GoodRx and Criteo win preliminary approval of revised $32M web-tracking privacy settlement
A U.S. District Court (N.D. Cal., Oakland) has granted preliminary approval to a revised $32 million settlement between GoodRx, Criteo and plaintiffs in the consolidated class action Doe et al. v. GoodRx Holdings, Inc., et al. The case concerns website tracking pixels on GoodRx properties that disclosed user identifiers and sensitive health information to third-party advertising and analytics firms between 2017 and 2020 without consent. An earlier $25 million proposal was rejected by Judge Araceli Martinez-Olguin for failing to show fairness to consumers, prompting the parties to add $7 million and formally include Criteo. The litigation followed an FTC complaint alleging violations of the FTC Act and the Health Breach Notification Rule, which GoodRx resolved for $1.5 million while denying wrongdoing. Claims against co-defendants Meta and Google continue separately; opt-out and claim deadline is December 29, 2026, with a final fairness hearing on February 11, 2027.
Detalhes técnicos
The exposure stemmed from tracking pixels — JavaScript/code snippets embedded in web pages that capture user interactions and transmit them to advertising platforms. In GoodRx's case, these transmitted identifiers alongside prescription and health-condition data, contradicting public statements that no personal health information was shared with advertisers.
Remediação
Under the FTC settlement GoodRx is barred from sharing user health information with third parties for advertising and must obtain consent for other disclosures. Organizations handling health-adjacent data should audit third-party tags on web and mobile properties, restrict pixel deployment on pages containing PHI, and validate privacy statements against actual data flows.
Linha do tempo
-
GoodRx and Criteo win preliminary approval of revised $32M web-tracking privacy settlement
ler a análise desta fonte ocultar
A U.S. District Court (N.D. Cal., Oakland) has granted preliminary approval to a revised $32 million settlement between GoodRx, Criteo and plaintiffs in the consolidated class action Doe et al. v. GoodRx Holdings, Inc., et al. The case concerns website tracking pixels on GoodRx properties that disclosed user identifiers and sensitive health information to third-party advertising and analytics firms between 2017 and 2020 without consent. An earlier $25 million proposal was rejected by Judge Araceli Martinez-Olguin for failing to show fairness to consumers, prompting the parties to add $7 million and formally include Criteo. The litigation followed an FTC complaint alleging violations of the FTC Act and the Health Breach Notification Rule, which GoodRx resolved for $1.5 million while denying wrongdoing. Claims against co-defendants Meta and Google continue separately; opt-out and claim deadline is December 29, 2026, with a final fairness hearing on February 11, 2027.
Technical Details
The exposure stemmed from tracking pixels — JavaScript/code snippets embedded in web pages that capture user interactions and transmit them to advertising platforms. In GoodRx's case, these transmitted identifiers alongside prescription and health-condition data, contradicting public statements that no personal health information was shared with advertisers.
Remediation
Under the FTC settlement GoodRx is barred from sharing user health information with third parties for advertising and must obtain consent for other disclosures. Organizations handling health-adjacent data should audit third-party tags on web and mobile properties, restrict pixel deployment on pages containing PHI, and validate privacy statements against actual data flows.