GoodRx, a health technology company offering prescription drug discount coupons and telehealth services, shared sensitive user health data with Facebook/Meta, Google, Criteo, Branch, and other advertising platforms from at least 2017 through 2020. The data shared included users’ personal health conditions, specific medications they were taking, prescription information, and personal identifiers — enabling advertisers to target users based on their health status. In February 2023, the FTC took enforcement action against GoodRx under the Health Breach Notification Rule (HBNR), which was the first time the FTC used the HBNR against a health app company. GoodRx agreed to pay a $1.5 million civil penalty and was banned from sharing health data with advertising companies for advertising purposes. The FTC found that GoodRx had failed to notify users that it was sharing their health information, violated the FTC Act’s prohibition on unfair or deceptive practices, and violated the Health Breach Notification Rule by not notifying users and the FTC of the unauthorized disclosure. The case established that the HBNR applies to consumer health apps and telehealth companies, not just traditional HIPAA-covered entities, significantly expanding the regulatory landscape for health tech companies. GoodRx had over 55 million users at the time of the action. The case is closely linked to the contemporaneous Cerebral enforcement action and broader scrutiny of Meta Pixel use in healthcare.