FTC fines GoodRx $1.5M for sharing sensitive health data with Facebook, Google & others

The Federal Trade Commission on Wednesday announced that GoodRx, a drug discount app, has agreed to pay a $1.5 million civil penalty for allegedly failing to report unauthorized disclosure of consumer health data to Facebook, Google, and other third-party digital companies such as Criteo, Branch, and Twilio. It was the first such enforcement action taken under the FTC’s Health Breach Notification Rule.

As part of the settlement, the telehealth and prescription drug provider also will be prohibited from sharing user health data with applicable third parties for advertising purposes. That  proposed order, filed by the Department of Justice on the FTC’s behalf, must be approved by the federal court before it takes effect.

California-based GoodRx operates a digital health platform that offers prescription drug discounts, telehealth visits, and other health services for about 55 million users. The company collects personal and health information about its users, including information from users themselves and from pharmacy benefits managers confirming when a consumer purchases a medication using a GoodRx coupon. The FTC says information GoodRx shared with third parties for advertising purposes included users’ prescription medications and personal health conditions.