehealth consent, never created an account and never made a purchase, and who are not already represented by a lawyer on the claim.
Is this the same as the LifeMD settlement that paid $10?
No. That was a separate Nevada case, W.M.F. and Matthew Marden v. LifeMD, Inc., which covered LifeMD and RexMD members and purchasers. Claims closed September 22, 2025, final approval came September 30, 2025, and $10 cash or $25 voucher distributions began January 21, 2026. The California investigation targets prospective patients who never became members, so missing that claim deadline does not by itself disqualify anyone.
Do I need to have bought something from LifeMD?
No – the opposite. The review is aimed at people who started a questionnaire but never accepted the terms, never created an account and never made a purchase. Having become a customer would put a person outside these criteria.
Is there a deadline or a claim form?
There is no claim form and no court deadline, because no complaint has been filed and no class has been certified. Statutes of limitations still run independently of any case, though, and California privacy claims of this kind can carry short deadlines, which is why the review is treated as time-sensitive.
Has LifeMD been found to have done anything wrong?
No. No complaint has been filed on these allegations, no class has been certified, and no court or regulator has made any finding. Nothing has been proven.
Sources
- OpenClassActions.com, LifeMD Data Privacy Investigation — the published criteria, the free case review, and the responsible-attorney disclosure.
- Order Granting Final Approval, W.M.F. & Matthew Marden v. LifeMD, Inc., No. A-24-906800-C, Eighth Judicial District Court, Clark County, Nevada, entered September 30, 2025 — the separate, closed matter.
- California Invasion of Privacy Act, Cal. Penal Code §§ 630 et seq.; California Consumer Privacy Act as amended by the CPRA; Confidentiality of Medical Information Act.
- Federal Trade Commission, State of Utah and Los Angeles County v. Hims & Hers Health, N.D. Cal., filed July 29, 2026.
- OpenClassActions.com, LifeMD & RexMD Privacy Settlement Closed: Payment Status and Did LifeMD Rush GLP-1 Prescriptions? What Ex-Workers Say.
By Felix Levine | Published: September 10, 2026
Legal Disclaimer & Attorney Advertising Notice
This article is for informational purposes only and is not legal advice. OpenClassActions.org is a consumer news site, not a law firm and not a lawyer referral service, and is not affiliated with LifeMD, Inc., Rex MD or ShapiroMD. Reading this article or submitting a case review on the linked page does not create an attorney-client relationship, does not file a lawsuit, and does not pause any legal deadline. No complaint has been filed against LifeMD on these allegations, no class has been certified, and nothing described here has been proven. You are free to choose any attorney you wish, and prior results do not guarantee a similar outcome. The responsible attorney and office-location disclosure for the investigation appears on the investigation page.