GoodRx and Criteo are seeking final approval of a revised $32 million settlement over allegations that tracking tools shared users’ personal and health information with advertisers. The proposed deal follows a judge’s rejection of an earlier $25 million agreement as inadequate. It covers roughly 54.8 million people whose information was allegedly shared through tracking tools on GoodRx’s website and app, according to court filings.
GoodRx operates a free prescription-price comparison and medication-discount service. Plaintiffs allege that tracking technologies on its website and app—including the Meta Pixel, Google Analytics and Criteo One Tag—sent information about users’ interactions to Meta, Google and Criteo for advertising without consent, according to a legal analysis from Constangy. Criteo provides digital advertising services. GoodRx denies wrongdoing and liability; the settlement agreement says the deal is not an admission of fault.
A Rejected First Attempt
The revised agreement comes after the court rejected an earlier proposal. GoodRx and Criteo had agreed to a $25 million settlement in November 2024, but the court denied preliminary approval at a June 13, 2025, hearing. In a January 16, 2026, order addressing the second, $32 million proposal, U.S. District Judge Araceli Martínez-Olguín said plaintiffs had not provided a claim-by-claim analysis that would allow the court to evaluate the deal’s fairness, and noted that the record identified no confirmatory discovery used to assess the claims. The proposal also sought a broad release from class members.
The parties later increased the proposed fund by $7 million, to $32 million, according to MLex. The deal would resolve claims against GoodRx and Criteo, not those against co-defendants Meta and Google, whose claims continue separately, according to Open Class Actions.
Preliminary Approval and Deadlines
Open Class Actions reported that Judge Martínez-Olguín granted preliminary approval on September 8, 2026; it also reported that the settlement website was live by October 23, 2026.
The reported deadlines and hearing date are the same in those accounts. Class members who want to submit a claim, exclude themselves or object must do so by December 29, 2026. A final approval hearing is scheduled for February 11, 2027, at 11:00 a.m. in Oakland. The agreement also allows GoodRx and Criteo to cancel the deal if opt-outs exceed an agreed threshold.
How the Litigation Got Here
The consolidated case, Doe et al. v. GoodRx Holdings, Inc., et al., is before the U.S. District Court for the Northern District of California’s Oakland Division. The first putative class action was filed on February 2, 2023; later suits naming GoodRx, Criteo, Meta and Google were consolidated. The claims include negligence, intrusion upon seclusion and unjust enrichment, as well as alleged violations of California’s Confidentiality of Medical Information Act, Invasion of Privacy Act, Consumers Legal Remedies Act and Unfair Competition Law, and New York and Illinois consumer protection statutes, according to The HIPAA Journal. Plaintiffs allege that tracking tools disclosed identifying and sensitive health information without users’ knowledge or consent, despite GoodRx website statements that it would not give advertisers or other third parties information revealing a personal health condition and that personal information would not be disclosed to third parties between October 2017 and March 2019.
Meta, Google and Criteo are separately seeking dismissal of the claims against them. If the GoodRx-Criteo agreement receives final approval, plaintiffs may continue pursuing claims against Meta and Google outside the settlement. GoodRx has denied wrongdoing and said it believed its use of advertising tools complied with regulations.
A Separate $1.5 Million FTC Settlement
The private lawsuit is separate from an earlier Federal Trade Commission action. GoodRx agreed to pay $1.5 million to resolve the FTC investigation, according to Law360. The agency alleged that GoodRx violated the FTC Act and the Health Breach Notification Rule by disclosing users’ personal and health information to advertising platforms, according to the FTC case summary. The agreement required GoodRx to stop sharing users’ health information with third parties for advertising and to obtain consent before sharing data for non-advertising purposes. GoodRx disputed the FTC’s allegations and said the issue had been addressed nearly three years before the investigation began.
How Federal Health-Privacy Rules Apply
The FTC says its Health Breach Notification Rule provides accountability for certain entities outside HIPAA coverage that handle sensitive health information. That rule is a regulatory framework distinct from this private settlement, according to the Federal Trade Commission. For tracking tools, HHS’s Office for Civil Rights says its online tracking technologies bulletin was updated on March 18, 2024, and addresses how HIPAA-regulated entities must comply with HIPAA Rules. It says those entities may use tracking technologies provided they meet those obligations—a distinct setting from the claims in this lawsuit involving a consumer-facing service, according to HHS’s Office for Civil Rights.
What Happens To The Money
If the $32 million agreement receives final approval, the fund would first pay attorneys’ fees and expenses, notification and administration costs, account costs and service awards for class representatives. The remaining money would be distributed pro rata among people with valid claims. Plaintiffs’ attorneys are seeking fees of up to one-third of the fund—roughly $10.67 million—plus reasonable litigation expenses, according to the settlement agreement. The February 2027 hearing in Oakland is the next major checkpoint.
