GoodRx: Health Data for Advertisers, Privacy Promises for Users

The GoodRx FTC health data settlement required the company to pay a $1.5 million civil penalty over allegations that it disclosed users’ personal health information without authorization and failed to notify them. The Federal Trade Commission alleged that medication and health-condition information went to advertising platforms despite promises to protect it. For someone inside a digital-health business, the important connection is between the privacy promise a customer saw and the data the advertising software actually sent about people using the service.

The court entered the order on February 17, 2023. The Justice Department’s announcement of the entered order describes both the payment obligation and continuing restrictions on the company’s handling of health information.

GoodRx Care, HeyDoctor and the Prescription Business

GoodRx sold prescription-discount products and telehealth services directly to consumers through its website and mobile apps. The Federal Trade Commission describes that business in its account of the GoodRx enforcement action. The order names GoodRx Holdings and its business names, including GoodRx Gold, GoodRx Care, HeyDoctor and HeyDoctor by GoodRx.

The service brought prescription information and remote care into a consumer platform. The government’s allegations concern what happened to identifying information and health details in that setting, including information about medications and sensitive conditions. The privacy issue reached the systems around the care, where advertising software and outside recipients could become part of the data flow.

What the Federal Trade Commission Alleged GoodRx Shared

The Federal Trade Commission alleged that GoodRx disclosed prescription medications, personal health conditions, contact information, and unique advertising and persistent identifiers to outside advertising platforms, including Facebook and Google. Its account places the alleged disclosures between 2017 and 2020 and says they contradicted explicit privacy promises.

The identifying fields matter as much as the medication name. In its rule commentary, the Federal Trade Commission explains that device and mobile advertising identifiers combined with health information can identify or re-identify an individual. A privacy review that considers only the health field misses what the accompanying identifier can reveal.

The government also alleged that GoodRx’s public policies promised it would not give third parties information revealing a person’s health condition or personal health information. According to the Justice Department, the company repeatedly assured users that it would protect their privacy while disclosing their information without authorization, consent or knowledge.

For an insider, that creates a concrete comparison: the promise shown to users, the fields sent outside the company, and the recipient’s use of those fields. The policy and the software are parts of the same story.

Why the Health Breach Notification Rule Reached GoodRx

GoodRx was the Federal Trade Commission’s first enforcement action under the Health Breach Notification Rule. The rule reaches covered personal-health-record businesses outside HIPAA and requires notice when unsecured, identifiable health information is breached.

In the GoodRx action, the agency alleged that the company acted as a vendor of personal health records and disclosed more than 500 consumers’ unsecured, identifiable health information without their authorization. It charged the company with failing to give the required notices to affected individuals, the FTC and media outlets.

The alleged breach was the unauthorized disclosure itself. The action put advertising transfers within breach enforcement: information a business sent to an advertising platform could trigger notice obligations. Calling the transfer part of the marketing operation did not answer whether the consumer authorized it.

The Federal Trade Commission later brought a similar action involving Easy Healthcare’s Premom ovulation and period-tracking app. In its rulemaking account, the agency described alleged disclosures to Google and AppsFlyer contrary to privacy promises, together with failure to provide required breach notices. The repeated mechanism was a health app’s disclosure of identifiable information followed by a failure to tell users.

HIPAA Claims Were Part of the Privacy Promise

The government’s HIPAA allegation concerned how GoodRx represented its privacy protections. The Justice Department said the company’s advertising displayed a seal claiming that the service was HIPAA secure and that patient data was protected, although GoodRx was not a HIPAA-covered entity and had not complied with HIPAA requirements.

The alleged assurance was striking: a badge promising protection under a law the company was not subject to and had not followed. A badge on the customer-facing page and an advertising integration behind it cannot be assessed in isolation.

The HIPAA representation was part of the consumer-protection action under the Federal Trade Commission Act and Health Breach Notification Rule. The order also prohibits further misrepresentations, extending the remedy to what the company tells users about its practices.

Advertising Restrictions and the Limits of Consent

The GoodRx order bans disclosure of health information for advertising purposes and requires affirmative consent and notice for other covered disclosures. Its terms retain defined operational exclusions. The advertising restriction and the consent requirement therefore do different work: consent is not a blanket permission to continue a disclosure the order bans.

The Federal Trade Commission’s later rule commentary also points to GoodRx when explaining why a manipulated consent interface does not provide meaningful choice. It describes interfaces that impair a consumer’s ability to decide and says that disclosures inconsistent with a company’s privacy promises are unauthorized. The presence of a consent screen tells only part of the story. What it says, how it works and what the company sends afterward matter together.

Advertising Analytics and Operational Analytics

The Federal Trade Commission’s later rulemaking examples distinguish advertising analytics from services needed to run an app. In its medication-app example, outside companies use identifiable health information for their own advertising profiles, contrary to the app’s privacy promises.

The agency contrasts that use with necessary app services under contracts that restrict recipients to those services and notices that clearly disclose the sharing purposes. Crash reporting is one example of operational analytics when essential to the app’s functioning and unconnected to advertising.

For a platform employee, the useful distinction is the work the recipient performs and the use it can make of the information. An analytics label alone does not describe either.

What the GoodRx Order Requires

The order requires GoodRx to notify users whose information was disclosed and to notify users in the event of a future breach. The order also requires deletion and a privacy program.

The Justice Department also identifies continuing recordkeeping, certification, monitoring and compliance obligations. Those requirements give the order a life inside the business after the settlement announcement, reaching the records it keeps and the assurances it makes about compliance.

For an employee involved in those functions, the important evidence may be the gap between a stated control and what a system or recipient actually does. A deletion workflow, a disclosure setting and a certification each answer a different part of that question.

The Rule After the GoodRx Order

The amended Health Breach Notification Rule took effect on July 29, 2024. The Federal Trade Commission subsequently withdrew its superseded health-app policy statement on September 9, 2026, leaving the amended rule in place.

The Evidence Inside a Digital-Health Platform

Advertising configurations, recipient logs, consent interfaces and deletion workflows can show how a platform’s data practices compare with its promises. The useful account connects what information moved, who received it, what users were told and what the company did after identifying the disclosure.

Different employees may see different parts. An engineer may understand what an advertising software development kit was configured to send. A marketing employee may understand the recipient and purpose. Someone responsible for privacy may know which consent interface was used, how a deletion request was handled or how the company reached its notice decision.

We bring those views together. The work is to connect an employee’s knowledge of the system with the representation made to users and the company’s response. A technical log becomes more informative when someone can explain the business decision behind it.

Health Data and a Whistleblower Case

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. Where health data and government healthcare money meet, we assess what you know and the case it can support.

You Know What the Software Sent

If you worked on the advertising integration, consent screens or response to a health-data disclosure, speak with our whistleblower experts about what happened inside the platform. We assess how your technical and business knowledge can build a whistleblower case, bring in whistleblower lawyers who know digital-health privacy, and stay beside you through the process.