GoodRx Tracking Pixel Litigation

GoodRx is the case that broadens the story beyond hospitals — and it is really two separate matters that are easy to confuse. One is a landmark $1.5 million FTC enforcement action, the first ever under the Health Breach Notification Rule, and it is final. The other is a private class action with a much larger headline number that a federal court has repeatedly declined to approve. Keeping them apart is the whole point.

What GoodRx allegedly did

GoodRx is a prescription-discount and telehealth platform — consumers use it to compare drug prices, find coupons, and access some telehealth services. The core allegation, common to both the FTC action and the class action, is that GoodRx used Meta Pixel, Google and Criteo tracking tags, and software development kits (SDKs) that shared users' sensitive information — including the specific medications they looked up and the health conditions those implied — with advertising and social-media companies, without users' authorization.

This is what makes GoodRx different from the hospital cases in this series. It's not a health system; it's a consumer-health platform, and the data at issue is prescription and medication data — arguably some of the most sensitive information a person can reveal, because a drug name often implies a diagnosis. Consumer Reports first surfaced the data-sharing in 2020, and it drew regulatory attention from there.

Thread 1: the FTC action — a regulatory landmark

This is the thread that matters most for its precedent, and it is fully resolved.

On February 1, 2023, the Department of Justice, acting on behalf of the FTC, filed a proposed order against GoodRx. The FTC's core theory was twofold:

• Violation of the FTC's Health Breach Notification Rule (HBNR) — GoodRx failed to notify consumers of the unauthorized disclosure of their health information to third parties. This was the first enforcement action the FTC had ever brought under the HBNR, and it rested on an expanded reading of the rule: the FTC treated unauthorized sharing of health data as a reportable "breach," even though no hacker was involved and nothing was stolen in the traditional sense.
• Violation of Section 5 of the FTC Act — unfair and deceptive practices. The FTC noted, among other things, that GoodRx had displayed a "HIPAA Secure" seal implying it was HIPAA-compliant and a covered entity when, per the FTC, it was neither.

The outcome: GoodRx agreed to a $1.5 million civil penalty (paid to the U.S. Treasury), the advertising-sharing ban, and a corrective-action program. The settlement was approved by the court and is in effect. GoodRx denied the FTC's allegations and admitted no wrongdoing, stating it settled to avoid the time and expense of litigation and had already addressed the underlying practices.

Thread 2: the class action — repeatedly rejected

Separately from the FTC action, private plaintiffs brought class-action litigation over the same data-sharing. This is the thread that carries the bigger headline numbers — and it is important to be precise, because it has not produced an approved settlement.

The consolidated case is Doe v. GoodRx Holdings, Inc., in the U.S. District Court for the Northern District of California, before Judge Araceli Martínez-Olguín. It names GoodRx alongside co-defendants Meta, Google, and Criteo, and asserts a stack of claims: federal wiretapping, the California Invasion of Privacy Act, California's Confidentiality of Medical Information Act, unjust enrichment, intrusion upon seclusion, and various state consumer-protection laws.

Here is the sequence, which is the instructive part:

• November 2024: plaintiffs proposed a $25 million settlement with GoodRx (GoodRx alone; the ad-tech co-defendants were not part of it).
• June 2025: the court declined to grant preliminary approval, flagging problems with the class definition, the scope of the release class members would give up, the size of the fund, and — critically — the absence of a claim-by-claim analysis showing what class members could actually recover.
• November 2025: the parties returned with a revised $32 million settlement, now adding Criteo as a settling defendant.
• January 16, 2026: the court again denied preliminary approval, finding the parties had "largely failed to address" its earlier concerns — still no claim-by-claim value analysis, still an insufficiently justified broad release, and no confirmatory discovery to support the strength of the claims. The court noted estimated per-member recovery of only roughly $4 to $12.

How GoodRx fits the 2026 landscape

GoodRx broadens the healthcare pixel wave beyond hospitals into consumer-health and pharmacy. Since 2023, US healthcare organisations have reportedly paid $100M+ across roughly 19 analysed pixel cases, and the Markup's 2022 investigation found the Meta Pixel on 33 of the 100 largest US health systems. GoodRx's distinct contribution is the regulatory dimension: it's where the FTC drew a line.

The GoodRx FTC action is often cited alongside BetterHelp as the pair of enforcement actions that put every health-adjacent app on notice: the FTC will treat unauthorized ad-tech data sharing as a reportable breach, and it will use its unfairness authority to ban the practice outright.

Why this case matters for website operators

First: regulators, not just plaintiffs, are watching. The hospital cases in this series were plaintiff-driven. GoodRx shows the FTC will act on its own — and its remedies (a permanent ban on a data-sharing practice) can be more consequential than a cash settlement. If you're a health-adjacent app or site, you have two categories of risk, not one.

Second: a big settlement number can be a mirage. The class action's $25M and $32M figures are widely repeated, but the court declined both. A proposed settlement is not paid money and not a resolved case. It's a reminder to read past headlines to the actual procedural posture.

Third: prescription and condition data is uniquely sensitive. A medication name often implies a diagnosis. When a pixel transmits which drug a user searched, the alleged harm is concrete and severe — which is exactly why this drew first-ever regulatory action.

Fourth: claims you make about privacy are enforceable. The "HIPAA Secure" seal issue shows that representations about your data practices can themselves be the violation. Saying you protect data, then sharing it via pixels, is the deceptive-practice hook.

What this means for your site

The controls that address this class of risk are technical, not legal:

• Block before consent, everywhere. Meta Pixel, Google and Criteo tags, and marketing SDKs should not fire and transmit until the visitor affirmatively agrees. The disclosure only happens if the tag loads.
• Treat any search or product term as potentially sensitive. On a health-adjacent site, the thing a user typed — a drug, a condition, a service — is the sensitive payload. Don't let it flow to ad platforms pre-consent.
• Make your privacy claims match your configuration. If your policy or a trust seal says you protect health data, your actual tag behaviour has to back that up. A mismatch is the enforcement hook.
• Audit SDKs, not just web pixels. GoodRx's exposure included SDKs. If you have a mobile app, its embedded kits are a separate surface with its own review.
• Keep an auditable consent log. Timestamped proof of affirmative consent is the record that supports both litigation defense and regulatory response.

ConsentPixel — Privacy · Verified blocks Meta, Google, and other third-party trackers at the browser level until the visitor consents — on the web pages where prescription and condition searches happen — and logs each decision. It governs your website's tracking layer; app-embedded SDKs and internal systems are separate workstreams that need their own review.

Frequently asked questions

Related cases & reading

Sources

1. Federal Trade Commission, "FTC Enforcement Action to Bar GoodRx from Sharing Consumers' Sensitive Health Info for Advertising" (Feb 1, 2023) and "First FTC Health Breach Notification Rule case addresses GoodRx's not-so-good privacy practices" — $1.5M penalty, first HBNR action, permanent ad-sharing ban.
2. HIPAA Journal, "Court Approves FTC Settlement with GoodRx" — court approval and in-effect status; "HIPAA Secure" seal allegation.
3. WilmerHale and Davis Wright Tremaine client alerts (Feb–Mar 2023) — HBNR expanded interpretation, Section 5 unfairness theory.
4. ClassAction.org and Bloomberg Law (Jan 2026) — Doe v. GoodRx Holdings, Inc., N.D. Cal.; $25M (2024) and revised $32M (Nov 2025) settlements, both denied preliminary approval (June 2025 and Jan 16, 2026), estimated $4–$12 per member.
5. Justia Dockets, "Order denying Preliminary Approval of Class Settlement, Doe v. GoodRx Holdings, Inc. et al." (filed Jan 16, 2026); MLex and Law360 coverage of the denial and co-defendants Meta, Google, Criteo.
6. The Markup, "The FTC Is Taking on Telehealth's Data Sharing Problem — Starting with GoodRx" (Feb 1, 2023) — pixel/SDK mechanism and prescription-data specifics.