GoodRx shared sensitive prescription search data with Meta Platforms, Google, and Criteo without obtaining user authorization. When millions of Americans used GoodRx to research prescription prices, the platform deployed tracking pixels—small pieces of code embedded on web pages—that transmitted their health information directly to advertising and analytics companies. For example, if you searched for medications for diabetes or depression on GoodRx, that search history, along with your email address and phone number, was automatically forwarded to Meta’s servers so the company could build a profile of your health interests for targeted advertising purposes.
The privacy violations affected an estimated 56 million consumers. In response to litigation alleging violations of federal wiretapping statutes and consumer protection laws, GoodRx Holdings and Criteo have agreed to pay $32 million in settlement compensation (an increase from the originally proposed $25 million settlement that was rejected by the court twice). The settlement currently awaits its third approval attempt as of June 2026, while Meta Platforms and Google continue to defend themselves in ongoing litigation.
Table of Contents
- How Did GoodRx Share Prescription Search Data With Advertisers?
- What Personal Data Was Exposed in the GoodRx Privacy Breach?
- Which Companies Received GoodRx Users’ Prescription Data?
- How Much Money Will GoodRx Settlement Provide to Affected Consumers?
- What Federal Laws Did GoodRx Violate by Sharing Health Data?
- Current Legal Status of the GoodRx Privacy Settlement
- How GoodRx’s Tracking Pixel Scheme Compromised Privacy at Scale
How Did GoodRx Share Prescription Search Data With Advertisers?
GoodRx used website tracking technologies—specifically pixels and cookies—to intercept user data on its platform and transmit it to third-party advertising companies. These pixels function as invisible trackers that fire whenever a user interacts with GoodRx pages. Each time someone searched for a prescription drug price, looked at medication information, or reviewed pharmacy options on GoodRx, the pixel collected that activity and sent it to Meta, Google, and Criteo in real time. The mechanism worked without explicit user consent.
When visitors landed on GoodRx, the tracking code was automatically activated. Unlike a clear permission prompt asking “Do you want to share your prescription searches with Meta?”, the data transmission happened silently in the background. The platform’s privacy disclosures did not adequately inform users that sensitive health data would be transmitted to advertising networks, nor did it explain the scope of information being shared or the identities of the companies receiving it. This tracking scheme represents a particularly invasive form of surveillance because prescription searches inherently reveal sensitive medical information. A search for medications used to treat HIV, opioid addiction, mental illness, or fertility problems communicates deeply personal health details that advertisers typically cannot obtain through other channels.
What Personal Data Was Exposed in the GoodRx Privacy Breach?
The data transmitted to advertisers included far more than anonymous browsing behavior. GoodRx’s tracking pixels sent actual prescription information, medical conditions, email addresses, telephone numbers, and detailed records of user activity across both the GoodRx platform and other websites users visited. In practice, this meant Meta received not just “someone searched for diabetes medication” but rather “the person with email address [email protected], phone number 555-0123, searched for metformin on February 15th and then visited a diabetes support forum.” The combination of identifiers made this data particularly valuable to advertisers and particularly damaging to consumers. By linking prescription searches to actual email addresses and phone numbers, the data enabled targeted advertising campaigns.
More concerning, it created permanent digital records of individuals’ health concerns that persisted in Meta’s and Google’s data warehouses indefinitely. A critical limitation in the litigation is that the settlement only covers claims related to prescription price lookups where tracking pixels transmitted data. GoodRx may have collected other sensitive health data through different mechanisms that fall outside this settlement’s scope. Consumers affected by other privacy violations from GoodRx may need to pursue separate claims.
Which Companies Received GoodRx Users’ Prescription Data?
Three major corporations—Meta Platforms (Facebook’s parent company), Google, and Criteo—received prescription and health data from GoodRx tracking pixels. Meta and Google are among the largest data aggregators in the world, with surveillance capabilities spanning billions of people globally. By adding GoodRx prescription data to their existing profiles, these companies deepened their surveillance of health interests. Criteo operates as a retargeting and advertising company, meaning it specializes in showing targeted ads to people based on their browsing and search behavior.
When Criteo received GoodRx users’ prescription searches, it could deploy that information to display pharmaceutical advertisements and health-related ads to those same individuals across the internet. If you searched for arthritis medications on GoodRx, Criteo could later show you arthritis treatment ads on unrelated websites you visit. The violation of federal wiretapping statutes stems from the unauthorized interception and transmission of this data. Under federal law, intercepting electronic communications—which includes monitoring internet traffic and forwarding data to third parties—without consent constitutes illegal wiretapping. GoodRx’s pixel-based transmission of prescription data triggered these protections.
How Much Money Will GoodRx Settlement Provide to Affected Consumers?
The total settlement amount is $32 million, an increase from the originally proposed $25 million. The court rejected the initial settlement proposal twice before GoodRx and Criteo agreed to increase the payout. This $32 million will be distributed among the 56 million consumers whose prescription data was shared without authorization. When divided across 56 million affected individuals, the per-person settlement amount is relatively modest, roughly 57 cents per person on average.
However, settlement distributions depend on claim forms filed, objections, attorney fees, and court-approved deductions. Some consumers will receive more if they file timely claims; others may receive less if the settlement fund is divided among a smaller number of documented claimants. For comparison, other major privacy class action settlements in the technology sector have ranged from $20 million to over $700 million depending on the scope of violations and number of affected parties. The settlement amount reflects not just the scale of the violation but also the difficulty of proving actual financial damages. While prescription surveillance creates clear privacy harms, quantifying what a single person lost financially from having their health data shared with advertisers proves challenging in court.
What Federal Laws Did GoodRx Violate by Sharing Health Data?
GoodRx’s actions violated multiple federal statutes. The Wiretap Act, codified in Title III of the federal criminal code, prohibits intentional interception of electronic communications. By transmitting prescription data without authorization, GoodRx violated this federal wiretapping statute. The company also breached the Health Breach Notification Rule under the Health Insurance Portability and Accountability Act (HIPAA), which establishes standards for protecting health information and requires notification when breaches occur.
Additionally, GoodRx violated state and federal consumer protection laws by deceptive practices—failing to disclose that prescription searches would be transmitted to advertising networks and misrepresenting the scope of data sharing in its privacy policies. Some states have additional health privacy statutes that GoodRx violated as well. A significant limitation is that Meta Platforms and Google have not yet settled and continue to defend the litigation. The $32 million settlement covers claims against GoodRx Holdings and Criteo only. Consumers pursuing claims against Meta and Google for their role in receiving and using this health data will need to await the outcome of ongoing litigation, which could extend years into the future.
Current Legal Status of the GoodRx Privacy Settlement
As of June 2026, the settlement is in its third approval attempt seeking final court authorization. The court previously rejected two settlement proposals—the initial $25 million offer and a revised version—before GoodRx and Criteo increased the total to $32 million. Court approval of class action settlements requires judicial findings that the settlement is fair, reasonable, and adequate, and that it treats class members fairly.
GoodRx Holdings and Criteo are the only defendants settling in this phase. Meta Platforms and Google remain active defendants in ongoing litigation. This split creates a situation where some of the primary beneficiaries of the illegal data transmission—Meta and Google, the companies that obtained the valuable health surveillance data—continue fighting the claims rather than settling. The remaining litigation against Meta and Google could result in additional settlements or judgments that provide further compensation to affected consumers.
How GoodRx’s Tracking Pixel Scheme Compromised Privacy at Scale
The tracking pixel mechanism that enabled GoodRx’s privacy violation operates invisibly to most users. HTML code embedded in web pages contains tiny 1-pixel-by-1-pixel image files or JavaScript code that triggers automatically when a page loads. Each pixel beacon includes parameters that communicate user information to remote servers. In GoodRx’s case, the pixels included prescription search queries, medical information, and personally identifiable information linked to user accounts. The scale of the violation reflects the volume of prescription searches conducted on GoodRx.
The platform serves millions of Americans monthly who use it to compare pharmacy prices and research medication costs. Each search represented an opportunity for the tracking pixels to transmit health data. Over months and years, this resulted in 56 million individuals having their prescription information shared without authorization. A single user who conducted multiple prescription searches would have had each search transmitted separately, creating a detailed longitudinal record of their health interests over time. The fact that GoodRx continued this practice despite operating in the healthcare space—a heavily regulated sector where privacy obligations are well-established—underscores how standard the practice had become among technology platforms. The company failed to implement basic safeguards that would have limited data transmission to only what was necessary or obtained user consent before sharing health information with advertisers.
Sources
- GoodRx $32M Privacy Settlement 2026: Who Qualifies — OpenClassActions.com’s continuing news coverage of this case.
You Might Also Like
- Willow TV Privacy Class Action Claims Subscriber Data Was Shared With Meta
- Talkspace Privacy Class Action Claims Mental Health Data Was Shared With Tracking Tools
- Audible Privacy Class Action Claims Listening Data Was Shared With Third Parties
Open Settlements You Can Claim Now
Browse current class action settlements accepting claims — several require no proof of purchase: