If you searched for medications, browsed vaccine information, or shopped for health products on CVS's website or mobile app before July 27, 2026, you may be entitled to a small cash payout under a $20.5 million class action settlement awaiting final approval. The deal resolves claims that the pharmacy giant let a third-party advertising firm secretly collect and use sensitive customer data without consent.
The lawsuit, Brewer, et al. v. CVS Pharmacy, Inc. and Criteo Corp., was filed in the Circuit Court of the 17th Judicial Circuit in Broward County, Florida, and assigned to Judge Shari A. Olefson, according to Settlement Insight. Four named plaintiffs brought the case on behalf of digital platform users, and as Cleveland.com reports, the suit accused CVS of transferring customers' personal data collected on CVS websites and its app to advertising company Criteo. Before the case ever reached a public docket, plaintiffs' counsel had already contacted CVS and Criteo, and the two sides participated in private mediation on March 17, 2026, before JAMS mediator Robert A. Meyer, then continued negotiating for several weeks before reaching settlement terms, per the same account from Settlement Insight.
What the Lawsuit Alleged
According to Data Breach Today, the complaint claimed third-party ad-tracking code embedded on CVS platforms intercepted and transmitted sensitive user data — including prescription details, immunization information, and searches for health products — to Criteo without user consent. The lawsuit alleged violations of the federal Electronic Communications Privacy Act as well as state privacy statutes, the outlet reported. CVS has denied any wrongdoing, per Cleveland.com's reporting.
CVS is a health solutions company with more than 36 million customers, per Settlement Insight's reporting.
How Much Money Is Actually on the Table
Despite the headline $20.5 million figure, the settlement is structured as a maximum cash payment ceiling rather than a guaranteed payout pool, according to Settlement Insight. Class counsel may request up to 37.5 percent of that total — roughly $7.69 million — for fees. Administration costs and service awards are also included within the $20.5 million ceiling, with any unclaimed funds reverting back to CVS and Criteo rather than boosting individual payments, the outlet's report states.
Eligible users include people who used the CVS website, the CVS Health website, or the CVS mobile app before July 27, 2026, per Cleveland.com. Claimants without documentation could receive $5, while those who submit valid proof — such as browser search history, dated screenshots, or email receipts for online CVS purchases — could receive up to $10, Cleveland.com reports. Claim Depot warns that the settlement restricts cash recoveries to one claim per household, regardless of how many people at that address used CVS's digital platforms, meaning multiple claims from the same home risk rejection.
Key Dates and How Payments Will Arrive
Claims must be submitted by November 16, 2026, according to Cleveland.com, and FOX 9 reports that class members who wish to object must do so by November 1. Judge Olefson has scheduled a final approval hearing for December 1, 2026, with approved claim distributions planned for 120 days after final approval and the resolution of any potential appeals, per Claim Depot. Payments will be sent via PayPal, Venmo, or Zelle, according to Cleveland.com's reporting. Questions can be directed to the CVS Digital Privacy Settlement administrator by mail at P.O. Box 1110, Costa Mesa, CA 92628, by email at [email protected], or by phone at (888) 654-1271, Cleveland.com reports.
Privacy Claims in the CVS Lawsuit
The CVS complaint alleged violations of the Electronic Communications Privacy Act and state privacy statutes.
For CVS customers, the more immediate concern is simpler: file a claim before the November 16 deadline, or risk missing out on the payout entirely.
