CVS Health faces multiple data privacy lawsuits as of 2026, but the status varies significantly depending on which case you’re asking about. The most advanced settlement is the ExtraCare Privacy Settlement, which received final approval in late 2024 and began paying claimants in early 2026—eligible members who used their ExtraCare card between 2018 and 2023 can receive between $15 and $50 without needing to provide proof of purchase. Alongside this settlement, a separate federal lawsuit in California is actively proceeding against CVS and marketing partners over allegations that the CVS Pharmacy website and mobile app secretly tracked customers’ health-related browsing data, including information about prescriptions and medical conditions, and shared it with third parties without consent.
Beyond these two major cases, CVS is defending itself in several other class actions, including pharmacy dispensing-error suits, Caremark drug-pricing disputes, and a generic pricing settlement that reached preliminary approval with a final hearing scheduled for February 2026. Louisiana also concluded a $45 million settlement with CVS Health in 2024 over allegations that the company used customer information for unlawful text-messaging campaigns. For consumers trying to understand their rights, the key distinction is whether you’re a past ExtraCare member (eligible for the settled payment), someone affected by health data tracking (part of the ongoing lawsuit), or a patient impacted by other pharmacy-related claims.
Table of Contents
- What Data Was CVS Accused of Tracking Without Consent?
- How Is the California Health Data Tracking Lawsuit Progressing?
- Who Qualifies for the ExtraCare Privacy Settlement and How Much Can You Receive?
- How Do You File a Claim for the ExtraCare Settlement?
- What Other CVS Class Actions Are Currently Pending?
- What Was the Louisiana Settlement About and Has It Been Paid Out?
- How Do CVS’s Data Privacy Settlements Compare to Other Retail and Pharmacy Cases?
What Data Was CVS Accused of Tracking Without Consent?
cvs Pharmacy’s website and mobile app allegedly used tracking technology from a company called Quantum Metric, Inc. to monitor and intercept visitors’ sensitive health information. According to the lawsuit, this included names, addresses, prescription details, and browsing activity related to health conditions—data that was then shared with marketing partners without users’ knowledge or permission. The tracking happened as customers browsed the CVS Pharmacy website or used the app, meaning even people simply checking whether a medication was in stock or looking up health information could have had their activity logged and shared for marketing purposes.
The lawsuit alleges these practices violated California’s Invasion of Privacy Act, a state law that prohibits intentional interception of private communications or data. What makes this case unusual is that it doesn’t require customers to have purchased anything or even created an account—simply visiting the CVS Pharmacy website or using the mobile app was enough to trigger the tracking. A federal judge ruled in 2024 that CVS and its marketing partner cannot dismiss the case, allowing most of the claims to proceed. This means the lawsuit is still active and has not been settled, unlike the ExtraCare case, which already completed its settlement process.
How Is the California Health Data Tracking Lawsuit Progressing?
The health data tracking case remains in ongoing federal litigation in California, which means there is no settlement offer yet and no deadline for claiming. The court has already rejected CVS’s attempts to dismiss the case, signaling that a judge found the allegations credible enough to move forward. For consumers, this creates an uncertain timeline—the case could take years to resolve, either through trial or a future settlement agreement that would then need to be approved by the court.
One important limitation of this lawsuit is that if you’ve already cleaned your browser cookies or cleared your tracking data, proving that you visited the CVS Pharmacy website during the period when the tracking occurred might be difficult. The lawsuit covers website and mobile app visitors, but demonstrating exactly when you visited or how much personal data was collected about you specifically would likely require access to CVS’s internal tracking records, which the company has not voluntarily disclosed. Currently, there is no mechanism to file a claim because there is no settlement—you are automatically included in this lawsuit if you fall within the class definition, but that also means you cannot receive compensation until the case is resolved.
Who Qualifies for the ExtraCare Privacy Settlement and How Much Can You Receive?
The ExtraCare Privacy Settlement is the only CVS data privacy case with active claim payouts as of 2026. You are eligible if you were a member of CVS’s ExtraCare loyalty program between January 2018 and December 2023 and used your card to make at least one purchase during that time. The settlement does not require you to prove that you were harmed or that your specific data was misused—membership and card usage during that window is sufficient to qualify. Payment amounts range from $15 to $50 per claimant, with the exact amount depending on how many people file claims.
If fewer people claim, each person receives more money; if more people claim, the fund gets divided among more recipients. An important detail about this settlement is that you do not need to provide a receipt or proof of purchase when filing your claim. This makes it accessible to people who may no longer have their receipt, who can’t remember exactly what they bought, or who simply have discarded documentation from transactions years ago. However, CVS has the ability to verify your ExtraCare membership internally, so the company can check whether your account shows purchases during the settlement period. Claims processing for this settlement began in early 2026, meaning the window to file is likely limited and may have already closed or be closing soon, depending on the settlement agreement’s terms.
How Do You File a Claim for the ExtraCare Settlement?
To file a claim for the ExtraCare Privacy Settlement, you typically need to either submit a claim form online through the settlement website or mail in a paper claim form—the specific process depends on which settlement administrator is handling the case. Most CVS settlements direct claimants to a dedicated website where you can enter your ExtraCare membership information and submit your claim electronically. The online process is faster than mailing a paper form and provides immediate confirmation of receipt.
If you choose to mail a claim, you will need to complete a paper form with your name, address, and ExtraCare membership details, then send it to the settlement administrator’s address before the deadline. The advantage of mailing is that you have a postal record of when you sent it, which can be helpful if there are questions about whether your claim was timely. However, the disadvantage is slower processing—paper claims typically take longer to review and process than online submissions. If you filed a claim before early 2026 and were approved, you should have already received your payment by check or direct deposit, depending on how you elected to receive it.
What Other CVS Class Actions Are Currently Pending?
Beyond the data privacy cases, CVS is defending several other class actions that have nothing to do with health tracking or ExtraCare data. Caremark, which is owned by CVS Health, is involved in drug-pricing litigation over allegations of unfair pricing practices affecting customers. Pharmacy dispensing-error suits have also been filed, claiming CVS pharmacy locations made mistakes filling prescriptions or dispensing medications.
Additionally, a generic drug pricing settlement received preliminary approval and is heading toward a final approval hearing scheduled for February 2026—if the judge approves it, there will be a claims window for customers who purchased generic medications from CVS during the relevant time period. These other cases operate on completely separate timelines and involve different conduct than the health tracking lawsuit or ExtraCare settlement. If you believe you were affected by a pharmacy error, generic drug overpricing, or Caremark’s pricing practices, you would need to file claims in those separate actions. Class action lawsuits don’t automatically cover all possible misconduct by a company—each case addresses specific allegations and has its own class definition, settlement terms, and claims deadline.
What Was the Louisiana Settlement About and Has It Been Paid Out?
In 2024, Louisiana reached a $45 million settlement with CVS Health that addressed a different type of consumer harm than the data tracking cases. This settlement focused on allegations that CVS used customer information to conduct an unlawful text-messaging campaign—specifically, the company allegedly sent text messages to customers encouraging them to oppose certain pharmacy benefits manager legislation. These communications were characterized as unfair, deceptive, and unlawful business practices because CVS used personal customer data without clear consent to deliver political messaging.
This settlement has been concluded as of 2026, though the distribution of funds from this case is separate from the ExtraCare privacy settlement. If you received unwanted text messages from CVS during the relevant period, you may have been part of the Louisiana class. However, because this settlement has already been approved and funded, the claims window has likely closed. The settlement illustrates an important point: companies can face liability not just for selling or sharing personal data, but also for using data to contact customers for corporate advocacy campaigns without clear authorization.
How Do CVS’s Data Privacy Settlements Compare to Other Retail and Pharmacy Cases?
CVS’s ExtraCare settlement and health data tracking case are not isolated—other major retailers and pharmacies have faced similar litigation over data privacy and health information tracking. What distinguishes the CVS cases is the specific focus on health-related browsing data and the involvement of a third-party tracking vendor (Quantum Metric), which shifted some responsibility for the data sharing to a marketing partner. In other retail data breaches, liability has typically fallen solely on the retailer, but CVS’s health data tracking case names both CVS and the tracking company as defendants.
The payment amounts in the ExtraCare settlement ($15 to $50) are relatively modest compared to some data breach settlements, where individuals have received $50 to $200 or more. However, the ExtraCare case required no proof of harm—membership alone qualifies you—whereas larger settlements often require customers to document fraud, identity theft, or actual financial losses. The Louisiana $45 million settlement, while larger in total payout, was distributed across a different class and addressed customer objections to political messaging rather than data misuse. These variations mean that comparing CVS’s settlements to other companies’ data privacy cases requires understanding what exactly each lawsuit alleged and who qualified to recover.