Run a free scan

GoodRx: keep drug names and conditions out of ad pixel events

If a page is about a medicine or a condition, the event your ad pixel sends can be health data. The GoodRx case shows how custom event names, URLs and audience uploads turned a prescription-coupon site into a source of health data for advertising platforms, and why the FTC treated that as a breach that needed notices.

US District Court, N.D. Cal. (DOJ for the FTC) · FTC Act Section 5 and Health Breach Notification Rule · Stipulated order entered 17 February 2023

The problem

People used GoodRx to look up drug prices, get coupons and book HeyDoctor telehealth visits. The government alleged that from 2017 GoodRx sent the drug a person looked at, the related condition and their identifiers to Facebook, Google and Criteo, and used that data to target them with ads on Facebook and Instagram, while its privacy policy said it would never share health information with advertisers (Complaint ¶¶ 3–6, 27, 38). These are allegations. GoodRx neither admitted nor denied them (Order, Findings ¶ 3).

Case record

Court
US District Court, Northern District of California
Case number
3:23-cv-00460-DMR
Parties
United States (for the FTC) v. GoodRx Holdings, Inc.
Counsel
DOJ and US Attorney, N.D. Cal., with FTC staff ([DOJ release](https://www.justice.gov/archives/opa/pr/digital-healthcare-platform-ordered-pay-civil-penalties-and-take-corrective-action)); defence: not stated in the cited record
Laws
FTC Act Section 5; Health Breach Notification Rule, 16 C.F.R. Part 318
Stage
Stipulated order entered 17 February 2023 ([DOJ release](https://www.justice.gov/archives/opa/pr/digital-healthcare-platform-ordered-pay-civil-penalties-and-take-corrective-action))
Amount
USD 1,500,000 civil penalty ([Order § XII](https://www.ftc.gov/system/files/ftc_gov/pdf/goodrx_stipulated_order_for_permanent_injunction_civil_penalty_judgment_and_other_relief.pdf))
Source review
17 October 2026

What the regulator alleged

What the regulator alleged
CountWhat the law requiresFacts allegedResult
I–V: deception (FTC Act § 5(a))No false or misleading claimsPolicy promised never to give advertisers information revealing "a personal health condition"; GoodRx shared drug and contact data with ad platforms, let them reuse it, claimed to follow Digital Advertising Alliance principles and showed a "HIPAA Secure" seal while not a HIPAA-covered entity ([¶¶ 27, 31, 37, 52, 82–101](https://www.ftc.gov/system/files/ftc_gov/pdf/goodrx_complaint_for_permanent_injunction_civil_penalties_and_other_relief.pdf))Settled; not adjudicated
VI–VII: unfairness (§ 5(n))No practices causing substantial, unavoidable injuryNo policies to stop health-data disclosure; disclosure for ads without notice or affirmative express consent ([¶¶ 102–109](https://www.ftc.gov/system/files/ftc_gov/pdf/goodrx_complaint_for_permanent_injunction_civil_penalties_and_other_relief.pdf))Settled
VIII: Health Breach Notification RuleA vendor of personal health records must notify individuals, the FTC and, above 500 residents of a state, the media after a "breach of security"Disclosures to Facebook and Google were unauthorised acquisitions of more than 500 people's health data; no notices sent ([¶¶ 110–115](https://www.ftc.gov/system/files/ftc_gov/pdf/goodrx_complaint_for_permanent_injunction_civil_penalties_and_other_relief.pdf))Settled; the count carrying the civil penalty

Technical issue

  • Tools or vendors: Facebook pixel and Custom Audiences, a Google pixel and Google SDKs, Criteo, Branch and Twilio (Complaint ¶¶ 4, 39–47).
  • Where: GoodRx and GoodRx Gold drug and coupon pages, HeyDoctor treatment pages such as /services/hyperlipidemia, and the mobile apps (¶¶ 41–46 and n.3).
  • What data: custom events named "Drug Name" and "Drug Category", drug quantity, pharmacy name, city, state and ZIP, page URLs containing drug names, page microdata and IP addresses. From May 2019 the pixel was configured to send name, email, phone and gender; from December 2019 some URLs embedded name, email, date of birth and phone. The Google SDKs sent latitude, longitude and advertising IDs (¶¶ 40–46).
  • Audience uploads: in August 2019 GoodRx uploaded emails, phone numbers and mobile ad IDs of people who had filled prescriptions, in audiences named "lisinopril claims" and "atorvastatin claims" (¶¶ 6, 49, 51).
  • When: routinely from 2017. After GoodRx said it had stopped, the pixel kept sending health data for "several thousand users" who had it cached, until at least November 2020 (¶ 63).
  • How it came to light: a Consumer Reports article on 25 February 2020. The next day the CTO wrote internally: "What we do not have is the data we are sharing by partner along with its business purpose" (¶¶ 55–56).

Inth’s technical interpretation: nobody needed to send a diagnosis. A custom event called "Drug Category" with the value "high cholesterol", sent with an IP address and an email, is a health record in a vendor’s log. The complaint says marketing staff created these events without review (¶ 54): a code-review gap as much as a policy gap. The cached-pixel detail shows that removing a tag from a template does not stop copies already running in browsers.

Illustrative pattern, not the defendant’s code.

// Bad: health context goes to the ad platform as event data
fbq('init', PIXEL_ID, { em: user.email, ph: user.phone });
fbq('trackCustom', 'DrugView', {
  drug_name: coupon.drugName,        // "Lipitor"
  drug_category: coupon.condition,   // "high cholesterol"
  quantity: coupon.quantity,
});

Illustrative pattern, not the defendant’s code. Generic consent check, not a specific c15t API.

// Fixed: no health fields in ad events; ads tag only after a marketing choice
const AD_SAFE_PARAMS = ['page_type']; // reviewed allowlist, no drug or condition
function sendAdEvent(name, params) {
  if (!consent.has('marketing')) return;
  const safe = Object.fromEntries(
    Object.entries(params).filter(([k]) => AD_SAFE_PARAMS.includes(k)));
  fbq('trackCustom', name, safe);
}
sendAdEvent('PageView', { page_type: 'coupon' });

Consent alone would not have been enough here: the order bans disclosure of health information for advertising outright (see below), so the fix is to keep those fields out.

Timeline

Timeline
DateEvent
25 February 2020Consumer Reports article ([¶ 55](https://www.ftc.gov/system/files/ftc_gov/pdf/goodrx_complaint_for_permanent_injunction_civil_penalties_and_other_relief.pdf))
1 February 2023Complaint and proposed order filed ([FTC case page](https://www.ftc.gov/legal-library/browse/cases-proceedings/2023090-goodrx-holdings-inc))
17 February 2023Order entered ([DOJ release](https://www.justice.gov/archives/opa/pr/digital-healthcare-platform-ordered-pay-civil-penalties-and-take-corrective-action))

Outcome

The order, cited by section (stipulated order):

  • § I, permanent ban: no disclosure of health information to third parties for advertising. Advertising measurement (such as conversion reporting) and contextual ads are carved out.
  • § III: other disclosures of health information need affirmative express consent, which a privacy policy, a hover or a manipulative interface cannot supply (Definition A).
  • § IV: notices for any future breach of security, to individuals within 60 days, to the FTC and, above 500 residents of a state, to the media.
  • § V: notice to users who used the sites or apps between July 2017 and April 2020, posted for 180 days.
  • § VI: within 60 days, tell every recipient to delete the data and get written confirmation.
  • §§ VII–VIII: a privacy programme, with independent assessments every two years for 20 years.
  • § XII: USD 1.5 million civil penalty.

The settlement does not establish that GoodRx broke the law. It is the FTC’s first enforcement action under the Health Breach Notification Rule (FTC case page).

What it cost

What it cost
ItemAmount or term
Civil penaltyUSD 1,500,000 ([Order § XII](https://www.ftc.gov/system/files/ftc_gov/pdf/goodrx_stipulated_order_for_permanent_injunction_civil_penalty_judgment_and_other_relief.pdf))
Consumer redressNone ordered
Third-party assessmentsBiennial, for 20 years ([§ VIII](https://www.ftc.gov/system/files/ftc_gov/pdf/goodrx_stipulated_order_for_permanent_injunction_civil_penalty_judgment_and_other_relief.pdf))
Separate private class actionSee [Doe v. GoodRx](/enforcement/goodrx-private-litigation); not part of this order
Defence costsNot stated in the cited record

Why it matters

The penalty was small; the theory was not. The FTC treated an unauthorised disclosure to an ad platform as a "breach of security" under a rule most teams associated with hacks. In April 2024 the FTC amended the rule to say a breach includes "an unauthorized disclosure" and to stress that it covers health apps not covered by HIPAA (FTC release, 26 April 2024). Its definition of affirmative express consent, which excludes manipulative interfaces, reappears in the BetterHelp order.

How Inth catches this

  • Code audit: flags a pull request that adds a custom pixel event, and traces fields such as a drug name or condition from the page template into the Meta Pixel or Google event payload.
  • Website audit: records each request to facebook.com/tr or a Google collection endpoint from coupon and treatment pages, with page, time and consent state.
  • Consent banner: holds the Meta Pixel back until the visitor grants marketing, under an opt-in policy, and loads Google tags with Consent Mode v2 defaults set to denied until the visitor chooses. Under the default California opt-out policy those tags run until the visitor opts out.
  • Evidence: the finding history and runtime observations show when each event was added and what it carried.

Inth has no breach-notification capability: deciding whether a disclosure triggers the Health Breach Notification Rule, and sending notices, is a legal process. Inth also cannot see list uploads made by hand in Ads Manager or what an ad platform does with data after receipt.

Checks for your own systems

In the repository

  • Search for fbq('trackCustom', gtag('event' and SDK logEvent calls and list every parameter they send.
  • Flag parameter names or values that come from drug, condition, test, symptom or treatment fields.
  • Check whether URLs or advanced matching (em, ph) carry drug names, conditions or emails on health pages.

In the browser and network

  • In a clean profile, open a coupon page and a treatment page; filter for facebook.com/tr, /g/collect and criteo.
  • Decode each payload; look for the drug name in cd[...], dl and title fields.
  • Repeat after logging in, and after removing a tag, to catch cached copies still sending.

With the people responsible

  • List every audience upload to an ad platform and what defines the list.
  • Compare vendor terms with your privacy promises: can the vendor use the data for its own purposes?
  • Agree in writing who decides whether a disclosure is a reportable breach.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit GoodRx’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.