A revised $32 million settlement has received first approval from the court to resolve class action data breach litigation against GoodRx and Criteo related to the use of website tracking tools on the GoodRx website that disclosed user information to third parties without consent. GoodRx is a Santa Monica, California-based telehealth company that operates a free-to-use platform that tracks prescription drug prices and offers coupons providing discounts on medications. Criteo is a Paris, France-based digital advertising company that offers AI-driven performance marketing and retargeting solutions.

Both companies agreed to settle a consolidated class action complaint alleging unfair business practices and improper sharing of consumer data with digital advertising and analytics companies between 2017 and 2020. The litigation also named other companies as defendants, which are not included in the settlement agreement. The litigation stems from a Federal Trade Commission (FTC) complaint alleging GoodRx unlawfully disclosed the personal and health information of its users in violation of the FTC Act and the FTC’s Health Breach Notification Rule. GoodRx disagreed with the FTC’s allegations; however, the FTC complaint was resolved with a $1.5 million settlement.

On February 2, 2023, the first putative class action lawsuit was filed, followed by other class action complaints against defendants GoodRx, Criteo, Meta and Google. The lawsuits were consolidated into a single complaint – Doe et al. v. GoodRx Holdings, Inc., et al. – which is pending in the United States District Court for the Northern District of California, Oakland Division.

The consolidated lawsuit asserted claims for negligence, negligence per se, intrusion upon seclusion, unjust enrichment, and violations of the California Confidentiality of Medical Information Act, California Invasion of Privacy Act, California Consumers Legal Remedies Act, California Unfair Competition Law, New York’s General Business Law, and Illinois Consumer Fraud and Deceptive Business Practices Act.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The plaintiffs believe their claims are valid, and the defendants deny the claims in the lawsuit and maintain no laws were violated. After two mediation conferences and subsequent discussions, a settlement was agreed upon that was acceptable to all parties to avoid the cost, distraction, and risks associated with a trial and related appeals. The proposed $25 million settlement was agreed by the plaintiffs and the defendants; however, the settlement was rejected by District Court Judge Araceli Martinez-Olguin, as the parties failed to meet the legal standards for demonstrating that the settlement was fair to consumers.

In response, GoodRx and Criteo agreed to increase the settlement fund by $7 million and formally added Criteo to the settlement agreement. The claims against the other defendants, Meta and Google, are continuing separately. The renegotiated settlement agreement has received preliminary approval from the court. Under the terms of the settlement, GoodRx and Criteo will establish a $32,000,000 settlement fund from which attorneys’ fees and expenses, notification and settlement administration costs, settlement fund account costs, and service awards for the class representatives will be deducted. The remainder of the settlement fund will be paid pro rata to individuals who submit a valid claim. The settlement agreement includes a clause that allows the defendants to cancel the settlement if the number of individuals excluding themselves exceeds an agreed-upon number.

Class members wishing to object to the settlement or opt out must do so by December 29, 2026. Claims must be submitted by the same date, and the final fairness hearing has been scheduled for February 11, 2027.

December 4, 2024: GoodRx Agrees to $25 Million Settlement to Resolve Tracking Technology Lawsuit

GoodRx, a telemedicine platform provider and drug discounter, has agreed to settle a consolidated class action lawsuit for $25 million. The lawsuit was filed in response to its use of website tracking technologies that disclosed website visitor data to third parties such as Meta Platforms, Google, and Criteo for advertising purposes without user consent.

The tracking technologies, also known as pixels, are code snippets that are added to websites to track user interactions. The information gathered on visitors can be used to improve websites and is also transferred to third parties for advertising purposes. The Federal Trade Commission (FTC) investigated GoodRx over the use of tracking tools and determined the FTC Act had been violated. GoodRx had provided repeated assurances to its users that their sensitive data would not be shared with third parties, when the tracking tools on its website shared identifying information, including sensitive health information, with third parties without users’ knowledge or consent. The FTC also alleged a violation of its Health Breach Notification Rule as GoodRx failed to notify users about the data sharing.

GoodRx disagreed with the FTC’s findings, claiming the issue had been addressed almost 3 years before the FTC started investigating and maintains there was no wrongdoing. GoodRx maintains tools were used for advertising purposes in a manner it believed was compliant with all regulations. GoodRx chose to settle the alleged violations with the FTC for $1.5 million rather than fight them in court. The settlement agreement also requires GoodRx to refrain from sharing users’ health information with third parties for advertising purposes and to obtain consent before sharing data for non-advertising purposes.

Shortly after the FTC settlement was announced, a class action lawsuit was filed in the U.S. District Court of the Northern District of California against GoodRx that made similar allegations to the FTC – that personal information was disclosed to third parties without users’ knowledge or consent, when they had been informed on the website – between October 2017 and March 2019- that their personal information would not be disclosed to third parties. Specifically, the plaintiffs claimed that the website stated, “We never provide advertisers or any other third parties with any information that reveals a personal health condition of personal health information.”

The lawsuit asserted claims of common law invasion of privacy, intrusion upon seclusion, unjust enrichment, violations of the California Confidentiality of Medical Information Act (CMIA), aiding and abetting violations of CMIA, violations of the California Invasion of Privacy Act, violations of the California Consumers Legal Remedies Act, and violations of the California Business and Professional Code. Several other lawsuits were filed over the privacy violations, which were consolidated into a single action, – Jane Doe et al. v. GoodRx Holdings, Inc., et al. The consolidated lawsuit also asserts claims of negligence, negligence per se, and violations of New York’s General Business Law and the Illinois Consumer Fraud and Deceptive Business Practices Act.

Meta, Google, and Criteo were also named in the lawsuit as co-defendants, and all three companies are attempting to have the claims against them dismissed. District Court Judge Araceli Martinez-Olguin is due to issue a ruling on the plaintiffs’ motion to approve the $25 million settlement. Should the judge approve the settlement, the plaintiffs will be permitted to continue to pursue claims against the other co-defendants, as they are not part of the proposed settlement.

If approved, individuals whose privacy was violated will be permitted to file claims for a share of the settlement fund, after attorneys’ fees, service awards, and legal costs and expenses have been deducted. The plaintiffs’ attorneys are seeking one-third of the settlement amount – $8.33 million.

Update: The $25 million settlement agreement was rejected by the judge, as both sides failed to adequately demonstrate that the settlement was fair to consumers. There was a lack of claim-by-claim analysis showing the economic value and legal strength of each claim, unjustified financial discounts, missing evidence of confirmatory discovery, and overly broad liability releases.

The post GoodRx & Criteo Revised $32 Million Data Privacy Settlement Gets First Approval appeared first on The HIPAA Journal.

A Ukrainian affiliate of the Nefilim & Hive ransomware operations who attacked hospitals, government entities, and businesses over a three-year period has received a 70-month jail term. Ukrainian national Artem Aleksandrovych Stryzhak, 35, was arrested in Spain in June 2024 and was extradited to the United States on April 30, 2025, to face charges of alleged involvement in the Nefilim and Hive ransomware operations. Co-conspirator, Ukrainian national Volodymyr Tymoshchuk, was also indicted but remains at large. An $11 million reward has been offered by the U.S. Department of State for information that leads to his arrest.

Stryzhak was alleged to have joined the Nefilim ransomware operation as an affiliate in June 2021, and agreed to pay the ransomware operator 20% of any ransom payments he generated in exchange for access to the Nefilim group’s infrastructure and encryptor. Between June 2021 and October 2021, Stryzhak used Nefilim ransomware in multiple attacks on entities in the United States.

Stryzhak was also alleged to have been a member of the Hive ransomware operation between June 2021 and January 2023, and along with his co-conspirators, conducted attacks on hospitals, government entities, and businesses. According to the prosecutors, along with his co-conspirators, Stryzhak deployed Hive ransomware against seven victims, including law firms, a dentist’s office, and a healthcare provider during the COVID-19 pandemic.

Stryzhak pleaded guilty to conspiracy to commit fraud and related activity such as extortion in connection with international ransomware operations and faced up to 10 years in jail. At sentencing in federal court in Brooklyn on October 27, 2026, Stryzhak received a 70-month prison term. “Artem Stryzhak chose to deploy ransomware that extorted money from victims, leaving businesses and individuals facing devastating losses.  His actions serve as a strong reminder of the real-world damage cybercriminals can cause and underscore the FBI’s commitment to stopping these schemes and protecting the public,” stated FBI Assistant Director in Charge Barnacle.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The post Hospital Ransomware Attacker Receives 70 Month Jail Term appeared first on The HIPAA Journal.