CVS Health and the advertising-technology company Criteo have agreed to pay $20.5 million to settle a class action alleging that web trackers on CVS digital properties captured and transmitted patients' health information to an ad network, according to court filings and coverage of the settlement. The lawsuit claimed that third-party tracking code on cvs.com, cvshealth.com, and the CVS app intercepted searches for medical conditions, immunizations, and prescriptions, and information about healthcare products, without consent.
Both companies deny any wrongdoing. The settlement still requires approval at a final hearing scheduled for December 1, and the class it covers is broad: anyone in the United States who accessed the CVS digital properties before July 27, 2026. The per-person economics of the deal say as much about tracker litigation as the legal claims do.
The mechanics of the alleged tracking
The complaint described a standard piece of the modern web: a pixel or script embedded in a website fires when a visitor does something, and the data about that action flows to a third party that uses it to build advertising profiles. The difference here is what the pages were. A pharmacy website knows more about its visitors than almost any retailer, because the searches themselves are health information. A search for a diabetes medication, a vaccination appointment, or a specialty pharmacy product is a medical fact in a way a search for a lawn mower is not.
The plaintiffs alleged violations of the Electronic Communications Privacy Act, state privacy statutes, breach of confidence, invasion of privacy, and negligence. The companies denied liability, and the settlement resolves the dispute without any admission of wrongdoing. Court documents do not specify how much each company is contributing.
The lawsuit's procedural history, drawn from Criteo's securities filings, shows the usual attrition of tracker litigation. Filed in July 2025, dismissed as to Criteo in October 2025, revived by an amended complaint in November, sent to mediation in March 2026, and settled in July. A second defendant, the customer-experience vendor Medallia, was named in the amended complaint but is not part of the settlement.
What class members actually get
The payment schedule is modest. Eligible class members can claim up to $5 without documentation or up to $10 with proof of membership, payable through Zelle, PayPal, Venmo, or check, with one claim per household. The deadline to file a claim is November 16, 2026, and the deadline to opt out of the settlement class is November 1.
The rest of the fund goes where settlement funds usually go. Attorneys' fees and expenses may take up to $7,687,500, service awards for the class representatives up to $2,500 each, and settlement administration costs come off the top. The arithmetic is familiar to anyone who has followed consumer class actions: the class is enormous, the harm is diffuse, and the individual payment is the smallest meaningful number in the settlement.
That does not make the case meaningless. The $20.5 million is the price CVS and Criteo paid to end the litigation, and for the tracker industry the number now exists as a data point: health-site tracking settled at roughly twenty million dollars for one pharmacy chain's digital properties.
The regulatory shadow behind the settlement
The lawsuit did not develop in a vacuum. Federal regulators have spent three years pushing on exactly this practice. The Federal Trade Commission warned hospitals and telehealth providers in 2023 that the tracking pixels on their websites may be disclosing health information in violation of the FTC Act's prohibition on unfair practices, and the Department of Health and Human Services has issued guidance that third-party trackers on patient-facing pages raise HIPAA concerns when they collect protected health information.
Those warnings changed behavior at the margin, but tracker settlements continue, which suggests the behavior changed less than the risk profiles did. The regulators' theory and the plaintiffs' theory here are the same: a pharmacy's website is a healthcare setting, and the rules that protect medical privacy do not stop at the front door of a URL.
Why health-site tracking is different from other tracking
Every retailer tracks its visitors. The pharmacy case is different because of what the searches mean. When a visitor to cvs.com searches for a medication, the search is a medical fact about that person. The tracker that records it is not recording shopping intent; it is recording health status. Advertising networks build audiences around such signals, and the audiences are the point: a diabetes-medication audience, a vaccination audience, a specialty-pharmacy audience, each one a list of people grouped by medical condition that advertisers can target.
The plaintiffs' theory was that the data crossed a legal line the moment it left the pharmacy's control for an ad network's servers, whatever the network did with it afterward. That theory has gained ground across the industry. Health systems, telehealth platforms, and pharmacy sites have faced lawsuits and regulatory scrutiny over the same configuration, and the Federal Trade Commission's 2023 warning letters to hospitals and telehealth providers made the regulator's view explicit: trackers on health sites that disclose health information may violate the FTC Act's unfairness prohibition, and the practice should be disclosed or removed.
The CVS settlement fits into that trajectory as the pharmacy version of a pattern. The dollar figure is specific to this case, but the underlying conduct, a pixel on a health page, is the industry default configuration. The settlement does not change the default. It prices it.
What happens to the class members who never claim
Class-action settlements of this size follow a predictable shape: a settlement website opens, notices go out by email and publication, and a fraction of the class files claims. The per-person amounts here, $5 to $10, guarantee the claim rate stays low, because the cost of filing exceeds the payment for many members. The unclaimed remainder of the fund typically reverts or is distributed per the settlement's cy pres provisions, often to privacy or consumer organizations named in the agreement.
That structure is the usual criticism of this kind of settlement, and it has a sharper edge in the health context. A class member whose pharmacy searches were shared with an ad network has suffered a privacy harm that the settlement's payment does not measure. The $5 check is not compensation; it is a receipt, evidence that the class member's data was part of the case. The real remedy in privacy litigation is rarely the check. It is the discovery process, the public filings, and the precedent, which is why the industry watches the settlements and the plaintiffs' lawyers watch the trackers.
For CVS customers, the practical step is concrete: the claim deadline is November 16, and the official settlement site is the only place to file. For everyone else, the case is a marker on the path toward a rule that health-site trackers either obtain real consent or stop firing. The marker is now $20.5 million, and the path is shorter than it was.
One thread remains open even after approval: Medallia, the customer-experience vendor also named in the amended complaint, is not part of the settlement, and the litigation against it continues on its own schedule. A plaintiff class that settled with two defendants and is still litigating against a third is a useful reminder of how these cases actually resolve: in stages, at different prices, with each defendant making its own calculation about the cost of discovery versus the cost of settlement. The $20.5 million figure covers only part of the conduct alleged, and the rest is still being priced.
What to watch next
Two dates matter. November 16 is the claim deadline, and December 1 is the final approval hearing. If the court approves, payments issue about 120 days after approval or after appeals resolve, which puts real money in real accounts sometime in 2027.
The larger question is whether the settlement changes the practice it litigated. CVS settled, denied wrongdoing, and said nothing about changing its tracker configuration. Criteo's filings show the company booking the matter as ordinary litigation expense. The FTC's warning letters were aimed at exactly this configuration, on exactly this kind of site, and the configuration, by every indication, is still out there on other sites in other forms.
A $20.5 million settlement is not a deterrent to an industry that measures advertising revenue in the tens of billions. But it is a template, and templates are what class-action lawyers use. The next complaint about a health-site tracker will cite this settlement as the market price of the conduct, and the next one after that will cite both. The per-person check is $5 or $10. The industry-level price, across every pharmacy, insurer, and telehealth site that still fires a pixel on a symptom search, is only starting to be written.
Primary sources
- GovInfoSecurity for the settlement terms, the allegations, and the case history.
- NBC Chicago for the claim amounts, deadlines, and payment methods.