FTC Suits Put Ticket Brokers and Telehealth Privacy in the Crosshairs

The agency moved against two very different businesses in late July: one accused of gaming online ticket limits for profit, the other accused of hiding charges, blocking cancellations, and sharing sensitive health data with ad platforms.

FTC targets ticket broker accused of dodging purchase limits

The Federal Trade Commission on July 27 said Elite Events and its operators will pay $300,000 in civil penalties to resolve allegations that the ticket broker used unlawful tactics to buy tickets in bulk for more than 2,400 high-demand events, then flipped them at a profit.

According to the FTC complaint, Elite Events and Tickets LLC, which also does business as Smart Scalpers or smartscalpers.com, and owners Kevin W. McKerley and Aaron L. Fera violated the Better Online Ticket Sales Act. That law bars people from circumventing security measures, access controls, or other technical controls used by ticket issuers to enforce posted ticket limits or online ordering rules.

The agency said the company used hundreds of agents, including many based abroad, along with multiple purchasing accounts, virtual credit cards, IP proxy services and multi-session browsers to get around limits set by issuers such as Ticketmaster and AXS.

For technology and compliance teams, the core point is straightforward: if a site has a technical control to enforce a posted ticket cap, deliberately working around that control can trigger federal liability under the BOTS Act. The FTC said the complaint alleged Elite Events used unlawful tactics across more than 2,400 events.

How the FTC says the scheme worked

One example in the complaint involved a Metallica concert at Virginia Tech University. The FTC said Elite Events used 75 accounts to buy 277 tickets between September 2024 and March 2025, even though the seller limited purchases to six tickets per buyer.

The complaint says the company paid between $50 and $270 per ticket and then resold them for $100 to $400 per ticket on the secondary market. The FTC said that model made profit by taking tickets out of reach for ordinary fans and reselling them at a markup.

The agency also said the company used fictitious names, addresses and phone numbers, including some tied to employees; numerous virtual credit card accounts to generate thousands of unique card numbers; proxy services to mask location and identity; and multi-session browsers to open multiple independent browsing sessions in one internet application.

FTC Bureau of Consumer Protection Director Christopher Mufarrige said consumers should be able to buy tickets without “bad actors” driving up prices and reducing access for fans.

The proposed order imposes more than $10.7 million in civil penalties against Elite Events, Fera and McKerley, but that amount will be partially suspended after payment of $300,000 because the defendants said they cannot pay the full amount. The full amount becomes immediately due if they are found to have lied about their finances.

The order also permanently bars them from circumventing ticket limits, using multiple accounts or multiple IP addresses or multi-session browsers to evade restrictions, and from buying tickets with payment accounts not in the names of Fera or McKerley.

The FTC and the defendants filed a stipulated final order in the U.S. District Court for the Southern District of Georgia, Augusta Division. The Commission voted 2-0 to authorize the case.

Hims & Hers faces broader consumer and privacy claims

Two days later, on July 29, the FTC, joined by Utah and California through Los Angeles County Counsel, sued telehealth provider Hims & Hers in federal court over claims that it misled consumers about billing, made cancellations difficult, and shared sensitive health information with third-party advertising platforms.

The complaint says Hims tells consumers they can consult with a medical provider to find a treatment “right for them,” but then charges many users almost immediately after they submit an intake form. The FTC says most consumers do not get the consultation they expect and are instead enrolled in recurring subscription plans shortly after submitting the form.

That matters because the case is not just about privacy. It is also about timing, consent and subscription design. The FTC alleges Hims failed to clearly disclose that it charges consumers for prescriptions almost immediately, and failed to clearly and conspicuously disclose when prescriptions would be refilled each month, making cancellations harder before the next billing cycle.

The agency also said Hims made cancellation unnecessarily difficult. Before 2023, most consumers could cancel only by contacting customer service by phone, email or chat, along with additional hurdles. Even after adding online cancellation for most users in 2023, the FTC alleges the company hid the cancellation button behind several steps, including an option to “add/remove items from order,” before consumers could even see the word “cancel.”

Privacy allegations center on ad-tech sharing

The most sensitive allegations involve health data. The FTC says Hims shared consumers’ sensitive health information with Meta, Snap and other third parties, despite claims that it protected patient privacy.

According to the complaint, Hims shared lists of certain customers with advertising platforms and also used third-party tracking technologies that automatically shared certain “Events,” meaning actions taken by visitors on Hims’ website, with those companies.

For compliance teams, that is a reminder that online tracking in health-related flows can carry serious legal risk when the data is sensitive and the company has promised privacy. The FTC’s complaint says those practices violated the FTC Act and the Restore Online Shoppers’ Confidence Act, which covers deceptive billing and subscription practices. Utah alleges violations of its Consumer Sales Practices Act, and California alleges violations of its False Advertising and Unfair Competition Laws.

The Commission voted 2-0 to authorize filing the complaint in the U.S. District Court for the Northern District of California.

What technology and compliance leaders should watch

These cases show the FTC is using familiar tools in two different markets: consumer protection, platform controls and privacy promises.

For ticketing businesses and marketplaces, the Elite Events case underscores that controls intended to enforce limits cannot be treated as optional friction. If a company builds workflows around proxies, multiple accounts or payment instruments to bypass issuer restrictions, the FTC may treat that as unlawful circumvention rather than ordinary resale activity.

For telehealth and subscription businesses, the Hims case highlights three pressure points: whether consumers clearly understand when they will be charged, whether cancellation is genuinely simple, and whether sensitive data is being shared in ways that match privacy promises.

The immediate deadlines are court-driven. In both matters, the FTC has already filed complaints, which means the claims now move into federal litigation or settlement enforcement. In the ticketing case, the stipulated final order would become binding if approved and signed by the court. In the Hims case, the defendants will have to answer the allegations in federal court unless the matter is resolved.

For executives, the practical lesson is direct: review automated purchasing systems, subscription flows, cancellation paths and ad-tech integrations now. The FTC’s latest actions show it is willing to test both the money trail and the data trail.