A federal judge in Northern California granted first approval to a revised $32 million class settlement that resolves claims against GoodRx and the advertising firm Criteo over tracking tools that pushed patient data outward without consent. The figure is $7 million higher than the $25M pact the telehealth drug discounter struck on its own.
The extra money bought Criteo a place in the deal. Meta and Google remain outside it, and their portion of the litigation continues.
What the pixels did
GoodRx runs a free price-check and coupon platform for prescription drugs, which makes it a de facto mirror of what medications people take. The consolidated complaint filed in February 2023, Doe et al. v. GoodRx Holdings, claimed advertising and analytics tags shipped visitor data to third parties between 2017 and 2020, alongside claims under California’s medical information and privacy statutes and New York consumer law.
Regulators moved first. The FTC settled with GoodRx for $1.5M in 2023 under its Health Breach Notification Rule, a penalty GoodRx did not concede was warranted. The private suits followed within weeks.
What class members get
Claims and opt-outs are due December 29, 2026. The final fairness hearing is set for February 11, 2027. Both companies deny any violation and say the deal avoids the cost and distraction of a trial.
For compliance teams the lesson is the one that keeps resurfacing: a pharmacy identifier plus a condition-specific page is health data under the FTC, whether or not HIPAA ever attached.
