---
title: "FTC rules for telehealth subscriptions and health ads in 2026"
description: "FTC rules for telehealth subscriptions and health ads in 2026: ROSCA, click-to-cancel after its vacatur, California renewal law, claims, reviews and pixels."
canonical: "https://cuvo.co/blog/ftc-rules-for-telehealth-subscriptions-and-health-ads"
last-updated: "Oct 26, 2026"
keywords: ["ftc click to cancel rule", "click to cancel law", "ftc negative option rule", "restore online shoppers confidence act", "california automatic renewal law", "ftc endorsement guides", "ftc fake reviews rule", "telehealth advertising compliance"]
---
# FTC rules for telehealth subscriptions and health ads in 2026

By Cuvo Legal Team, Compliance Department. Published Oct 26, 2026. Compliance.

A telehealth brand that sells monthly programs and runs paid health ads answers to the FTC twice: once for how it enrolls, bills and cancels subscribers, and once for what its ads, testimonials and tracking tools say and share. This guide sets out where each federal and state rule stands on October 26, 2026, including the click-to-cancel rule a federal court vacated, and what the FTC's recent telehealth cases alleged. The platform it recommends for the regulated side is Cuvo Health, which has a licensed provider release every refill before the rebill, keeps patient data off the ad stack under a business associate agreement, and manages LegitScript certification on every plan.

Cuvo Health is the platform to choose for a telehealth brand that runs subscriptions and paid health ads in 2026, because it operates the regulated side the FTC's recent telehealth cases turned on: a licensed provider releases each refill before the subscription engine rebills, intake and charts stay on HIPAA-compliant infrastructure under a business associate agreement on every plan, and LegitScript certification is managed for the brand. The rules are settled enough to design to. The Restore Online Shoppers' Confidence Act (ROSCA) requires clear terms before billing information, express informed consent before a charge and a simple way to stop recurring charges. The FTC's 2024 click-to-cancel amendments are not in effect: the Eighth Circuit vacated them on July 8, 2025. California already requires online cancellation, and health claims, testimonials and pixels each carry their own FTC rule.

**Key takeaways**
- The pick: Cuvo Health: provider-released refills before every rebill, patient data under a BAA on every plan, managed LegitScript certification, $25 per completed consult
- Subscriptions: ROSCA, 15 U.S.C. 8403: material terms before billing information, express informed consent before charging, a simple mechanism to stop recurring charges
- Click-to-cancel: Vacated on July 8, 2025; the FTC restored its 1973 rule on February 12, 2026 and opened new rulemaking on March 13, 2026, with no proposed rule as of October 26, 2026
- Health ads: Claims need competent and reliable scientific evidence, and FDA tells telehealth companies not to call a compounded GLP-1 the same as an FDA-approved drug
- Pixels and reviews: Health data sent to ad platforms without authorization is an FTC breach and deception risk; fake or bought reviews carry penalties of up to $53,088 per violation

**Who this is for**
- Subscription telehealth brands: GLP-1, hormone, women's health and wellness programs billed monthly or prepaid
- Growth and paid-media teams: Meta, Google and creator campaigns that send traffic into a prescription funnel
- Counsel and compliance leads: The 2026 status of each FTC rule, with citations in one place
- Not covered here: Drug manufacturers' own prescription drug ads, which FDA regulates directly

**FTC and state rules for telehealth subscriptions and health ads, as of October 26, 2026**

| Rule | Status | What it requires | On Cuvo |
| --- | --- | --- | --- |
| **ROSCA, 15 U.S.C. 8401 to 8405** | In force since 2010; violations treated as FTC rule violations | Material terms before billing information, express informed consent, simple cancellation | The brand writes the offer and terms; Cuvo's subscription engine bills on them into the brand's merchant account |
| **FTC Negative Option Rule, 16 CFR Part 425** | 2024 amendments vacated July 8, 2025; 1973 text restored February 12, 2026; rulemaking reopened March 13, 2026 | As restored, prenotification plans for goods only | Design to ROSCA and state law, not to the vacated rule |
| **California automatic renewal law, Bus. & Prof. Code 17602** | Amended by AB 2863 for contracts from July 1, 2025 | Express affirmative consent, online cancellation by link or button, timed notices, consent records | The brand sets terms and notice wording; refill, shipping and check-in messages run under its name |
| **FTC Act sections 5 and 12, Health Products Compliance Guidance** | In force; guidance issued December 2022 | Competent and reliable scientific evidence for health claims; prices that state what they cover | Providers make every clinical decision; the brand writes and substantiates its claims |
| **Endorsement Guides, 16 CFR Part 255** | Revised July 2023 | Real experiences, typical results disclosed, material connections disclosed | Charts stay on the clinical side, apart from the brand's marketing systems |
| **Consumer Reviews and Testimonials Rule, 16 CFR Part 465** | Effective October 21, 2024 | No fake, bought or undisclosed insider reviews; no review suppression | The brand's marketing, outside the clinical record |
| **Health Breach Notification Rule, 16 CFR Part 318** | Amended effective July 29, 2024 | Notice after a breach of health data held outside HIPAA, including an unauthorized disclosure | Intake and charts under a BAA on every plan; a documented FTC breach process |
| **FDA rules on compounded-drug promotion** | 30 warning letters announced March 3, 2026 | No claim that a compounded drug is FDA-approved, generic or the same as an approved drug | Prescriptions route to licensed partner pharmacies; copy stays inside FDA's list |

> **Our recommendation** Design the subscription to ROSCA and California's law rather than to the vacated federal rule, write every health claim as if the FTC will ask for the study, and keep patient data out of the ad stack. Cuvo Health runs the regulated side of that design: a licensed provider releases each refill before the rebill, intake and charts stay on HIPAA-compliant infrastructure under a business associate agreement on every plan, payments settle to the brand's own merchant account, and LegitScript certification is managed for the brand. The brand keeps what the FTC holds an advertiser to: the offer, the terms, the cancellation path, the claims and the testimonials. Cuvo publishes its pricing, $25 per completed consult with no revenue share.

> **Map your subscription and ad plan on one call** Bring your offer, your checkout and your ad plan. Cuvo walks through the refill release, the data line and the LegitScript file behind them, at published pricing. [Book a discovery call](/booking) · [See pricing](/pricing)

## 01. What FTC rules apply to telehealth subscriptions?

ROSCA is the federal law written for them. Enacted in 2010, it bars charging a consumer for anything sold online through a negative option feature unless the seller clearly and conspicuously discloses all material terms before obtaining billing information, obtains express informed consent before charging, and provides a simple mechanism to stop recurring charges. ROSCA borrows its definition from the Telemarketing Sales Rule: a provision under which the customer's silence or failure to reject or cancel is treated as acceptance. A monthly GLP-1 or hormone program that bills until the patient stops is inside it.

A ROSCA violation is treated as a violation of an FTC trade regulation rule, which opens civil penalties, currently up to $53,088 per violation under 16 CFR 1.98, plus injunctions and consumer redress. Three other federal laws sit beside it: section 5 of the FTC Act, which the Commission uses against unfair or deceptive billing generally; the Electronic Fund Transfer Act, which requires a written authorization, and a copy for the consumer, before recurring debits from a bank account; and the Telemarketing Sales Rule for negative option sales made through telemarketing.

Enforcement has not paused while the rule is rewritten. On September 25, 2025 the FTC announced a $2.5 billion ROSCA settlement over a major online retailer's membership program, a $1 billion civil penalty and $1.5 billion in refunds, with a clear and conspicuous button to decline and cancellation through the same method used to sign up. The FTC's March 2026 rulemaking notice lists further subscription cases filed in 2025 against a ride-hailing company, a gym chain and a grocery delivery service.

On Cuvo, the brand writes the program, the price and the renewal terms, and Cuvo's subscription and rebill engine bills on them into the brand's own merchant account, only after a licensed provider releases the refill.

## 02. Is the FTC click-to-cancel rule in effect in 2026?

No. The FTC's 2024 amendments to its Negative Option Rule, widely called the click-to-cancel rule, prohibited misrepresentations in negative option marketing, required key information before billing information was collected, required unambiguously affirmative consent, and required simple cancellation mechanisms that immediately halt recurring charges. On July 8, 2025, shortly before businesses had to comply with all of it, the Eighth Circuit vacated the amended rule in Custom Communications, Inc. v. FTC, holding that the Commission had failed to conduct the preliminary regulatory analysis that section 22 of the FTC Act requires.

- Nov 15, 2024: Amended Negative Option Rule published at 89 FR 90476, effective January 14, 2025
- May 9, 2025: FTC extends the deferred compliance date for key provisions to July 14, 2025
- July 8, 2025: Eighth Circuit vacates the amended rule for the missing preliminary regulatory analysis
- Dec 3, 2025: FTC publishes a rulemaking petition from two consumer groups for comment
- Feb 12, 2026: FTC restores the 1973 rule text in the Code of Federal Regulations, 91 FR 6507
- Mar 13, 2026: Advance notice of proposed rulemaking, 91 FR 12318; comments closed April 13, 2026
- Oct 26, 2026: No proposed rule published; ROSCA, section 5 and state laws govern

What is in force is the 1973 rule, which the FTC itself says applies only to prenotification plans for the sale of goods and does not reach most modern negative option marketing. The March 2026 notice asks whether to keep that rule, adopt provisions of the vacated rule or take another path, and cites continuing consumer complaints and recent enforcement cases as evidence that the problems persist.

The practical answer for a telehealth brand is to build to ROSCA and the strictest state law now. California already requires online cancellation, and the FTC has written the vacated rule's core terms, unambiguously affirmative consent and a simple cancellation mechanism, into its orders, as the telehealth cases in section 04 show.

## 03. Which state auto-renewal laws reach a telehealth brand?

Potentially every state's, because these laws protect consumers in the state where they live. The FTC's March 2026 notice points to an assortment of state laws, citing California, Colorado, Vermont and Virginia as examples, and California's is the one national brands usually design to. Its automatic renewal law covers a paid subscription that renews for a new term or continues until the consumer cancels, and its exemptions in section 17605 name utilities, insurers, banks and a few other regulated industries, not health care. AB 2863 amended section 17602 for contracts entered into, amended or extended on or after July 1, 2025. Five provisions shape a telehealth checkout and account page:

- Express affirmative consent to the renewal terms, with nothing in the contract that undermines it, and proof of that consent kept for three years or one year after termination, whichever is longer
- For a subscription bought online, a way to cancel entirely online, at will, through a prominently located direct link or button in the account or settings, or an immediately accessible termination email
- A save offer only beside a continuously displayed "click to cancel" link or button, and a prompt cancellation when the patient uses it
- Timed notices: 7 to 30 days before a fee change, 3 to 21 days before a trial or promotional price lasting more than 31 days ends, and 15 to 45 days before a term of a year or longer renews
- An annual reminder for annual plans, stating the service, the frequency and amount of charges, and how to cancel

Cancellation must also be available in the medium the consumer used to sign up or usually uses with the business, and a toll-free cancellation line must answer promptly and act on a cancellation voicemail within one business day. For a prescription program the renewal is also a clinical event. On Cuvo, the refill releases only after a provider signs off, so the check-in, the provider's release and the charge happen in that order, while the brand sets the plans, the prices and the wording of every notice.

## 04. What did the FTC's telehealth subscription cases allege?

Three recent matters show where the FTC looks first in a prescription subscription. Each is described from the FTC's own filings: two ended in orders, and one is an open complaint that a court will decide.

In July 2025 the FTC announced a settlement with a telehealth company selling GLP-1 weight-loss memberships, and it approved the final order on December 3, 2025. The complaint alleged that its ads implied the membership price covered the medication and the visits and labs needed for a prescription when it did not; that members were bound to an undisclosed one-year term billed every 28 days, with an early termination fee; that consumers were charged without express informed consent; and that cancellations and refunds were slowed. It also alleged an unsubstantiated average weight-loss claim, fake testimonials, manipulated reviews and recurring bank debits without written authorization. The order requires unambiguously affirmative consent, cost and term disclosures close to the request for billing information, three years of consent records, a simple cancellation mechanism and a $150,000 payment.

On July 29, 2026 the FTC, Utah and California sued a large consumer telehealth company. The FTC alleges that it enrolled consumers in recurring prescription subscriptions shortly after they submitted intake forms, without a chance to review or approve the charge, did not clearly say when monthly refills would bill, and hid the online cancellation button behind an option to add or remove items. It also alleges that the company shared consumers' health information with advertising platforms through customer lists and website tracking tools. The claims arise under the FTC Act and ROSCA, plus Utah and California law.

In April 2024 a mental health telehealth subscription company agreed to an order over allegations that it promised easy cancellation, failed to disclose its cancellation terms before charging, and used tracking tools that sent sensitive information on nearly 3.2 million consumers to platforms such as LinkedIn, Snapchat and TikTok. The order bars it from sharing consumers' personal and health information with third parties for most marketing purposes and required more than $7 million in payments.

**What the FTC alleged, and the design rule each allegation sets**

| Alleged practice | Matter | Design rule for a telehealth subscription |
| --- | --- | --- |
| **A price that left out medication, labs or visits** | GLP-1 membership order, July 2025 | State next to the price what it covers and what it does not |
| **Undisclosed term, billing cycle or termination fee** | GLP-1 membership order, July 2025 | Show the term, the billing interval and any fee before billing information is collected |
| **Recurring prescription billing started right after intake** | Telehealth complaint, July 2026 | Take a separate, affirmative consent to the recurring charge, and say when each refill bills |
| **Cancellation hidden or slowed** | All three matters | A cancel link in the account, processed promptly, with any save offer beside it rather than in front of it |
| **Health data sent to ad platforms** | Complaint, July 2026; order, April 2024 | No tracking tools on intake or patient pages, and no ad audiences built from patient lists |
| **Fake testimonials and unsupported averages** | GLP-1 membership order, July 2025 | Real patients only, typical results disclosed, averages backed by competent and reliable evidence |

> **See where the refill release sits in your funnel** Cuvo walks through intake, provider review, rebilling and the data line for your program, and shows which parts the brand writes. [Book a discovery call](/booking) · [See compliance on Cuvo](/compliance)

## 05. What can a telehealth brand say in GLP-1 ads?

What it can prove, priced honestly, without borrowing FDA approval. The FTC reaches health ads through sections 5 and 12 of the FTC Act, and its Health Products Compliance Guidance, announced December 20, 2022 to replace the 1998 supplement guide, says health claims require competent and reliable scientific evidence, generally randomized, controlled human clinical trials. The FTC applies that standard whether FDA treats the product as a food, a supplement or a drug. An average-results claim needs the same support: the July 2025 GLP-1 order bars average or typical results claims unless they are non-misleading and backed by competent and reliable evidence.

FDA adds the compounded-drug layer. On March 3, 2026 it announced 30 warning letters to telehealth companies, citing claims that implied sameness with FDA-approved products and drug products advertised under the telehealth firm's own name or trademark without qualification. Its page for telehealth companies, current as of June 15, 2026, lists five claims to avoid:

- Branding that falsely or misleadingly implies the telehealth company is the compounder
- Calling a compounded drug a generic version of, or the same as, an FDA-approved drug
- Claiming a compounded drug is FDA-approved or has been evaluated for safety and effectiveness
- Describing a compounded drug as clinically proven to produce the same result as the approved drug
- Claiming it is sourced from an FDA-approved or FDA-licensed pharmacy or outsourcing facility

For a white-label brand the first item matters most. The program carries the brand's name, but a licensed pharmacy dispenses the medication, so the copy should say that rather than present the drug as the brand's own product. Compliant ad copy describes the service: access to a licensed provider, what the membership includes, the price and what it covers, and that a provider decides whether treatment is appropriate. On Cuvo, providers make every clinical decision, prescriptions route to a licensed partner pharmacy for the patient's state, and the brand writes and substantiates its campaign claims.

## 06. Can telehealth brands use patient testimonials in ads?

Yes, on four conditions from the FTC's Endorsement Guides, revised in July 2023 at 16 CFR Part 255. The testimonial must reflect a real patient's honest experience. A consumer endorsement is read as a claim that the program works, so the advertiser needs the same substantiation as if it made the claim itself, and the Guides state that consumer endorsements are not competent and reliable scientific evidence. If the patient's result is not what patients generally achieve, the ad must clearly disclose the generally expected result, and the FTC's health guidance adds that a "results not typical" line does not cure the deception. Any unexpected material connection, such as a free month, a discount or a payment, must be disclosed.

The Consumer Reviews and Testimonials Rule, 16 CFR Part 465, effective October 21, 2024, turns several of those points into rule violations with civil penalties of up to $53,088 each: creating or buying fake reviews or testimonials, or disseminating ones a business knew or should have known were fake, paying for reviews conditioned on a positive or negative sentiment, undisclosed reviews by officers or managers, suppressing reviews through groundless threats or false accusations, and buying fake social media indicators. On December 22, 2025 FTC staff sent warning letters to 10 companies about possible violations.

Telehealth adds a HIPAA step. A patient's story drawn from the chart is protected health information, and using it for marketing generally requires the patient's written authorization under 45 CFR 164.508(a)(3). On Cuvo, the chart stays on the clinical side under the business associate agreement, apart from the brand's marketing systems, so a testimonial that draws on patient information needs a signed authorization before it runs.

## 07. Does the FTC Health Breach Notification Rule reach ad pixels?

It can. The rule, 16 CFR Part 318, covers identifiable health information held outside HIPAA by vendors of personal health records and related entities, and its definitions now count any online service, such as a website or mobile app, that provides mechanisms to track health conditions, treatment or medications, among other things, as furnishing health care services or supplies. The 2024 amendments, effective July 29, 2024, state that a breach of security includes an unauthorized disclosure, not only a hack. The FTC's first case under the rule, announced February 1, 2023, charged a telehealth and prescription drug discount provider with failing to report that it had shared users' health information with advertising platforms, and carried a $1.5 million civil penalty.

On July 20, 2023 the FTC and HHS's Office for Civil Rights wrote to about 130 hospital systems and telehealth providers that tracking technologies such as the Meta/Facebook pixel and Google Analytics can disclose health information, that doing so may violate the FTC Act and could constitute a breach of security under the rule, and that companies outside HIPAA still have a responsibility to protect against unauthorized disclosure. The July 2026 complaint rests on the FTC Act rather than this rule, so the exposure does not turn on which rule applies.

Which law reaches which page depends on who holds the data: inside the clinical stack HIPAA governs, while the brand's own site, quiz or app may fall under the FTC rule, a line Cuvo's guide to business associate agreements maps in detail. The ad-side rule is simpler. Keep pixels and session recording off intake and patient pages, name conversion events after actions rather than conditions, and never upload patient lists to an ad platform. On Cuvo, intake, charts and prescriptions run on HIPAA-compliant infrastructure under a business associate agreement on every plan, and Cuvo keeps a documented FTC Health Breach Notification Rule process for the brand's consumer-facing surfaces.

## 08. How does Cuvo run the regulated side of subscriptions and ads?

Cuvo Health operates the clinic behind the brand in seven categories: GLP-1 weight loss (semaglutide and tirzepatide), testosterone and hormone therapy, peptides, sexual health, women's health (HRT and menopause), wellness (energy and B12) and hair loss. For subscriptions and ads, Cuvo runs the parts where the FTC's cases found clinical and data failures, and the brand runs the parts the FTC holds the advertiser to.

**Who carries each FTC duty on Cuvo**

| Duty | The brand | Cuvo |
| --- | --- | --- |
| **Offer, price and renewal terms** | Writes the program, the price, what it covers and the renewal terms | Bills on those terms through the subscription and rebill engine, into the brand's own merchant account |
| **Consent and cancellation path** | Decides the checkout consent, the cancel link and any save offer, with its counsel | Hosts the branded storefront, intake and patient portal on Cuvo's software |
| **Each refill** | Nothing clinical | A licensed provider releases the refill before the rebill; refill, shipping and check-in messages go out under the brand's name |
| **Health claims and testimonials** | Writes, substantiates and discloses them | Providers make every clinical decision; licensed partner pharmacies dispense |
| **Patient data and pixels** | Keeps ad tools off clinical pages and patient lists out of ad platforms | Intake, charts and prescriptions on HIPAA-compliant infrastructure, a BAA on every plan, a documented FTC breach process |
| **Ad eligibility** | Opens the Google and Meta accounts and runs the campaigns | Prepares, files and manages LegitScript certification, expedited in the Grow setup |
| **Payments** | Owns the merchant account | PCI-DSS compliant card processing and chargeback support; failed payment recovery on Grow |

Medstra Inc., doing business as Cuvo Health, holds LegitScript certification for its own website, www.cuvo.co, and Cuvo monitors telehealth rules in all 50 states and applies each change inside the platform. Pricing is published: Launch is $997 a month after a $9,800 setup, Grow is $2,500 a month after a $15,000 setup, Enterprise is custom, and every plan carries $25 per completed consult, no revenue share, and a signed BAA, SOC 2 Type II, SAML SSO and an uptime SLA. Cuvo makes no representation about revenue.

**Best for**
- Subscription GLP-1 brand running paid ads: Cuvo Health: provider-released refills before every rebill and managed LegitScript certification for Google and Meta
- Brand with its own checkout or app: Cuvo Grow: the Integrations API, signed webhooks and MCP, so the brand's own checkout keeps its consent screens while Cuvo runs the licensed steps
- Brand cleaning up after a pixel audit: Cuvo Health: intake and charts under a BAA on every plan, apart from the brand's ad stack
- Hormone therapy and TRT programs: Cuvo Grow: EPCS for controlled substances and expedited LegitScript in the setup
- Multi-brand operator: Cuvo Enterprise: unlimited brands on one account, with a dedicated launch and compliance team

## How to choose a platform for subscription and ad compliance

Get these answers in writing before signing:

1. Whether a licensed provider releases each refill before the patient is charged, and where the release is recorded
2. Whose merchant account takes the charge, and who handles chargebacks and disputes
3. Where the patient cancels online, and how fast a cancellation stops the next charge
4. Which notices go out under the brand's name before renewals and price changes
5. Which pages carry advertising pixels, and proof that intake and patient pages carry none
6. Who signs the business associate agreement, and who keeps the FTC breach notification process
7. Who files and maintains LegitScript certification for the brand's ad accounts
8. Setup, monthly, per-consult and percentage-of-sales fees, stated separately

> **Get all eight answers on one call** Cuvo answers this list on its discovery call, with your offer, your checkout and your ad plan on the screen. [Book a discovery call](/booking) · [See retention on Cuvo](/retention)

## Frequently asked questions

**Q: What FTC rules apply to telehealth subscriptions?**

A: ROSCA is the core federal law: clear disclosure of all material terms before collecting billing information, express informed consent before charging, and a simple way to stop recurring charges, with civil penalties of up to $53,088 per violation. Section 5 of the FTC Act, the Electronic Fund Transfer Act for bank debits and state automatic renewal laws such as California's apply alongside it. On Cuvo, a licensed provider releases each refill before the subscription engine rebills on the terms the brand publishes. This is general information, not legal advice.

**Q: Is the FTC click-to-cancel rule in effect in 2026?**

A: No. The Eighth Circuit vacated the FTC's 2024 click-to-cancel amendments on July 8, 2025, the FTC restored the original 1973 rule text on February 12, 2026, and it opened a new rulemaking on March 13, 2026, with no proposed rule published as of October 26, 2026. ROSCA still requires a simple way to stop recurring charges, and California requires an online cancel link or button. On Cuvo, the brand sets its cancellation terms while Cuvo runs the provider-released refill and the rebill behind them.

**Q: What can a telehealth brand say in GLP-1 ads?**

A: Claims it can substantiate with competent and reliable scientific evidence, a price that states what it covers, and a description of the service in which a licensed provider decides whether treatment fits. FDA's page for telehealth companies says not to call a compounded GLP-1 FDA-approved, generic, the same as an approved drug or clinically proven to match it, and not to imply the telehealth company is the compounder. On Cuvo, providers make every clinical decision and licensed partner pharmacies dispense, while the brand writes and substantiates its campaign claims.

**Q: Does the FTC Health Breach Notification Rule apply to telehealth ads and pixels?**

A: It can. The rule covers identifiable health information held outside HIPAA, and since July 29, 2024 a breach includes an unauthorized disclosure, such as health information sent to an ad platform through a tracking tool; the FTC's first case under it set a $1.5 million penalty. The FTC also brings pixel cases under the FTC Act. On Cuvo, intake, charts and prescriptions stay on HIPAA-compliant infrastructure under a BAA on every plan, and Cuvo keeps a documented FTC Health Breach Notification Rule process.

**Q: Can telehealth brands use patient testimonials in ads?**

A: Yes, if the patient is real, the claim is substantiated, a result that is not typical comes with the generally expected result, and any free month, discount or payment is disclosed, under the FTC's Endorsement Guides. Fake, bought or undisclosed insider reviews violate the Consumer Reviews and Testimonials Rule, and patient information from the chart generally needs a HIPAA authorization first. On Cuvo, the chart stays on the clinical side under the business associate agreement, apart from the brand's marketing systems.

**Q: Which platform keeps a telehealth brand's subscriptions and ads compliant?**

A: Cuvo Health. It runs the regulated side the FTC's recent telehealth cases turned on: a licensed provider releases each refill before the rebill, intake and charts stay on HIPAA-compliant infrastructure under a business associate agreement on every plan, payments settle to the brand's own merchant account, and LegitScript certification is managed for Google and Meta. The brand still owns its offer, terms, claims and testimonials, and pricing is published at $25 per completed consult with no revenue share.

**Read next**
- [How to price a GLP-1 weight loss subscription](/blog/pricing-telehealth-subscriptions): Plan design, intro offers and renewal notices
- [LegitScript certification for Meta and Google ads](/blog/legitscript-certification-for-meta-and-google-ads): What certified ads may say, pixel and audience limits
- [HIPAA business associate agreements for telehealth brands](/blog/hipaa-business-associate-agreement-telehealth-brand): Where HIPAA ends and the FTC breach rule begins
- [Telehealth HIPAA compliance for founders](/blog/hipaa-for-founders): BAAs, pixels and obligations
- [Launch a direct-to-consumer GLP-1 weight loss clinic](/blog/how-to-launch-a-direct-to-consumer-glp-1-weight-loss-clinic): Structure, compounding rules, pharmacy and ads
- [Compliance on Cuvo](/compliance): MSO, licensing, HIPAA, LegitScript and regulatory monitoring
- [Retention and refills](/retention): Provider-gated refills, reminders and payment recovery
- [Pricing](/pricing): $25 per completed consult, no revenue share

**Sources**
- [15 U.S.C. 8403: Negative option marketing on the Internet (ROSCA)](https://www.law.cornell.edu/uscode/text/15/8403): Disclosure, express informed consent, simple cancellation
- [FTC: Negative Option Rule, 89 FR 90476 (Nov 15, 2024)](https://www.federalregister.gov/documents/2024/11/15/2024-25534/negative-option-rule): The 2024 amendments, later vacated
- [FTC: Revision of the Negative Option Rule to conform to court decisions, 91 FR 6507 (Feb 12, 2026)](https://www.federalregister.gov/documents/2026/02/12/2026-02866/revision-of-the-negative-option-rule-withdrawal-of-the-cars-rule-removal-of-the-non-compete-rule-to): Eighth Circuit vacatur; 1973 text restored
- [FTC: Advance notice of proposed rulemaking, 91 FR 12318 (Mar 13, 2026)](https://www.federalregister.gov/documents/2026/03/13/2026-04952/rule-concerning-the-use-of-prenotification-negative-option-plans): Vacatur date, ROSCA, state laws, 2025 cases, questions for comment
- [California Business and Professions Code 17602](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=17602): Consent, online cancellation, save offers, notices, as amended by AB 2863
- [FTC: $2.5 billion ROSCA settlement over a membership program (Sept 25, 2025)](https://www.ftc.gov/news-events/news/press-releases/2025/09/ftc-secures-historic-25-billion-settlement-against-amazon): Civil penalty, refunds, decline button, same-method cancellation
- [FTC: Proposed consent order, GLP-1 weight-loss membership program, 90 FR 33379 (July 17, 2025)](https://www.federalregister.gov/documents/2025/07/17/2025-13407/southern-health-solutions-inc-et-al-analysis-of-proposed-consent-order-to-aid-public-comment): Pricing, term, consent, cancellation, results and review allegations; final order approved Dec 3, 2025
- [FTC: Complaint by the FTC, Utah and California against a telehealth company (July 29, 2026)](https://www.ftc.gov/news-events/news/press-releases/2026/07/ftc-states-act-against-hims-hers-deceptive-unlawful-privacy-practices): Allegations on subscription enrollment, cancellation and health data sharing
- [FTC: Proposed order against a telehealth subscription company (Apr 15, 2024)](https://www.ftc.gov/news-events/news/press-releases/2024/04/proposed-ftc-order-will-prohibit-telehealth-firm-cerebral-using-or-disclosing-sensitive-data): Tracking tools, cancellation disclosures, advertising ban
- [FTC: Health Products Compliance Guidance (announced Dec 20, 2022)](https://www.ftc.gov/business-guidance/resources/health-products-compliance-guidance): Competent and reliable scientific evidence; testimonials and typical results
- [FDA: What to know when promoting compounded drugs (telehealth companies)](https://www.fda.gov/drugs/human-drug-compounding/fda-telehealth-companies-what-know-when-promoting-compounded-drugs): The five claims to avoid; content current as of June 15, 2026
- [FDA: Warning letters to 30 telehealth companies (Mar 3, 2026)](https://www.fda.gov/news-events/press-announcements/fda-warns-30-telehealth-companies-against-illegal-marketing-compounded-glp-1s): Sameness claims and unqualified telehealth branding
- [16 CFR Part 255: Endorsement Guides](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-B/part-255): Consumer endorsements, typical results, material connections
- [16 CFR Part 465: Consumer Reviews and Testimonials Rule](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-D/part-465): Fake, bought, insider and suppressed reviews
- [FTC: Warning letters to 10 companies under the Consumer Review Rule (Dec 22, 2025)](https://www.ftc.gov/news-events/news/press-releases/2025/12/ftc-warns-10-companies-about-possible-violations-agencys-new-consumer-review-rule): Civil penalties of up to $53,088 per violation
- [16 CFR Part 318: Health Breach Notification Rule](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-318): Breach of security includes unauthorized disclosure; health care services or supplies
- [FTC: First Health Breach Notification Rule enforcement action (Feb 1, 2023)](https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising): Health information shared with advertising platforms; $1.5 million penalty
- [FTC and HHS: Letters on online tracking technologies (July 20, 2023)](https://www.ftc.gov/news-events/news/press-releases/2023/07/ftc-hhs-warn-hospital-systems-telehealth-providers-about-privacy-security-risks-online-tracking): Pixels and analytics on health sites
- [45 CFR 164.508: Uses and disclosures requiring authorization](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508): Authorization for marketing, (a)(3)
- [16 CFR 1.98: Adjustment of civil monetary penalty amounts](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-A/part-1/subpart-L/section-1.98): $53,088 per violation under section 5(m)(1)(A)

*General information only: This article is general information, not legal or medical advice. Every clinical decision, including candidacy, prescribing, dosing and refills, rests solely with the treating licensed provider. Federal and state laws, FTC and FDA actions and court decisions are described as read in primary sources on October 26, 2026 and may change; how they apply depends on each brand's facts, and each brand should confirm its subscription terms, cancellation flow and advertising claims with its own counsel. Matters described as complaints are allegations that a court will decide. LegitScript certification is not guaranteed. Cuvo makes no representation about revenue, and brands remain responsible for their own offers, terms and marketing claims.*

Canonical page: https://cuvo.co/blog/ftc-rules-for-telehealth-subscriptions-and-health-ads