GoodRx to pay $25 million, while tech companies like Meta and Google await possible further action
-
GoodRx will pay $25 million to settle claims it shared users sensitive data with third parties like Meta and Google without consent.
-
FTC found violations of federal law, including the Health Breach Notification Rule; a class action followed with similar allegations.
-
If approved, affected users can file claims for compensationthough over $8 million may go to attorneys fees.
GoodRx, a popular telemedicine and drug discount provider, has agreed to pay $25 million to settle a class action lawsuit accusing the company of improperly sharing users' personal health information with advertisers like Meta, Google, and Criteodespite explicitly promising not to.
The suit stems from GoodRxs use of tracking pixels, hidden snippets of code embedded in websites that gather and transmit user data. Plaintiffs allege that from October 2017 to March 2019, GoodRx used such tracking technologies to send sensitive datalike users medication searches and health concernsto third-party ad platforms without informing users or obtaining consent, according to a HIPPA Journal report.
The settlement follows a 2023 Federal Trade Commission (FTC) action, in which the agency accused GoodRx of violating the FTC Act and the Health Breach Notification Rule. The FTC said the company repeatedly misled users, claiming their health information would be kept private while its website quietly leaked data to tech companies for marketing.
From assurances to allegations
Despite publicly asserting that we never provide advertisers or any other third parties with any information that reveals a personal health condition, GoodRx was found to be doing exactly that, according to both federal regulators and private plaintiffs.
GoodRx has denied any wrongdoing, stating that the issue was resolved years before the FTCs investigation began, and that it believed it was operating in full compliance. Nonetheless, it agreed to pay $1.5 million to the FTC and implement stricter privacy controls, including an explicit ban on sharing health data for advertising.
Shortly after the FTC settlement, a class action lawsuit was filed in California, ultimately consolidating several related lawsuits under the case name Jane Doe et al. v. GoodRx Holdings, Inc., et al. The case accuses GoodRx of invasion of privacy, intrusion upon seclusion, unjust enrichment, and multiple violations of California and other state consumer protection laws.
What happens next
The class action also names Meta, Google, and Criteo as co-defendants, alleging they knowingly received and used sensitive data. All three companies are fighting to have the claims dismissed. The proposed $25 million settlement applies only to GoodRx; if approved, claims against the tech giants would proceed.
The case is currently before District Court Judge Araceli Martinez-Olguin, who will decide whether to approve the proposed deal. If she signs off, affected users will be able to file claims for a share of the fund, although roughly $8.33 millionone-third of the totalis earmarked for plaintiffs attorneys.
The GoodRx case is one of the most high-profile examples yet of how digital health platforms are facing growing scrutiny for quietly sharing personal data with ad networks, often in contradiction of their own privacy promises. And with more healthcare services moving online, the implications could extend far beyond this one settlement.
Posted: 2025-07-23 13:58:48