INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

GoodRx & Criteo Agree $32 Million Data Privacy Settlement

| 2026-10-29 13:00 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
A revised $32 million settlement has received first approval from the court to resolve class action data breach litigation against GoodRx and Criteo related to the use of website tracking tools on the GoodRx website that disclosed user information to third parties without consent. The lawsuit, consolidated into a single complaint – Doe et al. v. GoodRx Holdings, Inc., et al. – is pending in the United States District Court for the Northern District of California, Oakland Division. This incident affects approximately 1 million users who had their personal and health information disclosed to third parties without consent between 2017 and 2020. The attack works by using website tracking tools on the GoodRx website that disclose user data to digital advertising companies such as Criteo. As of now, the settlement has received first approval from the court, but it is still pending further review and approval.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
NORTH_AMERICA NORTH_AMERICA healthhealth
Incident Timeline
‎October 2017
A class action lawsuit was filed in the U.S. District Court of the Northern District of California against GoodRx shortly after the FTC settlement announcement.
organisation the U.S. District Court
Shortly after the FTC settlement was announced, a class action lawsuit was filed in the U.S. District Court of the Northern District of California against GoodRx that made similar allegations to the FTC – that personal information was disclosed to third parties without users’ knowledge or consent, when they had been informed on the website – between October 2017 and March 2019- that their pers…
‎March 2019-
A class action lawsuit was filed in the U.S. District Court of the Northern District of California against GoodRx shortly after the FTC settlement announcement.
organisation the U.S. District Court
Shortly after the FTC settlement was announced, a class action lawsuit was filed in the U.S. District Court of the Northern District of California against GoodRx that made similar allegations to the FTC – that personal information was disclosed to third parties without users’ knowledge or consent, when they had been informed on the website – between October 2017 and March 2019- that their pers…
‎March 2019
The $25 million proposed settlement agreement was rejected by the judge due to inadequate demonstration of fairness to consumers.
financial $25 proposed settlement
District Court Judge Araceli Martinez-Olguin is due to issue a ruling on the plaintiffs’ motion to approve the $25 million settlement.
Update: The $25 million settlement agreement was rejected by the judge, as both sides failed to adequately demonstrate that the settlement was fair to consumers.
financial $8.33 third
The plaintiffs’ attorneys are seeking one-third of the settlement amount – $8.33 million.
‎February 2, 2023
The lawsuits against GoodRx Holdings, Inc., Criteo, Meta and Google were consolidated into a single complaint pending in the United States District Court for the Northern District of California.
industry Health
General Document Context
organisation Meta
On February 2, 2023, the first putative class action lawsuit was filed, followed by other class action complaints against defendants GoodRx, Criteo, Meta and Google.
organisation Google
On February 2, 2023, the first putative class action lawsuit was filed, followed by other class action complaints against defendants GoodRx, Criteo, Meta and Google.
organisation Holdings, Inc.
The lawsuits were consolidated into a single complaint – Doe et al. v. GoodRx Holdings, Inc., et al. – which is pending in the United States District Court for the Northern District of California, Oakland Division.
organisation Oakland Division
The lawsuits were consolidated into a single complaint – Doe et al. v. GoodRx Holdings, Inc., et al. – which is pending in the United States District Court for the Northern District of California, Oakland Division.
financial $32 revised settlement
Under the terms of the settlement, GoodRx and Criteo will establish a $32,000,000 settlement fund from which attorneys’ fees and expenses, notification and settlement administration costs, settlement fund account costs, and service awards for the class representatives will be deducted.
organisation HIPAA Journal
Get The FREE HIPAA Compliance Checklist Immediate Delivery of Checklist Link To Your Email Address Please Enter Correct Email Address Your Privacy Respected HIPAA Journal Privacy Policy The plaintiffs believe their claims are valid, and the defendants deny the claims in the lawsuit and maintain no laws were violated.
organisation District Court
The proposed $25 million settlement was agreed by the plaintiffs and the defendants; however, the settlement was rejected by District Court Judge Araceli Martinez-Olguin, as the parties failed to meet the legal standards for demonstrating that the settlement was fair to consumers.
financial $25 proposed settlement
The proposed $25 million settlement was agreed by the plaintiffs and the defendants; however, the settlement was rejected by District Court Judge Araceli Martinez-Olguin, as the parties failed to meet the legal standards for demonstrating that the settlement was fair to consumers.
‎December 4, 2024
GoodRx agreed to a $25 million settlement with the FTC over its use of tracking technologies that disclosed website visitor data without user consent.
industry Health
General Document Context
financial $25 proposed settlement
Claims must be submitted by the same date, and the final fairness hearing has been scheduled for February 11, 2027. December 4, 2024: GoodRx Agrees to $25 Million Settlement to Resolve Tracking Technology Lawsuit GoodRx, a telemedicine platform provider and drug discounter, has agreed to settle a consolidated class action lawsuit for $25 million.
organisation Meta Platforms
The lawsuit was filed in response to its use of website tracking technologies that disclosed website visitor data to third parties such as Meta Platforms, Google, and Criteo for advertising purposes without user consent.
organisation The Federal Trade Commission
The Federal Trade Commission (FTC) investigated GoodRx over the use of tracking tools and determined the FTC Act had been violated.
organisation Health Breach Notification Rule
The FTC also alleged a violation of its Health Breach Notification Rule as GoodRx failed to notify users about the data sharing.
‎Oct 29, 2026
A revised $32 million data privacy settlement has received first approval from the court to resolve class action litigation against GoodRx and Criteo related to the use of website tracking tools on the GoodRx website that disclosed user information to third parties without consent.
industry Health
General Document Context
financial $32 revised settlement
GoodRx & Criteo Revised $32 Million Data Privacy Settlement Gets First Approval. GoodRx & Criteo Revised $32 Million Data Privacy Settlement Gets First Approval Posted By Steve Alder on Oct 29, 2026
A revised $32 million settlement has received first approval from the court to resolve class action data breach litigation against GoodRx and Criteo related to the use of website tracking tools on the GoodRx website that disclosed user information to third parties without consent.
organisation a Federal Trade Commission
The litigation stems from a Federal Trade Commission (FTC) complaint alleging GoodRx unlawfully disclosed the personal and health information of its users in violation of the FTC Act and the FTC’s Health Breach Notification Rule.
organisation FTC
The litigation stems from a Federal Trade Commission (FTC) complaint alleging GoodRx unlawfully disclosed the personal and health information of its users in violation of the FTC Act and the FTC’s Health Breach Notification Rule.
financial $1.5 settlement
GoodRx disagreed with the FTC’s allegations; however, the FTC complaint was resolved with a $1.5 million settlement .
‎between 2017 and 2020
GoodRx and Criteo agreed to settle a consolidated class action complaint alleging unfair business practices and improper sharing of consumer data with digital advertising and analytics companies between 2017 and 2020.
‎2026/10/29
A $32 million data privacy settlement between GoodRx and Criteo was approved by a court.
organisation California Invasion of Privacy Act
The consolidated lawsuit asserted claims for negligence, negligence per se , intrusion upon seclusion, unjust enrichment, and violations of the California Confidentiality of Medical Information Act, California Invasion of Privacy Act, California Consumers Legal Remedies Act, California Unfair Competition Law, New York’s General Business Law, and Illinois Consumer Fraud and Deceptive Business Pr…
organisation California Consumers Legal Remedies Act
The consolidated lawsuit asserted claims for negligence, negligence per se , intrusion upon seclusion, unjust enrichment, and violations of the California Confidentiality of Medical Information Act, California Invasion of Privacy Act, California Consumers Legal Remedies Act, California Unfair Competition Law, New York’s General Business Law, and Illinois Consumer Fraud and Deceptive Business Pr…
organisation California Unfair Competition Law
The consolidated lawsuit asserted claims for negligence, negligence per se , intrusion upon seclusion, unjust enrichment, and violations of the California Confidentiality of Medical Information Act, California Invasion of Privacy Act, California Consumers Legal Remedies Act, California Unfair Competition Law, New York’s General Business Law, and Illinois Consumer Fraud and Deceptive Business Pr…
organisation Deceptive Business Practices Act
The consolidated lawsuit asserted claims for negligence, negligence per se , intrusion upon seclusion, unjust enrichment, and violations of the California Confidentiality of Medical Information Act, California Invasion of Privacy Act, California Consumers Legal Remedies Act, California Unfair Competition Law, New York’s General Business Law, and Illinois Consumer Fraud and Deceptive Business Pr…
organisation CMIA
The lawsuit asserted claims of common law invasion of privacy, intrusion upon seclusion, unjust enrichment, violations of the California Confidentiality of Medical Information Act (CMIA), aiding and abetting violations of CMIA, violations of the California Invasion of Privacy Act, violations of the California Consumers Legal Remedies Act, and violations of the California Business and Professiona…
organisation the California Invasion of Privacy Act
The lawsuit asserted claims of common law invasion of privacy, intrusion upon seclusion, unjust enrichment, violations of the California Confidentiality of Medical Information Act (CMIA), aiding and abetting violations of CMIA, violations of the California Invasion of Privacy Act, violations of the California Consumers Legal Remedies Act, and violations of the California Business and Professiona…
organisation the California Consumers Legal Remedies Act
The lawsuit asserted claims of common law invasion of privacy, intrusion upon seclusion, unjust enrichment, violations of the California Confidentiality of Medical Information Act (CMIA), aiding and abetting violations of CMIA, violations of the California Invasion of Privacy Act, violations of the California Consumers Legal Remedies Act, and violations of the California Business and Professiona…
organisation the California Business and Professional Code
The lawsuit asserted claims of common law invasion of privacy, intrusion upon seclusion, unjust enrichment, violations of the California Confidentiality of Medical Information Act (CMIA), aiding and abetting violations of CMIA, violations of the California Invasion of Privacy Act, violations of the California Consumers Legal Remedies Act, and violations of the California Business and Professiona…
‎December 29, 2026
Class members wishing to object to the settlement or opt out must submit their objections by December 29, 2026.
industry Health
General Document Context
‎February 11, 2027
The $32 million data privacy settlement between GoodRx and Criteo has received its first approval, with claims submission deadline set for the same date as a previously scheduled fairness hearing on February 11, 2027.
industry Health
General Document Context
financial $25 proposed settlement
Claims must be submitted by the same date, and the final fairness hearing has been scheduled for February 11, 2027. December 4, 2024: GoodRx Agrees to $25 Million Settlement to Resolve Tracking Technology Lawsuit GoodRx, a telemedicine platform provider and drug discounter, has agreed to settle a consolidated class action lawsuit for $25 million.
Tactical Metrics
Metrics
financial
32,000,000
Revised Settlement
A revised $32 million settlement has received first approval from the court to resolve class action data breach litigation against GoodRx and Criteo related to the use of website tracking tools on the GoodRx website that disclosed user information to third parties without consent.
GoodRx & Criteo Revised $32 Million Data Privacy Settlement Gets First Approval. GoodRx & Criteo Revised $32 Million Data Privacy Settlement Gets First Approval Posted By Steve Alder on Oct 29, 2026
Under the terms of the settlement, GoodRx and Criteo will establish a $32,000,000 settlement fund from which attorneys’ fees and expenses, notification and settlement administration costs, settlement fund account costs, and service awards for the class representatives will be deducted.
Metrics
financial
25,000,000
Proposed Settlement
The proposed $25 million settlement was agreed by the plaintiffs and the defendants; however, the settlement was rejected by District Court Judge Araceli Martinez-Olguin, as the parties failed to meet the legal standards for demonstrating that the settlement was fair to consumers.
Claims must be submitted by the same date, and the final fairness hearing has been scheduled for February 11, 2027. December 4, 2024: GoodRx Agrees to $25 Million Settlement to Resolve Tracking Technology Lawsuit GoodRx, a telemedicine platform provider and drug discounter, has agreed to settle a consolidated class action lawsuit for $25 million.
District Court Judge Araceli Martinez-Olguin is due to issue a ruling on the plaintiffs’ motion to approve the $25 million settlement.
Update: The $25 million settlement agreement was rejected by the judge, as both sides failed to adequately demonstrate that the settlement was fair to consumers.
Metrics
financial
1,500,000
Settlement
GoodRx disagreed with the FTC’s allegations; however, the FTC complaint was resolved with a $1.5 million settlement .
Metrics
financial
8,330,000
Third
The plaintiffs’ attorneys are seeking one-third of the settlement amount – $8.33 million.
Intelligence Sources
HIPAA Journal 2026-10-29