https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising Skip to main content U.S. flag An official website of the United States government Here's how you know Here's how you know Dot gov The .gov means it's official. Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you're on a federal government site. Https The site is secure. The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely. Translation Menu * Espanol Secondary Menu * Report Fraud * Sign Up for Consumer Alerts * Search the Legal Library Menu close Main Menu Mega * Show/hide Enforcement menu items Enforcement We enforce federal competition and consumer protection laws that prevent anticompetitive, deceptive, and unfair business practices. View Enforcement Search or browse the Legal Library Find legal resources and guidance to understand your business responsibilities and comply with the law. Browse legal resources Search small [ ]Search Sections + Cases and Proceedings + Premerger Notification Program + Merger Review + Anticompetitive Practices + Rulemaking + Statutes + Competition and Consumer Protection Guidance Documents + Warning Letters + Consumer Sentinel Network + Criminal Liaison Unit + Recent FTC Cases Resulting in Refunds + Notices of Penalty Offenses + Competition Matters Blog Take action + Report an antitrust violation + File adjudicative documents + Find banned debt collectors + View competition guidance Competition Matters Blog Competition Matters HSR threshold adjustments and reportability for 2023 the Premerger Notification Office Staff February 16, 2023 View all Competition Matters Blog posts * Show/hide Policy menu items Policy We work to advance government policies that protect consumers and promote competition. View Policy Search or browse the Legal Library Find legal resources and guidance to understand your business responsibilities and comply with the law. Browse legal resources Search small [ ]Search Sections + Advocacy and Research + Advisory Opinions + Cooperation Agreements + Federal Register Notices + Reports + Public Comments + Studies + Testimony + Policy Statements + International Take action + Find policy statements + Submit a public comment Feature [ftc_hq6_400x350] Vision and Priorities Memo from Chair Lina M. Khan to commission staff and commissioners regarding the vision and priorities for the FTC. Learn more Tech@FTC Blog Tech@FTC A Century of Technological Evolution at the Federal Trade Commission Stephanie T. Nguyen, Chief Technology Officer February 17, 2023 View all Tech@FTC Blog posts * Show/hide Advice and Guidance menu items Advice and Guidance Learn more about your rights as a consumer and how to spot and avoid scams. Find the resources you need to understand how consumer protection law impacts your business. Take action + Report fraud + Report identity theft + Register for Do Not Call + Sign up for consumer alerts + Get Business Blog updates + Get your free credit report + Find refund cases + Order bulk publications Consumer Advice + Shopping and Donating + Credit, Loans, and Debt + Jobs and Making Money + Unwanted Calls, Emails, and Texts + Identity Theft and Online Security + Scams Business Guidance + Advertising and Marketing + Credit and Finance + Privacy and Security + By Industry + For Small Businesses + Browse Business Guidance Resources + Business Blog Servicemembers: Your tool for financial readiness Visit militaryconsumer.gov Get consumer protection basics, plain and simple Visit consumer.gov Learn how the FTC protects free enterprise and consumers Visit Competition Counts Looking for competition guidance? Competition Guidance * Show/hide News and Events menu items News and Events Latest News Press Release FTC Approves Final Order Requiring Michigan-Based Security Companies to Drop Noncompete Restrictions That They Imposed on Workers March 8, 2023 View News and Events Upcoming Event Mar08 FTC and Texas Senior Medicare Patrol webinar about fraud - NCPW 2023 Wednesday, March 8, 2023 | 10:00AM - 1:00PM View more Events Sections + News + Events + Features + Topics + Data and Visualizations + Stay Connected Sign up for the latest news Follow us on social media Feature Computer-generated illustration of gray and red coronavirus cell on solid black background Coronavirus Scams Spot the latest COVID scams, get compliance guidance, and stay up to date on FTC actions during the pandemic. Latest Data Visualization COVID-19 Visualization Map Daily COVID-19 Complaint Data Use our visualizations to explore scam and fraud trends in your state based on reports from consumers like you. * Show/hide About the FTC menu items About the FTC Our mission is protecting consumers and competition by preventing anticompetitive, deceptive, and unfair business practices through law enforcement, advocacy, and education without unduly burdening legitimate business activity. Learn more about the FTC Sections + Mission + History + Commissioners and Staff + Bureaus and Offices + Budget and Strategy + Office of Inspector General + Careers at the FTC + Contact Featured Lina M. Khan Meet the Chair Lina M. Khan was sworn in as Chair of the Federal Trade Commission on June 15, 2021. Chair Lina M. Khan * Search Show/hide Search menu items Enter Search Term(s): [ ][Search] Looking for legal documents or records? Search the Legal Library instead. Translation Menu * Espanol Secondary Menu * Report Fraud * Sign Up for Consumer Alerts * Search the Legal Library * Enforcement Show/hide Enforcement menu items + Cases and Proceedings + Premerger Notification Program + Merger Review + Anticompetitive Practices + Rulemaking + Statutes + Competition and Consumer Protection Guidance Documents + Warning Letters + Consumer Sentinel Network + Criminal Liaison Unit + Recent FTC Cases Resulting in Refunds + Notices of Penalty Offenses + Competition Matters Blog * Policy Show/hide Policy menu items + Advocacy and Research + Advisory Opinions + Cooperation Agreements + Federal Register Notices + Reports + Public Comments + Studies + Testimony + Policy Statements + International * Advice and Guidance Show/hide Advice and Guidance menu items + Consumer Advice + Military Consumer + Consumer.gov + Business Guidance + Competition Guidance + Bulk Publications * News and Events Show/hide News and Events menu items + News + Events + Features + Topics + Data and Visualizations + Stay Connected * About the FTC Show/hide About the FTC menu items + Mission + History + Commissioners and Staff + Bureaus and Offices + Budget and Strategy + Office of Inspector General + Careers at the FTC + Contact Enter Search Term(s): [ ][Search] Looking for legal documents or records? Search the Legal Library instead. Breadcrumb 1. Home 2. News and Events 3. News 4. Press Releases For Release FTC Enforcement Action to Bar GoodRx from Sharing Consumers' Sensitive Health Info for Advertising Under proposed order, GoodRx will pay a $1.5 million civil penalty for failing to report its unauthorized disclosure of consumer health data to Facebook, Google, and other companies February 1, 2023 Tags: * Consumer Protection * Regional Offices * Bureau of Consumer Protection * Western Region San Francisco * Health * Advertising and Marketing * Online Advertising and Marketing * Privacy and Security * Consumer Privacy * Health Privacy The Federal Trade Commission has taken enforcement action for the first time under its Health Breach Notification Rule against the telehealth and prescription drug discount provider GoodRx Holdings Inc., for failing to notify consumers and others of its unauthorized disclosures of consumers' personal health information to Facebook, Google, and other companies. In a first-of-its-kind proposed order, filed by the Department of Justice on behalf of the FTC, GoodRx will be prohibited from sharing user health data with applicable third parties for advertising purposes, and has agreed to pay a $1.5 million civil penalty for violating the rule. The proposed order must be approved by the federal court to go into effect. "Digital health companies and mobile apps should not cash in on consumers' extremely sensitive and personally identifiable health information," said Samuel Levine, Director of the FTC's Bureau of Consumer Protection. "The FTC is serving notice that it will use all of its legal authority to protect American consumers' sensitive data from misuse and illegal exploitation." California-based GoodRx operates a digital health platform that offers prescription drug discounts, telehealth visits, and other health services. The company collects personal and health information about its users, including information from users themselves and from pharmacy benefit managers confirming when a consumer purchases a medication using a GoodRx coupon. Since January 2017, more than 55 million consumers have visited or used GoodRx's website or mobile apps. According to the FTC's complaint, GoodRx violated the FTC Act by sharing sensitive personal health information for years with advertising companies and platforms--contrary to its privacy promises--and failed to report these unauthorized disclosures as required by the Health Breach Notification Rule. Specifically, the FTC said GoodRx: * Shared Personal Health Information with Facebook, Google, Criteo, and Others: Since at least 2017, GoodRx deceptively promised its users that it would never share personal health information with advertisers or other third parties. GoodRx repeatedly violated this promise by sharing sensitive personal health information--including its users' prescription medications and personal health conditions--with third party advertising companies and advertising platforms like Facebook, Google, and Criteo, and other third parties like Branch and Twilio. * Used Personal Health Information to Target its Users with Ads: GoodRx monetized its users' personal health information, and used data it shared with Facebook to target GoodRx's own users with personalized health- and medication-specific advertisements on Facebook and Instagram. For example, in August 2019, GoodRx compiled lists of its users who had purchased particular medications such as those used to treat heart disease and blood pressure, and uploaded their email addresses, phone numbers, and mobile advertising IDs to Facebook so it could identify their profiles. GoodRx then used that information to target these users with health-related advertisements. * Failed to Limit Third-Party Use of Personal Health Information: GoodRx allowed third parties it shared data with to use that information for their own internal purposes, including for research and development or to improve advertising. It also falsely claimed that it complied with the Digital Advertising Alliance principles, which require companies to get consent before using health information for advertising. * Misrepresented its HIPAA Compliance: GoodRx displayed a seal at the bottom of its telehealth services homepage falsely suggesting to consumers that it complied with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), a law that sets forth privacy and information security protections for health data. * Failed to Implement Policies to Protect Personal Health Information: GoodRx failed to maintain sufficient policies or procedures to protect its users' personal health information. Until a consumer watchdog publicly revealed GoodRx's actions in February 2020, GoodRx had no sufficient formal, written, or standard privacy or data sharing policies or compliance programs in place. Health Breach Notification Rule Violation According to the FTC complaint, as a vendor of personal health records, GoodRx is subject to the Health Breach Notification Rule. GoodRx lets users keep track of their personal health information, including to save, track, and receive alerts about their prescriptions, refills, pricing, and medication purchase history. GoodRx violated the Health Breach Notification Rule by failing to notify consumers, the FTC, and the media about the company's unauthorized disclosure of individually identifiable health information to Facebook, Google, Criteo, Branch, and Twilio. The FTC issued a policy statement in September 2021 warning health apps and others that collect or use consumers' health information that they must comply with the Health Breach Notification Rule. More information on compliance and reporting breaches under the Health Breach Notification Rule are available at the FTC's Health Privacy page. Proposed Order In addition to the $1.5 million penalty for violating the rule, the proposed federal court order also prohibits GoodRx from engaging in the deceptive practices outlined in the complaint and requires the company to comply with the Health Breach Notification Rule. To remedy the FTC's numerous allegations, other provisions of the proposed order against GoodRx also: * Prohibit the sharing of health data for ads: GoodRx will be permanently prohibited from disclosing user health information with applicable third parties for advertising purposes. * Require user consent for any other sharing: The company must obtain users' affirmative express consent before disclosing user health information with applicable third parties for other purposes. The order requires the company to clearly and conspicuously detail the categories of health information that it will disclose to third parties and prohibits the company from using manipulative designs, known as dark patterns, to obtain users' consent to share the information. * Require company to seek deletion of data: The company must direct third parties to delete the consumer health data that was shared with them and inform consumers about the breaches and the FTC's enforcement action against the company. * Limit Retention of Data: GoodRx will be required to limit how long it can retain personal and health information according to a data retention schedule. It also must publicly post a retention schedule, and detail the information it collects and why such data collection is necessary. * Implement Mandated Privacy Program: It must put in place a comprehensive privacy program that includes strong safeguards to protect consumer data. The Commission voted 4-0 to refer the complaint and stipulated final order to the Department of Justice for filing. Commissioner Christine S. Wilson issued a concurring statement. The DOJ filed the complaint and stipulated order in the U.S. District Court for the Northern District of California. NOTE: The Commission authorizes the filing of a complaint when it has "reason to believe" that the named defendant is violating or is about to violate the law and it appears to the Commission that a proceeding is in the public interest. Stipulated final orders have the force of law when approved and signed by the District Court judge. The lead staff attorney on the GoodRx matter was Ronnie Solomon of the FTC's Bureau of Consumer Protection. The Federal Trade Commission works to promote competition and protect and educate consumers. Learn more about consumer topics at consumer.ftc.gov, or report fraud, scams, and bad business practices at ReportFraud.ftc.gov. Follow the FTC on social media, read consumer alerts and the business blog, and sign up to get the latest FTC news and alerts. Contact Information Contact for Consumers FTC Consumer Response Center 877-382-4357 https://reportfraud.ftc.gov Media Contact Juliana Gruenwald Henderson Office of Public Affairs 202-326-2924 Related Cases GoodRx Holdings, Inc. Related actions GoodRx Concurring Statement of Commissioner Christine Wilson For Consumers Blog: GoodRx's not-so-good privacy practices come to light For Businesses Blog: First FTC Health Breach Notification Rule case addresses GoodRx's not-so-good privacy practices Health Breach Notification Rule Health Privacy Topics Protecting Consumers Privacy and Security Enforcement Return to top Menu Secondary Menu * Report Fraud * Sign Up for Consumer Alerts * Search the Legal Library Main navigation * Enforcement + Cases and Proceedings + Premerger Notification Program + Merger Review + Anticompetitive Practices + Rulemaking + Statutes + Competition and Consumer Protection Guidance Documents + Warning Letters + Consumer Sentinel Network + Criminal Liaison Unit + Recent FTC Cases Resulting in Refunds + Notices of Penalty Offenses + Competition Matters Blog * Policy + Advocacy and Research + Advisory Opinions + Cooperation Agreements + Federal Register Notices + Reports + Public Comments + Studies + Testimony + Policy Statements + International * Advice and Guidance + Consumer Advice + Military Consumer + Consumer.gov + Business Guidance + Competition Guidance + Bulk Publications * News and Events + News + Events + Features + Topics + Data and Visualizations + Stay Connected * About the FTC + Mission + History + Commissioners and Staff + Bureaus and Offices + Budget and Strategy + Office of Inspector General + Careers at the FTC + Contact Footer * Privacy Policy * Policy and Notices * FOIA * No FEAR Act * Office of Inspector General * USA.gov