Exposed: GoodRx

GoodRx operates a prescription drug discount platform used by millions of Americans to find lower prices on medications. The company was fined by the FTC in February 2023 for sharing users personal health data, including specific medications and health conditions, with advertising platforms including Facebook, Google, and Twilio after prominently promising that it would never sell personal health information. The FTC alleged that GoodRx shared prescription medication data and associated health conditions to target users with personalized advertising, meaning that someone filling a prescription for HIV medication, antidepressants, or erectile dysfunction drugs may have had their medication data transmitted to advertising platforms for targeting purposes. GoodRx used Meta Pixel, Google Analytics, and other tracking technologies to transmit health data directly from its website and app to advertising companies. The company built custom Facebook advertising audiences using lists of users who had searched for or purchased specific medications, creating pharmaceutical targeting segments based on sensitive health conditions. This was particularly egregious because GoodRx users typically seek discount prescriptions precisely because they cannot afford standard healthcare, making them a vulnerable population whose financial desperation was exploited for advertising revenue. The FTC order was the first enforcement action under the Health Breach Notification Rule against a digital health company, establishing important precedent for health data privacy outside of HIPAA-covered entities.