GoodRx is a real company whose coupons save real money at real pharmacies — more than 55 million people have used it since January 2017. The FTC charged that it shared users' sensitive health information for advertising; GoodRx settled for $1.5 million and a permanent ban on sharing health data for advertising.

Is it safe to use GoodRx coupons?

The coupons themselves are real and work at the pharmacy counter — the FTC's case is about where the search history went, not whether the discounts exist. Use goodrx.com or the official app you opened, and read the current privacy policy and data-sharing settings before searching sensitive medications.

Scam verdict · Educational pattern check

Scam Detective research desk · Updated October 2026

Real discounts — settled FTC case

Is GoodRx Legit? The Coupons Are Real — So Is the FTC Case Over Where Your Prescription Data Went

Q: What did the FTC's GoodRx case find?

The FTC's first-ever Health Breach Notification Rule case charged that GoodRx shared users' sensitive health information with Facebook, Google, Criteo, Branch, and Twilio since at least 2017 — including an August 2019 upload to Facebook for custom audiences — and displayed a HIPAA-compliance seal it hadn't earned. GoodRx settled.

GoodRx is a real company whose coupons save real money at real pharmacies — more than 55 million people have used it since January 2017. The FTC charged that its data practices were real too: the agency's first-ever Health Breach Notification Rule case, alleging GoodRx shared users' sensitive personal health information — the medications you searched and the conditions they imply — with Facebook, Google, Criteo, Branch, and Twilio since at least 2017, including an August 2019 upload to Facebook to build custom advertising audiences, and displayed a HIPAA-compliance seal it hadn't earned. GoodRx settled: $1.5 million, a permanent ban on sharing health data for advertising, affirmative express consent for any other disclosure, and third-party deletion of the shared data. The coupons work; the question is what your search history funded.

Educational verdict from documented scam patterns — not a live report. For a 0–100 risk score on the exact link in your hand, run the checker.

Check a URL free Read the full guide

Straight from the source

The verdict stands on the public record — the line below is quoted verbatim from the source named under it.

“Digital health companies and mobile apps should not cash in on consumers' extremely sensitive and personally identifiable health information.”

— Samuel Levine, Director of the FTC's Bureau of Consumer Protection, Feb. 1, 2023.

Why this question never goes away

The coupons work at the counter; the question is what the search cost. The FTC charged that GoodRx shared users' sensitive personal health information — the medications you searched and the conditions they imply — with Facebook, Google, Criteo, Branch, and Twilio since at least 2017, including an August 2019 upload of user data to Facebook to build custom advertising audiences — and that it displayed a HIPAA-compliance seal it hadn't earned. The February 2023 case was the FTC's first-ever enforcement of the Health Breach Notification Rule, filed by the Justice Department in the U.S. District Court for the Northern District of California after a 4-0 Commission vote. GoodRx settled: a $1.5 million civil penalty, a permanent prohibition on sharing health data for advertising, affirmative express consent required for any other disclosure, and a directive that third parties delete the data already shared. More than 55 million people have used GoodRx since January 2017 — the discounts are real; the record is about where the prescription data went.

Five red flags — any one is enough

A coupon site that knows your conditions — the FTC charged GoodRx shared users' sensitive health information with Facebook, Google, Criteo, Branch, and Twilio since at least 2017, including an August 2019 upload to Facebook for custom advertising audiences.

A HIPAA seal on a site that isn't your doctor — the FTC said GoodRx displayed a HIPAA-compliance seal it hadn't earned; a seal is an image, and this one didn't mean what it implied.

Any health site that shares before it asks — the first-ever Health Breach Notification Rule case settled on a permanent ban on sharing health data for advertising and affirmative express consent for any other disclosure.

“GoodRx refund” or “settlement” contacts asking for information to send you money — the FTC never requires people to pay money or provide account information to send a payment.

“GoodRx support” reaching you first — the real company doesn't call, text, or email you about your coupons, your prescriptions, or a payment; settled-brand impersonators ride every FTC headline.

Your next three moves

Use the coupons at goodrx.com or the official app you opened yourself — and read the company's current privacy policy and any data-sharing settings before you search sensitive medications. Never through a link an ad or message handed you.

Refuse the specific ask: no “GoodRx support” contact you didn't start — and weigh sensitive searches against the record: the FTC's case began with exactly those queries.

Report health-data misuse to the FTC at reportfraud.ftc.gov — and paste any “GoodRx” link into the $2 instant check for a 0–100 scam risk score before you act.

Sixty seconds of checking beats a four-figure mistake.

Paste any URL for a free instant preview — the full 0–100 report is $2, one-time. No subscription.

Spot the scam before it spots you.

For businesses · $19, one-time

Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $19

Free brand scan first — you only pay for the full audit.