What GoodRx does with your data
Pharmacy, beauty, specialty retail and restaurants. People use it through a rewards program, app, or connected service.
Data current as of 2026-09-25; statuses change.
- Program or app
- GoodRx app and discount codes (added: pharmacy-adjacent, notably bad)
- Members
- 5.3 million accounts (2025). Monthly Active Consumers, Q4 2025 (unique consumers who used a GoodRx code in a month), down from 6.6M in Q4 2024. FTC says 55M+ consumers visited or used GoodRx since January 2017.
- Retail media
- GoodRx Pharma Direct (formerly pharma manufacturer solutions). Ad revenue $151.38 million (2025), reported
What it collects and does with your data
- 10-K: Pharma Direct revenue rose 41% to $151.4M in 2025 (19% of revenue). This line sells manufacturer programs and advertising to GoodRx users and is not purely ad revenue.
- FTC alleged GoodRx shared users' personal health information with Facebook, Google, and other companies for advertising and failed to report the unauthorized disclosures.
- 10-K states GoodRx remains subject to the FTC order and to state laws including Washington's My Health My Data Act.
Sensitive data
- health/pharmacy (prescriptions, PBM purchase confirmations)
Enforcement and litigation
2 matters in the research. Where the research says alleged, pending, or settled without admitting wrongdoing, so does this page.
- FTC/DOJ action, the first under the Health Breach Notification Rule: $1.5M civil penalty and a ban on sharing health data with third parties for advertising. Settled without admitting wrongdoing. Amount: $1.5 million.
- Doe v. GoodRx Holdings (N.D. Cal., No. 3:23-cv-00501) over sharing health data with Meta, Google, and Criteo. GoodRx agreed to a $25M settlement in November 2024; the court denied preliminary approval on 2025-06-12 and again on 2026-01-16. A revised agreement with Criteo, reported at $32M combined, was preliminarily approved on 2026-09-08 per MLex; the docket shows an order that day, not read. Final approval pending. Meta and Google remain defendants. Amount: $25 million.
Who else holds your data
Organizations holding a copy of your data, as the research counts them: at least 4. Floor: GoodRx, Facebook, Google, Criteo (historical recipients named in enforcement).
Third parties: Named: Facebook, Google, Criteo (historical recipients per FTC and class action). Current GoodRx privacy policy could not be retrieved (bot-blocked); categories not counted.
Data brokers linked to GoodRx
None. The research documents no flow between GoodRx and a data broker.
Data practices score
10 of 12 scored. Five components, each 0 to 3. How the score works
- Sells or shares
- 3
- Enforcement
- 3
- Retail media scale
- 2
- Sensitive data
- 2
- Opt-out friction
- unscored
Estimated emissions for one person
Research gaps
- Current privacy policy not read; opt_out_friction left null, so the total is out of 12.
- Preliminary approval of the class settlement is reported by MLex; the order text was not read. Final approval hearing date not found.
- No email frequency data.
Sources (5)
- https://www.sec.gov/Archives/edgar/data/1809519/000180951926000031/gdrx-20251231.htm 2026-02-26
- https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising 2023-02-01
- https://www.sec.gov/Archives/edgar/data/1809519/000180951926000152/gdrx-20260630.htm 2026-09-08
- https://www.courtlistener.com/docket/66783593/doe-v-goodrx-holdings-inc/
- https://www.mlex.com/mlex/data-privacy-security/articles/2522864
The Sources page lists these with their kind and what else uses them.