Santa Monica-based prescription drug savings platform GoodRx Holdings Inc. last week agreed to pay a $1.5 million fine to settle federal allegations that it shared customer information with third-party advertisers.
In agreeing to pay the fine, GoodRx said in a statement that it had addressed the issue of sharing of customer data three years ago and admitted no wrongdoing. The company said that it was only paying the fine to avoid a costly litigation process.
GoodRx operates a digital platform that allows customers to comparison price shop for prescription drugs and offers prescription drug discounts with more than 70,000 participating pharmacies nationwide. The company also has platforms for telehealth visits, disease and health condition treatment information and other health services.
The allegations were contained in a lawsuit filed in Northern California federal district court by the Department of Justice on behalf of the Federal Trade Commission; the filing was made public on Feb. 1.
In the filing, the commission argued that GoodRx violated its privacy policies and shared medical and prescription drug data of its customers with advertiser platforms – including Facebook, Google and Criteo – going back to at least 2017.
The FTC also alleged GoodRx failed to disclose this sharing of data to its customers, violating the commission’s Health Breach Notification Rule. The commission noted that this represented the first prosecution under the 2009 rule.
The filing contained an order that requires GoodRx to cease sharing disclosing customer health information with certain third-party platforms and requiring customer consent for sharing of data with any other third parties.
“Digital health companies and mobile apps should not cash in on consumers’ extremely sensitive and personally identifiable health information,” Samuel Levine, director of the FTC’s Bureau of Consumer Protection, said in a press release accompanying the filing. “The FTC is serving notice that it will use all of its legal authority to protect American consumers’ sensitive data from misuse and illegal exploitation.”
In a lengthy response posted to its website, GoodRx contested the allegations. Its main contention was that the sharing of customer data was an old issue that it resolved in 2020, before the FTC inquiry began.
“We proactively made updates consistent with our commitment to being at the forefront of safeguarding users’ privacy,” GoodRx said in the response. “While we had used vendor technologies to advertise in a way that we believe was compliant with all applicable regulations and that remains common practice among many health, consumer and government websites…(W)e also added a number of new, industry-leading ways for consumers to protect their privacy, including an option to request the deletion of personal data.”
GoodRx went further, criticizing the FTC’s use of the Health Breach Notification Rule in this instance.
“We believe this is a novel application of the Health Breach Notification Rule by the FTC,” the company stated. “We used Facebook tracking pixels to advertise in a way that we feel was compliant with regulations and that remains common practice for many websites. We do not agree with the assertion that this was a violation of the HBNR.”
Finally, GoodRx noted that it had already taken the steps required in the order.
“We believe that the requirements detailed in the settlement will have no material impact on our business or on our current or future operations,” the company said.
Investors initially seemed to agree with this assessment; they shrugged off news of the $1.5 million settlement and sent shares up nearly 6% on Feb. 1 to close at $5.91.
