GoodRx

Is GoodRx safe?

GoodRx is safe in the sense that matters to most people: the discount codes work at the counter and we found no breach of its systems. The concern is privacy. The US Federal Trade Commission said that from at least 2017 to 2020 GoodRx shared users' medications and health conditions with Facebook, Google and other firms, and used some of that data to target health ads on Facebook and Instagram. In 2023 a court ordered GoodRx to pay a $1.5 million penalty and banned it for good from using health data for advertising. We score it 60/100, below BetterHelp at 64, mainly because its app labels still show wide use of personal data for marketing.

What did GoodRx share with Facebook and Google?

GoodRx shows discount prices for prescriptions and offers telehealth visits, so it knows what drugs people look up and buy. According to the FTC's February 2023 complaint, it passed that knowledge to Facebook, Google, the ad firm Criteo, the marketing firm Branch and the messaging firm Twilio. In one case from August 2019, GoodRx put together lists of users who had bought heart disease and blood pressure medicines, uploaded them to Facebook and showed those people health ads on Facebook and Instagram. Some uploads included email addresses, phone numbers and mobile advertising IDs.

GoodRx's privacy policy had promised the opposite. It also showed a seal on its telehealth page that wrongly suggested it followed HIPAA, the FTC said. The sharing came to light in February 2020, when a consumer watchdog published it.

The FTC order and the penalty

This was the first case brought under the FTC's Health Breach Notification Rule, which covers health apps outside HIPAA. In the FTC's reading, sending health data to advertisers without permission counted as a breach, and GoodRx never told users, the FTC or the media. The Justice Department filed the case for the FTC in federal court in San Francisco, and the court entered the agreed order on 17 February 2023.

The order fines GoodRx $1.5 million. It also bans it permanently from sharing health information for advertising, requires express consent before any other sharing, bans tricks to obtain that consent and made it ask Facebook, Google and the others to delete what they received. GoodRx has to keep a privacy programme and limit how long it holds data, under a retention schedule it must publish. GoodRx agreed to the order without admitting the allegations.

The $32 million class action

Five class actions filed in early 2023 against GoodRx, Google, Meta and Criteo were combined in federal court in San Francisco. GoodRx agreed a $25 million settlement in November 2024, after an earlier $13 million deal in Florida fell apart. The judge turned down preliminary approval twice, in June 2025 and January 2026, asking for more information. A new $32 million version that also covers Criteo was filed in June 2026 and won preliminary approval on 8 September 2026, for people who used GoodRx before 20 April 2024. GoodRx has also set aside $5.5 million for indemnity claims from the other companies named in the suits, according to its August 2026 quarterly report. Google and Meta are not part of the deal and are still fighting the case. The claims in the suits are allegations; GoodRx has not admitted them.

What the app collects now

The labels on both app stores describe a business that still leans on marketing data. Apple's label lists purchase history, coarse location, browsing history, identifiers and in-app activity as linked to you and used for third-party advertising, and health data, precise location and search history as used for GoodRx's own marketing. Apple's listing has no "Data Used to Track You" section. On Google Play, GoodRx says it shares your name, email address, postal address, phone number, device IDs, in-app search history and purchase history with other companies for advertising or marketing, while health information is collected for analytics and not shared.

Neither label proves that medication data reaches ad platforms today, and the 2023 order forbids it. But a list of drugs you searched for is sensitive by itself, and the labels leave plenty of room for marketing use of the data around it.

The privacy policy, last updated on 18 September 2026 and shown only to visitors in the US, points the same way. It lists advertising networks, ad servers and advertisers among the companies that receive data, names analytics and tracking tools from Google, Facebook and Salesforce, and also lists pharmacies, drug makers and insurers. You can opt out of "sales" and targeted advertising through the "Your Privacy Choices" link at the foot of the site and manage ad cookies separately, but that sharing is on until you do. GoodRx honours the Global Privacy Control signal only as its California notice describes and ignores Do Not Track. Deletion is open to users nationwide through a web form that verifies your identity. The policy links a separate consumer health data notice, which we did not review.

On security, GoodRx runs a public bug bounty with cash rewards on HackerOne, and Google Play says data is encrypted in transit. We found no breach on record.

How to use GoodRx more safely

1. You do not need an account to see a price or show a code at the pharmacy. Use GoodRx without signing in if you only need a one-off discount.
2. Tap "Ask App Not to Track" on iPhone, refuse marketing emails and texts, and use "Your Privacy Choices" on goodrx.com to opt out of sales and targeted ads.
3. Turn off precise location and type in a ZIP code instead.
4. Compare the GoodRx price with your insurance copay, and ask the pharmacist whether a discount-code purchase counts towards your deductible.
5. If you stop using it, send GoodRx's deletion form rather than just removing the app.

How we scored it

Scams and harmful content (80) is the strongest factor, since there is no contact between users. Privacy (45) is the weakest: the FTC found years of sharing medication data with ad platforms, and both store labels still show broad use of contact details, location and purchase history for marketing. The regulatory record (56) reflects the $1.5 million penalty and the permanent federal court order.