GoodRx and Criteo reached a revised $32 million settlement after allegations that GoodRx’s website tracking tools shared users’ personal and health-related information with advertisers between 2017 and 2020 without consent. The deal recently received first court approval. Anyone who used GoodRx during that period should file a claim before the December 29, 2026 deadline.
| Company | GoodRx Holdings, Inc. |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Not Publicly Disclosed |
| People Affected | Not Publicly Disclosed |
| Attack Method | Unauthorized Data Sharing |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the GoodRx Data Breach?
GoodRx, a company known for its prescription discount platform, has reached a revised $32 million settlement over claims it shared user data with outside companies without permission. A court recently gave the deal its first approval. The case centers on website tracking tools that sent visitor information to advertising and analytics firms.
According to the litigation, this data sharing happened between 2017 and 2020. These tracking tools, often called pixels, are small pieces of code that monitor how visitors use a website. As a result, companies like Meta, Google, and Criteo reportedly received details about GoodRx users without their knowledge.
The issue first drew attention through a Federal Trade Commission investigation. The FTC alleged that GoodRx violated federal law and its Health Breach Notification Rule by disclosing health-related information to third parties. GoodRx disagreed with these findings but ultimately settled with the FTC for $1.5 million rather than pursue a lengthy legal fight.
Following the FTC settlement, affected users filed a wave of class action lawsuits. These cases were eventually consolidated into a single complaint, Doe et al. v. GoodRx Holdings, Inc., et al., now pending in the Northern District of California. The consolidated case also named Criteo, Meta, and Google as defendants, though only GoodRx and Criteo are part of the current settlement.
Who Was Affected?
The individuals affected are people who used the GoodRx website or app and had their activity tracked between 2017 and 2020. Because GoodRx operates as a free, widely used platform for comparing prescription drug prices, this group includes a broad range of everyday consumers across the United States.
The exact number of people affected has not been publicly disclosed. However, the lawsuit covers a nationwide class, with specific claims tied to consumer protection laws in California, New York, and Illinois. This suggests the impacted population spans many states rather than a single region.
Because GoodRx serves health-conscious consumers searching for medication pricing, the affected group likely includes people managing sensitive health conditions. In addition, since the platform is used by people of varying ages, it’s possible that some younger users or caregivers searching on behalf of family members were also affected.
What Information Was Potentially Exposed?
The specific types of information involved have not been publicly disclosed in detail beyond general descriptions used in the litigation. Court filings and the underlying FTC complaint describe the disclosure of identifying information and health-related browsing activity tied to GoodRx’s platform, shared with advertising and analytics companies without proper consent.
Because the core allegation involves the disclosure of personal and health information through tracking tools, affected individuals should understand that their browsing behavior and interaction with a health-related platform may have been shared with third parties. This differs from a typical hacking incident, since no outside attacker broke into GoodRx’s systems in this case.
Even without a traditional hack, this type of data sharing carries real risk. When health-related browsing data reaches advertising networks, it can be combined with other data points to build a detailed profile of a person’s medical interests. This raises concerns about targeted advertising based on sensitive conditions.
In addition, when personal identifiers move between multiple companies, the risk of further unauthorized use increases. For example, data shared with multiple third parties creates more opportunities for mishandling, resale, or exposure through a future breach at one of those third-party companies.
What Is the Company Doing?
GoodRx disagreed with the FTC’s allegations but chose to resolve that matter through a $1.5 million settlement rather than litigate further. As part of that resolution, GoodRx agreed to stop sharing users’ health information with third parties for advertising purposes. The company also agreed to obtain consent before sharing data for other purposes going forward.
In the consolidated class action, GoodRx and Criteo initially proposed a $25 million settlement. However, the court rejected that amount because the parties did not adequately show the settlement was fair to consumers. In response, the companies increased the fund by $7 million and formally added Criteo as a settling defendant, bringing the total to $32 million.
This revised agreement has now received preliminary court approval. Under its terms, the settlement fund will cover attorneys’ fees, administration costs, and service awards for class representatives, with the remainder distributed to people who file valid claims. Claims against Meta and Google continue separately and are not part of this resolution.
What Should Affected Individuals Do?
File a Claim Before the Deadline
If you used GoodRx between 2017 and 2020, you may be eligible to file a claim for a portion of the $32 million settlement fund. Claims must be submitted by December 29, 2026, so it’s important to act before that date passes.
To file a claim, affected individuals typically need to provide basic information confirming their use of the platform during the relevant period. Because the final fairness hearing is scheduled for February 11, 2027, payments will likely follow after that hearing concludes.
Monitor Your Credit Reports
Even though this case centers on data sharing rather than a traditional breach, it’s still wise to check your credit reports regularly. This helps you catch unfamiliar accounts or inquiries early, before they cause lasting damage.
You can request free credit reports from each of the three major bureaus annually. In addition, reviewing your reports every few months throughout the year gives you a more consistent view of your financial activity.
Stay Alert for Phishing Attempts
Because your information may have been shared with advertising and data companies, you could see an increase in targeted emails, texts, or calls. Scammers sometimes take advantage of data exposure news to craft convincing phishing messages.
As a result, avoid clicking links or sharing personal details in response to unexpected messages. Instead, contact companies directly using verified phone numbers or websites if you need to confirm an account issue.
Review Your Privacy Settings on Health Apps
Going forward, it’s worth reviewing the privacy settings on any health or prescription-related apps you use. Many platforms allow you to limit tracking or opt out of certain data-sharing practices.
Because tracking tools like pixels are common across many websites, taking a few minutes to adjust these settings can reduce how much of your activity gets shared with outside companies in the future.
Consider Speaking With a Data Privacy Attorney
If you’re unsure whether you qualify for the settlement or want to understand your broader legal options, consulting a data breach attorney can help. Many offer free case evaluations to walk you through your rights.
This is especially useful if you believe your sensitive health information was shared without your consent and you want guidance beyond the current settlement terms.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.