GoodRx to be barred from sharing health data for ads under proposed FTC settlement

The Federal Trade Commission proposed to permanently bar prescription drug comparison site GoodRx from sharing users’ health data with third parties for advertising purposes, the agency said Wednesday.

In a “first-of-its-kind proposed order,” the FTC also said it’s imposing a $1.5 million civil penalty for allegedly violating the agency’s Health Breach Notification Rule. Under the settlement, GoodRx is required to limit how long it holds onto personal and health information of users, and to ask third parties to delete consumer health data shared with them.

The FTC alleged that GoodRx shared personal health information, including user prescription medications and personal health conditions, with companies like Facebook, Google, Criteo since at least 2017, despite promises not to provide user data to advertisers or third parties. The agency also claims GoodRx used personal health data to target its users with personalized ads on Facebook and Instagram. For example, according to the FTC, GoodRx in 2019 uploaded to Facebook a list of information from users, who purchased certain medications, in order to target them with ads.

GoodRx said in a press release that it disagrees with the FTC’s allegations and doesn’t admit wrongdoing. It said the settlement allows the company to avoid expensive and time-consuming litigation and that the agreement “will have no material impact on our business.”

“The settlement with the FTC focuses on an old issue that was proactively addressed almost three years ago, before the FTC inquiry began,” GoodRx said, adding that it made updates to safeguard user safety before it was contacted by the agency.

GoodRX shares were up 3.5% on Wednesday to $5.79. The stock has lost more than three-quarters of its value in the past year.

GoodRx said in a blog post that medical records were not shared through its use of the Facebook pixel, the code websites use for advertising. Even so, GoodRx said it “led the industry by removing the standard Facebook Javascript pixel almost three years ago.”

FTC Commissioners voted 4-0 to refer the proposed order to the Department of Justice to file it on the FTC’s behalf.

Subscribe to CNBC on YouTube.

WATCH: The changing face of privacy in the pandemic