Privacy & Information Security Law Blog

The telehealth and prescription drug discount provider, GoodRx, recently agreed to pay $25 million to settle class action claims originating from the company’s unauthorized disclosure of consumers’ personal health information, according to recent filings with the U.S. District Court for the Northern District of California.  The class action alleges that GoodRx violated federal wiretapping statutes, consumer protection laws and privacy rights stemming from the company’s use of website tracking technologies and unauthorized sharing of consumers’ health information with Meta Platforms, Google and Criteo for ad purposes.

If accepted by the District Court, the settlement will resolve a lawsuit consumers brought following the Federal Trade Commission’s February 2023 enforcement action against GoodRx for violations of the Health Breach Notification Rule and FTC Act.  This settlement is separate from the $1.5 million civil penalty GoodRx agreed to as part of the FTC enforcement action, which also prohibits GoodRx from sharing sensitive health data for advertising.