GoodRx allegedly violates FTC’s Health Breach Notification Rule by sharing personal health information

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

GoodRx data violation overview: 

• Who: The Federal Trade Commission (FTC) has fined GoodRx $1.5 million.
• Why: The telehealth company was allegedly sharing user health data with third parties for advertising purposes, in violation of the law, the FTC said.
• Where: The company operates in the United States.

The Federal Trade Commission (FTC) has fined GoodRx $1.5 million, alleging the telehealth company was secretly sharing its customers’ health data with third parties for advertising purposes, a violation of privacy.

The fine, announced Feb. 1, was the first time the FTC had taken enforcement action under its Health Breach Notification Rule.

“Digital health companies and mobile apps should not cash in on consumers’ extremely sensitive and personally identifiable health information,” FTC’s Bureau of Consumer Protection Director Samuel Levine said.

“The FTC is serving notice that it will use all of its legal authority to protect American consumers’ sensitive data from misuse and illegal exploitation.” 

The FTC said the penalty was handed down to GoodRx for failing to notify consumers and others of its unauthorized disclosures of consumers’ personal health information to Facebook, Google and other companies.

In the future, GoodRx will be prohibited from sharing user health data with third parties for advertising purposes. It has also agreed to pay the $1.5 million civil penalty for violating the rule. 

The proposed order must be approved by the federal court to go into effect.

GoodRx told customers it would not share their health data, but did the opposite, FTC alleges

According to the FTC’s complaint, GoodRx violated the law by sharing sensitive personal health information for years with advertising companies and platforms including Facebook, Google and Criteo. 

It said GoodRx has, at least since 2017, “deceptively promised its users that it would never share personal health information with advertisers or other third parties,” while repeatedly violating this promise. 

The FTC said GoodRx also used its customers’ personal health information to target them with ads on platforms such as Facebook, including sharing that data with Facebook. 

It also allowed third parties it shared data with to use that information for their own internal purposes, including for research and development or to improve advertising, the FTC alleges.

Patient health information privacy has been in the news several times in recent months.

In September, 30 U.S. senators implored the U.S. Department of Health and Human Services (HHS) to ensure medical providers can’t — without a patient’s explicit consent — provide health information to police wanting to use it to aid in post-Dobbs abortion investigations. 

What do you think of the FTC’s decision? Let us know in the comments. 

The FTC is represented by Ronnie Solomon of its Bureau of Consumer Protection.

The FTC GoodRx case is Federal Trade Commission v. GoodRx, case number unknown, in the U.S. District Court for the Northern District of California. 

Read About More Class Action Lawsuits & Class Action Settlements:

• iHeartMedia class action alleges company discloses subscriber data to Meta
• Consumer alleges Apple violates user data by unlawfully recording data, app activity
• Carhartt class action claims company uses session replay software to view customer communications
• Gerber Life Insurance class action claims company makes unsolicited telemarketing calls