FTC fines GoodRx $1.5M for sharing health data with advertisers

In February 2023, the FTC announced a $1.5 million penalty against GoodRx, the telehealth and drug-discount platform, in the agency's first enforcement action under the Health Breach Notification Rule. The FTC alleged GoodRx shared users' prescription drug names and personal health conditions with Facebook, Google, and other advertising and analytics companies despite promising it would never share that data, then used the data itself to target its own users with health-related ads. GoodRx also displayed a HIPAA-compliance seal on its site despite not being covered by HIPAA, and failed to notify consumers, the FTC, or the media about the unauthorized disclosures, a reporting duty the FTC said the Health Breach Notification Rule imposed. The order permanently bars GoodRx from sharing health data for advertising, requires affirmative consent for other sharing, and directs it to have third parties delete the data already disclosed.