FTC finds GoodRx shared sensitive health data with Facebook, Google

Illustration: Gabriella Turrisi/Axios
The FTC on Wednesday filed a court order against GoodRx for failing to notify users that it shared their personal, identifiable health data with Facebook and Google and said it would permanently ban the company from sharing such information for ads, should the court order be federally approved.
Why it matters: The court order is the first FTC action under the Health Breach Notification Rule, which requires companies to notify users when their health data is infringed upon, and includes several safeguards aimed at protecting consumer data.
- “We’re making clear that apps violating this rule need to come clean with consumers when they share sensitive data improperly,” an FTC official said during a press briefing about the order.
- The order must be approved by the federal court to go into effect.
Zoom in: The health data GoodRx shared with tech companies includes individually identifiable data on users’ prescription medications and health conditions. Per the complaint:
- In August 2019, GoodRx compiled lists of users who’d purchased medications for heart disease and high blood pressure and uploaded their email addresses, phone numbers and mobile advertising IDs to Facebook so it could identify their profiles.
- GoodRx then used that information to target users with relevant ads.
Details: The court order, filed by the Department of Justice on behalf of the FTC in California’s Northern District, found GoodRx shared data with companies including Facebook, Google, Criteo, Branch and Twilio. The order found GoodRx:
- Monetized users’ personal health data to target them with health- and medication-specific ads on Facebook and Instagram.
- Let third parties it shared data with use the information for research, development or advertising purposes without getting consent.
- Misrepresented its HIPAA compliance, displaying a seal at the bottom of its telehealth site falsely suggesting it complied with the law.
- Failed to maintain sufficient policies or procedures to protect its users’ personal health information.
State of play: GoodRx, which offers prescription discount coupons and telehealth services, lets users track their personal health data to save, track and get alerts about prescriptions, refills, pricing and medication purchase history.
- Per the complaint, the company collects data from users themselves and from pharmacy benefit managers (PBMs) that confirm when someone buys a prescription drug using one of its coupons.
- Since January 2017, more than 55 million consumers have visited or used GoodRx’s website or mobile apps, the complaint says.
What they’re saying: A spokesperson for GoodRx told Axios the company does not agree with the allegations, saying the order “focuses on an old issue that was proactively addressed almost three years ago.”
- “We admit no wrongdoing,” the spokesperson said. “Entering into the settlement allows us to avoid the time and expense of protracted litigation.”
- “Health data today isn’t just what your doctor keeps in a file behind a desk,” an FTC official said during the briefing. “And the way we’re enforcing this reflects that new reality.”
- “We expect this to have a significant impact on the marketplace,” the official added.
Flashback: The FTC in 2021 issued a warning to health apps and others that collect or use consumers’ health information that they must comply with the Health Breach rule.
- “We are now showing the market that we meant business when we issued that policy statement,” the FTC official said.
What’s next: In addition to charging GoodRx with a $1.5 million civil penalty and banning it from disclosing user health information for ads, the order requires that the company:
- Direct third parties to delete the consumer health data shared with them and inform users about the breaches and the FTC’s enforcement action.
- Get users’ consent before sharing health data with third parties for purposes other than ads and detail the types of health information it will disclose to those parties.
- Limit how long it can retain personal health information.
- Create a privacy program that includes safeguards to protect such data.
Of note: While the order only binds GoodRx, companies including Facebook who received the data “are on notice that they were in receipt of data that was illegally collected,” another FTC official said.
This story has been updated to include the company’s comment.
Stock and Share Market News, Economy and Finance News, Sensex, Nifty, Global Market, NSE, BSE Live IPO News
TechScape: How the world is turning against social media | Technology
Government workers in the UK, US, Canada and European Union (the list will have grown by the time you read this) are banned from installing TikTok on their phones.
On Friday, France joined that list, preventing its civil servants from installing TikTok – and everything else. From the government’s press release (original in French):
After an analysis of the issues, in particular security, the government has decided to ban the downloading and installation of recreational applications on professional telephones provided to public officials from now on.
Recreational applications do not have sufficient levels of cybersecurity and data protection to be deployed on government equipment. This ban applies immediately and uniformly. Exemptions may be granted on an exceptional basis …
From a cybersecurity point of view, there are two reasons to ban TikTok: one is that it gathers a substantial amount of data in its natural course of operation; the other is that it cannot credibly commit to withstanding efforts from the Chinese Communist party to compel Tick tack to promote the party’s interests overseas.
But either of those rationales poses awkward questions for those who would ban TikTok, because the app isn’t unique. Plenty of apps and companies are exposed to China to a greater or lesser extent, and even more harvest vast amounts of personal data. So why focus on just one app?
France, at least, appears to have drawn the same conclusion. If TikTok can’t be safely installed on government devices, then how can anything else?
As with everything related to this spat, there is a geopolitical undercurrent: France gets to follow the international crowd, but bloody America’s nose in the process, highlighting the similarities between the data harvesting of TikTok and Facebook and declaring that neither of them is appropriate for a government device.
A world without TikTok?
In the short term, it’s hard not to feel as if everything is falling in Facebook’s favour. Sure, the company loses access to a few French civil servants, but everyone knows the real target here, and the further the bans spread, the more chance that the real ban-hammer drops, and TikTok faces general suppression.
Analysts at Wedbush Securities said on Sunday that such a ban was a matter of “when, not if”, “with the odds of a ban 90%+ in our opinion. We believe now it’s just a matter of time until CFIUS [the Committee on Foreign Investment in the United States] formally comes out with its recommendations for a US ban.” The legal wrangling would be tricky but the US, at least, probably has the power to do so, with TikTok’s status as a foreign-owned company enabling the government to invoke powers designed to protect national security.
TikTok could stave off a total ban if it secured its independence from Chinese-owned ByteDance, or if it was sold to another – American – owner, but the odds of that happening seem slim. “Project Texas”, an engineering effort to isolate American user data in servers controlled by Oracle, looks to be as big a concession the company was willing to make there, and it’s failed to convince those pushing for a ban.
So what would happen next? It’s hard to say: some of the fallout would depend on TikTok’s own actions. Any technical enforcement of the ban would likely be at the App Store level, as Google and Apple would be compelled to eject the app from their centralised distribution. The company could try to continue offering services to American users in spite of the CFIUS ban, building out its web service, offering Android apps for installation through third-party app stores, and continuing to operate for users who already downloaded the app on their iPhones. It’s not impossible to use a social network in a country that’s banned it: just look at the many, many Twitter and Facebook users posting from mainland China.
That would see a slow death of the site, similar to the constant drain of users from Musk’s Twitter. Without seismic upheaval, the winners would be the obvious places for other users to go: Instagram’s Reels and YouTube Shorts, which have spent years trying to clone TikTok’s appeal (and algorithm) with only moderate success.
More interesting would be if the company decided to push the big red button. Blocking all Americans overnight would cause instant upheaval. Some of the 150 million US users might shrug their shoulders and open another app, but others – many others – wouldn’t. Their dissatisfaction may not be enough to force the state to backtrack, but it could dissuade other governments from following course.
A new type of viral image

This week you may have seen the photo of the pope in a white puffer jacket.
Hopefully you have also realised that the image is a fake. It was generated by the latest version of AI art bot Midjourney, prompted to create a picture of the pope in a Balenciaga jacket. (As such, there’s an infinite amount of similar pictures available if you want to see more dripped-out papas).
after newsletter promotion
The pic came hot on the heels of a similarly viral Midjourney creation, after Bellingcat’s Eliot Higgins found himself banned from the tool for creating a selection of visualisations of Donald Trump being arrested in New York.
Higgins’s images didn’t quite escape containment in the same way the pope shot did, though, which is why I think the latter has a good case for being the first of a new type of viral image: the AI-generated fake that goes viral despite – not because – it was created by AI.
Midjourney’s fifth iteration is probably the best AI image generator on the market, particularly when trying to generate photorealistic images of humans. It’s even able to generate hands with five fingers (£), something this technology has notoriously struggled with before now.
So expect this to happen more in the future. The immediate future. Now. It’s time to treat photographic evidence as no more reliable than written statements: if @bonerfart420 posted that Rishi Sunak kicked a beggar, you wouldn’t believe them; it’s time to extend that same scepticism if they post a photo of him caught in the act.
Microsoft ahead of the game
It’s looking good for Microsoft’s multibillion takeover of gaming mega publisher Activision Blizzard, after the UK regulator dropped one of its key objections. According to the Competition and Markets Authority, Microsoft has provided sufficient proof that it would continue to make the Call of Duty series available on PlayStation consoles after the purchase was completed, and so that risk should be discounted.
“It would not be commercially beneficial to Microsoft to make CoD exclusive to Xbox following the deal,” the CMA says. “Microsoft will instead still have the incentive to continue to make the game available on PlayStation.”
That means, more broadly, that the CMA has provisionally concluded that the acquisition “will not result in a substantial lessening of competition in relation to console gaming in the UK”.
There’s still the question of “cloud gaming services”: few believe that Microsoft would offer Call of Duty to Sony to add to its PlayStation Plus service, making Xbox Game Pass the only subscription likely to have the series for the foreseeable future, and the CMA could still decide that’s a deal-breaker.
Of course, there are at least two other major regulators to go, with the EU competition commission and the FTC in the US both weighing in. But the former is expected to approve the deal itself. That leaves just the FTC still potentially committing itself to full-throated opposition of the deal. Things might still shake out the way Microsoft hopes.
If you want to read the complete version of the newsletter, please subscribe to receive TechScape in your inbox every Tuesday
Kvinna som anklagas för att ha skjutit ihjäl mannen på Facebook live
-
SEO5 dagar sedan
Optimera din SEO-strategi för maximal ROI med dessa 5 tips
-
SÖKMOTORER6 dagar sedan
Google Search Status Dashboard Lägger till Google Ranking Updates
-
SÖKMOTORER4 dagar sedan
Google Mars Space Office Design på Belo Horizonte, Brasilien
-
SÖKMOTORER5 dagar sedan
Google Search Console visar om embedURL-sidan använder indexifembedded
-
WORDPRESS7 dagar sedan
Intern länkning för SEO: Den ultimata guiden för bästa praxis
-
SÖKMOTORER5 dagar sedan
Google Bard länkar inte till källor för ofta
-
SÖKMOTORER5 dagar sedan
Microsofts annonsering riktar in sig på kunder genom att bläddra i kategorier med sökordsförstärkare
-
SOCIAL3 dagar sedan
LinkedIn lägger till ett nytt alternativ för att dela ett inlägg med flera medlemmar samtidigt