• by Wendy Davis  @wendyndavis, December 2, 2024

Drug discounter GoodRx has agreed to pay $25 million to settle class-action claims that it wrongly shared consumers' health information with Meta Platforms, Google and Criteo for ad purposes, according to court documents filed Friday.

If accepted by U.S. District Court Judge Araceli Martinez-Olguin in San Francisco, the settlement will resolve a lawsuit brought by consumers in February 2023, soon after the Federal Trade Commission unveiled an enforcement action against GoodRx over alleged privacy lapses.

The FTC alleged in its complaint that the drug discounter “repeatedly violated” promises to “never share personal health information with advertisers or other third parties.”

The agency specifically alleged that GoodRx shared sensitive information -- “prescription medications and personal health conditions, personal contact information, and unique advertising and persistent identifiers” -- with third-party ad companies.

GoodRx settled that matter by agreeing to pay $1.5 million, to refrain from sharing users' health data for ad purposes, and to obtain people's express consent before disclosing their health data for non-advertising purposes. The company said at the time that it didn't agree with the allegations. It also didn't admit wrongdoing. GoodRx added that the settlement focused on “an old issue that was proactively addressed almost three years ago, before the FTC inquiry began."

The class-action complaint by consumers largely reiterates the FTC's allegations, but also includes claims that GoodRx violated various state consumer protection laws by allegedly misrepresenting its policies regarding data. For instance, the consumers alleged that between October 2017 and March 2019, GoodRx's privacy policy stated “we never provide advertisers or any other third parties any information that reveals a personal health condition or personal health information.”

The plaintiffs in the class-action also sued Google, Meta and Criteo. Those companies have urged Martinez-Olguin to throw out the claims against them for numerous reasons. Among other arguments, the three companies say that even if the allegations in the complaint were proven true, they wouldn't show that the tech platforms intended to receive sensitive health data.

Criteo also argues the complaint makes “only vague and factually unsupported allegations about Criteo’s business generally,” and lacks any explanation of how GoodRx allegedly used Criteo, how Criteo's technology worked, or whether GoodRx allegedly configured Criteo's technology to send the company data.

Martinez-Olguin hasn't yet ruled on the request.