GOODRX · PRESCRIPTION DATA · FTC
The FTC alleged GoodRx shared prescription and health-condition information with advertising companies despite privacy promises.
Prescription searches and purchases → Facebook / Google / ad-tech → targeted health advertising
GoodRx collects health information through prescription searches, coupons, telehealth services and confirmations from pharmacy-benefit managers when users purchase medication with a GoodRx coupon. In 2023, the FTC brought its first enforcement action under the Health Breach Notification Rule against the company.
The FTC alleged that GoodRx had shared sensitive personal health information—including prescription medications and health conditions—with Facebook, Google, Criteo and other third parties. The agency also alleged that GoodRx used some of that information to create health- and medication-specific advertising audiences. GoodRx agreed to a $1.5 million civil penalty and an order limiting future health-data sharing.
Primary sources: FTC — GoodRx enforcement action · FTC case record
This page preserves the anecdote and its caveats separately from the shorter Why Privacy Matters explainer. The goal is to keep the argument readable without hiding the receipts.