GoodRx & Criteo $32M Settlement: Defending Against Healthcare Tracking Technology Litigation

The preliminary approval of a revised $32 million settlement in the GoodRx & Criteo class action represents a watershed moment for healthcare privacy litigation. This isn't a technical zero-day exploit or ransomware campaign—it's a systemic architectural vulnerability in how healthcare organizations implement third-party tracking technologies on digital properties handling sensitive health data.

GoodRx, a digital healthcare platform serving millions of consumers, faced allegations that it shared sensitive user health information—including prescription drug searches, medical conditions, and treatment intentions—with advertising giant Criteo and other third parties without adequate disclosure or consent. The court's preliminary approval of the revised settlement (following an initial $25 million proposal) signals judicial skepticism toward "dark pattern" consent mechanisms and inadequate technical safeguards around health data.

For CISOs and security architects, the message is unambiguous: your marketing pixels are now attack surface. The exfiltration of PHI (Protected Health Information) via third-party JavaScript trackers constitutes a data breach under HIPAA, triggers wiretap act violations, and creates massive liability. This post provides the technical framework to identify, contain, and remediate these exposures before they become eight-figure settlements.

Technical Analysis: The Tracking Technology Attack Surface

The Mechanism of Exposure

Unlike traditional breaches involving external adversaries exploiting CVEs, the GoodRx/Criteo incident centers on first-party instrumentation—intentionally deployed JavaScript tags that inadvertently become data exfiltration vectors when misconfigured.

The technical architecture typically involves:

Tag Management Systems (TMS): Platforms like Google Tag Manager, Tealium, or Adobe Launch inject third-party scripts into healthcare web applications.
Data Layer Exposure: Client-side JavaScript exposes sensitive variables (e.g., drugName, medicalCondition, dosage) to the global namespace or data layer.
Pixel Firing: Advertising pixels (Criteo OneTag, Meta Pixel, Google Analytics 4) capture these parameters via query strings, POST bodies, or custom events.
Third-Party Transmission: Data flows to external endpoints (criteo.com, facebook.com, doubleclick.net) containing PHI in URL parameters or headers.

Affected Platforms and Regulatory Context

While this litigation specifically targets GoodRx and Criteo, the entire digital health ecosystem is exposed:

Patient Portals: Epic MyChart, Cerner HealtheLife, and proprietary portals often embed analytics and marketing tags on authenticated pages.
Telehealth Platforms: Zoom Healthcare, Doxy.me, and Teladoc properties may include tracking pixels in waiting rooms or post-visit surveys.
Pharmacy & Prescription Apps: Any web property handling drug names, insurance information, or treatment searches.
Symptom Checkers & Health Content: Pages indicating specific medical conditions based on URL paths or search queries.

The regulatory framework creating liability:

HIPAA Privacy Rule: Sharing PHI with third parties without a Business Associate Agreement (BAA) or valid authorization.
Wiretap Act / ECPA: Interception of electronic communications without consent (class actions often argue users didn't consent to third-party interception).
State Privacy Laws: CCPA/CPRA, Washington My Health My Data Act, and similar statutes with private rights of action.
FTC Act Section 5: Unfair or deceptive practices regarding privacy representations.

The "Vulnerability": Consent Architecture Failure

The technical root cause isn't a software bug—it's an architectural failure to implement data governance at the edge. Most healthcare organizations deploy marketing tags through the same pipelines as functional application code, lacking:

Server-side tagging (where sensitive parameters are stripped before transmission to third parties)
Consent-based conditional loading (ensuring trackers fire only after explicit opt-in)
Data layer sanitization (preventing PHI from entering client-side variables accessible to third-party scripts)

Detection & Response

Executive Takeaways for Security Leadership

While this threat doesn't involve malware or network intrusion, the detection strategy focuses on data flow auditing and client-side attack surface management:

Immediate Tracker Inventory: Deploy automated discovery tools (e.g., Blacklight, WebXray, or commercial CSPM solutions) to enumerate all third-party scripts on authenticated and unauthenticated healthcare properties. Pay special attention to pages where users search for drugs, symptoms, or providers.
Network Traffic Analysis: Implement egress filtering and inspection to identify PHI transmission to advertising domains. Look for query parameters containing drug names, ICD-10 codes, or medical terminology in outbound HTTP requests to known ad-tech endpoints (Criteo, Meta, Google, TikTok, Snapchat).
Consent Verification: Audit your Consent Management Platform (CMP) to ensure trackers are blocked by default until explicit opt-in. Verify that "reject all" buttons actually prevent pixel firing at the network level, not just UI level.
Data Layer Sanitization: Implement client-side security solutions (e.g., Akamai Page Integrity Manager, Source Defense, HUMAN Security) to prevent unauthorized JavaScript from accessing sensitive form fields or URL parameters containing health data.
Legal Alignment: Ensure your privacy policy accurately reflects actual data sharing practices. The GoodRx settlement hinged partly on discrepancies between stated privacy practices and actual technical implementation.

Sigma Rules

YAML

---
title: Sensitive Health Data Transmitted to Advertising Domain
id: 8a7b9c4d-2e1f-4a5b-9c8d-3e2f1a0b9c8d
status: experimental
description: Detects HTTP requests to advertising/tracking domains containing query parameters indicative of health information (drug names, medical conditions) in the URI or user-agent. This may indicate HIPAA-regulated data exfiltration via marketing pixels.
references:
  - https://www.hipaajournal.com/goodrx-25-million-settlement-tracking-technology-lawsuit/
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.exfiltration
  - attack.t1567
logsource:
  category: webserver
  product: generic
detection:
  selection_domain:
    cs-host|contains:
      - 'criteo.com'
      - 'criteo.net'
      - 'facebook.com/tr'
      - 'connect.facebook.net'
      - 'doubleclick.net'
      - 'google-analytics.com'
      - 'analytics.google.com'
      - 'tiktok.com/i18n/pixel'
  selection_params:
    cs-uri-query|contains:
      - 'drug='
      - 'medication='
      - 'rx='
      - 'condition='
      - 'diagnosis='
      - 'symptom='
      - 'treatment='
      - 'prescription='
      - 'pharmacy='
      - 'dosage='
  condition: selection_domain and selection_params
falsepositives:
  - Legitimate marketing analytics with proper BAAs and server-side sanitization
  - Internal analytics platforms misconfigured with external domains
level: high
---
title: Third-Party Script Accessing Sensitive Healthcare Form Data
id: 9b8c7d6e-5f4a-4b3c-2d1e-0f9a8b7c6d5e
status: experimental
description: Detects JavaScript execution patterns where third-party advertising scripts access form fields or URL parameters containing medical terminology. This indicates potential PHI scraping by marketing tags.
references:
  - https://www.hipaajournal.com/goodrx-25-million-settlement-tracking-technology-lawsuit/
  - https://attack.mitre.org/techniques/T1059.007/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.collection
  - attack.t1059
logsource:
  category: browser
  product: generic
detection:
  selection_script:
    ScriptSrc|contains:
      - 'criteo'
      - 'facebook'
      - 'analytics'
      - 'ads'
      - 'tracker'
  selection_access:
    TargetElement|contains:
      - 'medication'
      - 'prescription'
      - 'symptom'
      - 'condition'
      - 'diagnosis'
      - 'drug'
      - 'rx'
  condition: selection_script and selection_access
falsepositives:
  - Legitimate healthcare application functionality
  - Accessibility tools and screen readers
level: medium

KQL Queries

KQL — Microsoft Sentinel / Defender

// Hunt for outbound connections to advertising domains from healthcare web properties
// Execute in Microsoft Sentinel or Defender with appropriate network logs

let AdTechDomains = dynamic([
    "criteo.com", "criteo.net", "casalemedia.com", "facebook.com", "connect.facebook.net",
    "doubleclick.net", "google-analytics.com", "analytics.google.com", "tiktok.com",
    "snapchat.com", "pinterest.com", "twitter.com/i/adsct", "ads.linkedin.com"
]);

let SensitiveParams = dynamic([
    "drug", "medication", "rx", "prescription", "condition", "diagnosis",
    "symptom", "treatment", "pharmacy", "dosage", "refill", "pill"
]);

// Check network connections (Defender)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (AdTechDomains)
| extend ParsedUrl = parse_url(RemoteUrl)
| extend QueryParams = tostring(ParsedUrl.QueryString)
| where QueryParams has_any (SensitiveParams)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, QueryParams, RemoteIP
| sort by TimeGenerated desc;

// Check web server logs (if ingested via CommonSecurityLog or custom logs)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any (AdTechDomains)
| where RequestURL has_any (SensitiveParams)
| project TimeGenerated, SourceIP, RequestURL, RequestMethod, UserAgent
| sort by TimeGenerated desc;

// Hunt for specific Criteo OneTag patterns in HTTP traffic
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL contains "criteo" or RequestURL contains "rtb"
| where RequestURL contains "medication" or RequestURL contains "drug" or RequestURL contains "health"
| project TimeGenerated, SourceIP, DestinationIP, RequestURL
| summarize Count = count() by RequestURL, bin(TimeGenerated, 1h);

Velociraptor VQL

VQL — Velociraptor

-- Hunt for browser artifacts indicating healthcare site usage with ad-tech trackers
-- This artifact checks browser history and cache for GoodRx-like patterns with Criteo pixels

SELECT * FROM Artifact.Windows.Forensics.BrowserHistory()
WHERE URL =~ "goodrx|walgreens|cvs|riteaid|pharmacy|prescription"
AND (
    URL =~ "criteo|facebook|doubleclick|analytics"
    OR VisitCount > 0
)

-- Check for cached JavaScript files from known ad-tech domains
LET adtech_cache = SELECT FullPath, Size, Created
FROM glob(globs="C:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\**")
WHERE FullPath =~ "criteo|facebook|analytics|adsystem"

SELECT * FROM adtech_cache

-- Check for localStorage/sessionStorage artifacts containing health data alongside tracking IDs
SELECT FullPath, Data, Created
FROM glob(globs="C:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\leveldb\\**")
WHERE FullPath =~ "goodrx|health|pharmacy"

PowerShell Assessment Script

PowerShell

# Audit local browser extensions and check for tracking pixels in downloaded web content
# Run this on endpoints to assess exposure to healthcare tracking technologies

$AdTechDomains = @(
    "criteo.com",
    "facebook.com/tr",
    "connect.facebook.net",
    "doubleclick.net",
    "google-analytics.com",
    "tiktok.com"
)

$HealthTerms = @(
    "drug=", "medication=", "rx=", "prescription=", "condition=",
    "diagnosis=", "symptom=", "treatment=", "pharmacy=", "goodrx"
)

Write-Host "=== Healthcare Tracking Technology Assessment ===" -ForegroundColor Cyan
Write-Host "Checking browser extensions for potential data leakage...`n"

# Check Chrome extensions (often inject tracking scripts)
$ChromeExtPath = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions"
if (Test-Path $ChromeExtPath) {
    $Extensions = Get-ChildItem $ChromeExtPath -Directory | Select-Object -ExpandProperty Name
    Write-Host "Installed Chrome Extensions (review for unnecessary ad-tech):" -ForegroundColor Yellow
    $Extensions | ForEach-Object { Write-Host "  - $_" }
}

# Check Edge extensions
$EdgeExtPath = "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Extensions"
if (Test-Path $EdgeExtPath) {
    $Extensions = Get-ChildItem $EdgeExtPath -Directory | Select-Object -ExpandProperty Name
    Write-Host "`nInstalled Edge Extensions:" -ForegroundColor Yellow
    $Extensions | ForEach-Object { Write-Host "  - $_" }
}

# Check hosts file for ad-tech blocking (defensive measure verification)
$HostsFile = Get-Content "$env:SystemRoot\System32\drivers\etc\hosts" -ErrorAction SilentlyContinue
$BlockedTrackers = $HostsFile | Where-Object { $_ -match "criteo|facebook|doubleclick" }

if ($BlockedTrackers) {
    Write-Host "`n[+] Hosts file contains tracker blocks (good):" -ForegroundColor Green
    $BlockedTrackers | Select-Object -First 5 | ForEach-Object { Write-Host "  $_" }
} else {
    Write-Host "`n[!] No tracker blocks found in hosts file" -ForegroundColor Red
}

# Check DNS cache for recent connections to ad-tech from healthcare contexts
Write-Host "`nRecent DNS resolutions for ad-tech domains:" -ForegroundColor Yellow
Get-DnsClientCache | Where-Object { 
    $_.Entry -match "criteo|facebook|analytics" 
} | Select-Object -First 10 | Format-Table Entry, Data, Status

Write-Host "`n=== Recommendations ===" -ForegroundColor Cyan
Write-Host "1. Implement browser isolation for healthcare portals"
Write-Host "2. Deploy endpoint DLP to detect PHI in browser URLs"
Write-Host "3. Use DNS filtering (Cisco Umbrella, etc.) to block ad-tech on medical devices"
Write-Host "4. Conduct regular audits of browser extensions on clinical workstations"

Remediation

The GoodRx settlement establishes a clear remediation framework. Organizations handling health data must implement the following immediately:

1. Server-Side Tagging Architecture

Remove client-side pixels entirely from authenticated healthcare applications. Implement server-side tagging (e.g., Google Tag Manager Server-Side, Adobe Experience Platform Edge Network, or Tealium EventStream) where:

Data is sent first to your controlled server endpoint
PHI parameters are stripped, hashed, or tokenized
Only sanitized, non-identifying data is forwarded to third-party ad networks
Transmission occurs via server-to-server API calls with proper BAAs in place

2. Consent Management Hardening

Implement opt-in by default architecture:

JavaScript

// Example: Conditional tag loading based on explicit consent
if (consentGiven === true && region !== 'EU') {
    loadCriteoPixel();
} else {
    console.log('Criteo blocked pending explicit consent');
    // Implement fallback conversion tracking without third-party scripts
}

Verify that your Consent Management Platform (OneTrust, TrustArc, Cookiebot) actually prevents network requests at the firewall level, not just DOM level.

3. Data Governance Controls

Classify all web properties: Categorize pages as "PHI-containing" (drug searches, condition pages, patient portals) vs. "General content" (homepage, about us).
Prohibit ad-tech on PHI pages: Implement Content Security Policy (CSP) headers blocking script-src connections to known ad-tech domains on sensitive paths.

Code

Content-Security-Policy: script-src 'self' 'unsafe-inline' https://trusted-cdn.com; connect-src 'self' https://api.yourhealthsystem.com;

4. Legal and Compliance Alignment

Execute BAAs: If you must share health data with analytics vendors, ensure Business Associate Agreements explicitly cover the data flows.
Update Privacy Policies: Accurately disclose all tracking technologies. The GoodRx litigation emphasized discrepancies between policy language and technical implementation.
State Law Compliance: Washington My Health My Data Act (effective 2024) and similar laws require opt-in consent for any sharing of consumer health data—broader than HIPAA.

5. Ongoing Monitoring

Deploy client-side security monitoring (e.g., Feroot, Source Defense, Akamai) to detect:

New third-party scripts injected via tag managers
Scripts accessing sensitive form fields or URL parameters
Data exfiltration to unauthorized domains

Vendor Advisory and Timeline

Immediate: Audit all web properties using automated scanning tools (Blacklight, WebXray) to enumerate trackers.
30 Days: Implement server-side tagging for all healthcare properties or remove ad-tech entirely.
60 Days: Conduct legal review of all data sharing agreements and update privacy policies.
Ongoing: Quarterly audits of tag manager configurations and network traffic analysis.

The $32 million settlement is not an outlier—it is the new baseline. Regulatory scrutiny from HHS OCR, FTC, and state attorneys general is intensifying. The technical controls described above are no longer optional for healthcare digital properties.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub