GoodRx and the FTC: Prescription Data Shared for Ads

The FTC said GoodRx promised not to share health information with advertisers, then did so.

By Siddharth ShankarUpdated October 24, 2026

Prescription discount apps and telehealth services are not always covered by the same rules as your doctor. The FTC’s case against GoodRx shows how a consumer health service can still be held to account. This guide follows the FTC’s announcement.

What was announced

The FTC announced the action on February 1, 2023. It was the FTC’s first enforcement action under the Health Breach Notification Rule. The target was GoodRx Holdings Inc., a telehealth and prescription drug discount provider. GoodRx agreed to pay a $1.5 million civil penalty. The Department of Justice filed the proposed order in the U.S. District Court for the Northern District of California on the FTC’s behalf, and the Commission voted 4-0 to refer it. The order takes effect only once the court approves it.

What the FTC alleged

• Unauthorised disclosures. GoodRx did not notify consumers, the FTC or the media about unauthorised disclosures of individually identifiable health information.
• Recipients. The data went to Facebook, Google, Criteo, Branch and Twilio.
• Data shared. Users’ prescription medications and personal health conditions.
• The promise. Since at least 2017, GoodRx allegedly promised users it would not share personal health information with advertisers or other third parties, despite repeatedly doing so.
• Ad targeting. In August 2019, GoodRx allegedly uploaded lists of users who bought certain medications, including heart and blood pressure drugs, to Facebook, and used them to target those users with health-related ads on Facebook and Instagram.
• Other claims. GoodRx allegedly let third parties use the data for their own purposes such as research or improving advertising, falsely claimed compliance with Digital Advertising Alliance principles and displayed a seal that falsely suggested HIPAA compliance.

The proposed order

The proposed order would:

• permanently ban GoodRx from disclosing user health information to applicable third parties for advertising;
• require affirmative express consent before sharing health information for other purposes, with no dark patterns used to obtain consent;
• require GoodRx to direct third parties to delete the shared health data and to inform consumers about the breaches;
• require a data retention schedule that limits how long data is kept, which GoodRx must publicly post;
• require a comprehensive privacy programme with strong safeguards;
• require compliance with the Health Breach Notification Rule.

What this shows

A seal that suggests HIPAA compliance does not mean a service is covered by HIPAA. Many consumer health services sit outside the rules that bind doctors and insurers. The Health Breach Notification Rule is one way the FTC can act when those services share data without authorisation.

How to protect yourself

1. Check whether a service is a healthcare provider or a consumer app, and read its privacy policy for sharing with advertising partners.
2. Do not assume a seal means protection. Look at what the policy actually says.
3. Limit browser tracking. See tracking cookies and Global Privacy Control.
4. Pay attention to what you search. Medication and condition searches can be logged and linked to your device.
5. Review your records. If you suspect misuse of your information, read medical identity theft signs.

Similar cases

Compare the Flo Health case and the BetterHelp case. For your own records held by providers, see the HIPAA right of access.