GoodRx has shared user health data with Facebook and Google, FTC says

Since 2017, more than 55 million people have used or visited the GoodRx mobile apps or website, according to the FTC. From 2017 to 2020, the company shared “extremely intimate and sensitive details” with external ad tech and marketing firms including Facebook, Google, Criteo and Twilio, the complaint says, repeatedly violating its public promises not to do so. The released data, the agency said, could link users to chronic physical and mental health problems, including substance abuse.

GoodRx also didn’t put limits on how Facebook, Google and other companies could use its customers’ health information, federal authorities said, giving the third parties the ability to use the data for internal business purposes like research and product development. Regulators said GoodRx also “failed to maintain adequate” safeguards for users’ personal information, such as: B. Appropriate formal, written privacy and data sharing policies.

The FTC’s case revolves around GoodRx’s use of tracking tools from Facebook, Google and other companies. Millions of websites and apps use such tools – known as “pixels” and “software development kits” – to track and share data about their users’ activity with third parties for business purposes such as ad targeting and user analytics.

Such tracking tools may collect information such as users’ first and last names, email addresses, mobile phone numbers, unique device ID codes, location, gender, and internet protocol or IP addresses. You can also record details about user activities, e.g. For example, opening an app, clicking a link, or viewing information about a specific disease or medication.

While such data sharing is widespread in consumer sectors like retail and travel, the FTC complaint states that GoodRx’s use of tracking tools to share personal health data with advertising platforms resulted in misleading and unauthorized data disclosures — an argument that challenges normal business operations in the digital healthcare industry.

GoodRx said it removed the Facebook tracking pixel almost three years ago.

In recent years, the FTC has intensified its focus on healthcare privacy.

In 2021, the FTC accused the developer of Flo, a health-tracking app used by more than 100 million women, of misleading users about their data-handling practices by sharing intimate health details about their periods and pregnancy with Google and Facebook. Flo agreed to a settlement with the agency that banned the company from deceiving users about privacy and required that they get their consent before sharing their health data.