GoodRx is a publicly traded (NASDAQ: GDRX) digital health platform, GoodRx Holdings, Inc., offering prescription discount coupons and telehealth services; its privacy policy (updated July 24, 2026) collects identifiers, commercial information, and prescription/pharmacy/insurance/healthcare-provider data tied to a user's identity. In February 2023 the FTC brought its first-ever Health Breach Notification Rule enforcement action against GoodRx, finding it had shared users' sensitive health and prescription information with Facebook, Google, Criteo, Branch, and Twilio for years despite promising never to share such data, and had used uploaded user lists to target its own customers with medication-specific Facebook ads; GoodRx paid a $1.5 million civil penalty and is now bound by an ongoing FTC Order the company discloses as an ongoing compliance obligation in its SEC filings. Corporate control is concentrated: per its most recent 10-K, parties to GoodRx's stockholders agreement - including Silver Lake, Francisco Partners, and Idea Men, LLC - hold roughly 93.8% of combined voting power through super-voting Class B shares. The company's own privacy policy today still self-declares certain advertising-related data disclosures as a potential CCPA "sale"/"targeted advertising" and requires an opt-out.
TRACK RECORD
1 ENFORCEMENT ACTION
[2023-02-01]
The FTC announced on February 1, 2023 that under a proposed order 'GoodRx will pay a $1.5 million civil penalty' for 'failing to report its unauthorized disclosure of consumer health data to Facebook, Google, and other companies,' marking the first-ever enforcement action under the FTC's Health Breach Notification Rule and barring GoodRx from sharing user health data with third parties for advertising going forward.
The FTC's February 2023 press release states GoodRx 'collects personal and health information about its users, including information from users themselves and from pharmacy benefit managers confirming when a consumer purchases a medication using a GoodRx coupon,' meaning GoodRx obtains identity-linked confirmation of actual medication purchases, not just self-reported data.
GoodRx Holdings, Inc.'s 10-K (filed February 26, 2026, for fiscal year 2025) discloses that parties to its stockholders agreement - including Silver Lake, Francisco Partners, and Idea Men, LLC - 'own approximately 93.8% of the combined voting power of our Class A and Class B common stock as of December 31, 2025,' via 10-votes-per-share Class B stock, and that the company has agreed to board nomination rights for those three holders.
The FTC found that 'Since at least 2017, GoodRx deceptively promised its users that it would never share personal health information with advertisers or other third parties,' then 'repeatedly violated this promise by sharing sensitive personal health information - including its users' prescription medications and personal health conditions - with third party advertising companies and advertising platforms like Facebook, Google, and Criteo, and other third parties like Branch and Twilio.'
As of 2026-08-17, GoodRx's own ads.txt file at www.goodrx.com authorizes 12 advertising system domain(s) to sell its ad inventory (10 DIRECT and 8 RESELLER entries), including google.com, appnexus.com, contextweb.com, ad-generation.jp, adtech.com, aps.amazon.com, districtm.io, doceree.com.
The FTC announced on February 1, 2023 that under a proposed order 'GoodRx will pay a $1.5 million civil penalty' for 'failing to report its unauthorized disclosure of consumer health data to Facebook, Google, and other companies,' marking the first-ever enforcement action under the FTC's Health Breach Notification Rule and barring GoodRx from sharing user health data with third parties for advertising going forward.
GoodRx's 10-K (filed February 26, 2026) confirms the enforcement action remains an active, disclosed obligation: 'We are also subject to a negotiated settlement with the Federal Trade Commission (the "FTC," and such settlement, the "FTC Order") which includes, among other things, agreements to effect or maintain, as applicable, certain changes to our business practices, policies, and compliance requirements.'
GoodRx's Apple App Store privacy label discloses that data including Health & Fitness, Location, Search History, Browsing History, and Identifiers may be collected and linked to a user's identity and used for 'Third-Party Advertising' and 'Developer's Advertising or Marketing' purposes.
The FTC complaint details GoodRx's ad-matching mechanism: in August 2019 'GoodRx compiled lists of its users who had purchased particular medications such as those used to treat heart disease and blood pressure, and uploaded their email addresses, phone numbers, and mobile advertising IDs to Facebook so it could identify their profiles,' then used that match to target the same users with health-specific ads.