GoodRx, a telehealth provider and online platform selling discounted prescription drugs, will pay $1.5 million to settle a Federal Trade Commission complaint that it failed to disclose to consumers it was sharing health data with Facebook, Google, and other ad-targeting companies. The FTC alleged that since at least 2017 GoodRx shared the sensitive health information of millions of consumers — including users’ prescription medications and health conditions — with third-party advertising companies and platforms despite promising users it wouldn’t share such data. Affected users were subsequently targeted by advertisements based on personal health data that they believed remained confidential. The complaint is the first enforcement action the FTC has taken under its Health Breach notification rule, which requires certain entities not covered by HIPAA to notify customers and the FTC if there’s a breach of individually identifiable health information. The FTC voted in September 2021 to clarify that the rule applies to any unauthorized use of data, not just breaches. According to the FTC complaint, GoodRx also exploited sensitive customer information for its own advertising purposes, uploading user information to Facebook for advertising campaigns that targeted users based on specific medications and health conditions. In addition to the $1.5 million penalty, the proposed court order permanently prohibits GoodRx from sharing user health information with third parties for advertising, requires GoodRx to direct third parties to delete health data that was shared with them, and requires the company to limit its data retention and make publicly available details about the information it collects.
12 Essentials for a Successful SOC Partnership
As cyber threats continue to impact businesses of all sizes, the need for round-the-clock security