CVS Pharmacy and digital advertising company Criteo have agreed to make up to $20.5 million available to resolve allegations that tracking tools on the pharmacy giant’s websites and mobile app funneled sensitive user information to third parties without proper consent. The proposed class action settlement, which received preliminary court approval in July, covers virtually anyone in the U.S. who visited cvs.com, cvshealth.com or used the CVS app before July 27, 2026.
But. Don’t expect a windfall. Claimants without proof of their visits stand to receive up to $5. Those who submit documentation such as browser history, screenshots or purchase receipts could get as much as $10. The final amounts will shrink based on how many people file valid claims. After attorneys’ fees, administration costs and service awards come out first.
The case highlights a growing tension in healthcare. Retail pharmacies now operate vast digital platforms. Customers research prescriptions, manage accounts and buy over-the-counter products online. Every click, search and page view generates data. Much of it touches on personal health matters.
Tracking Tools Under Fire
Plaintiffs in Brewer et al. v. CVS Pharmacy, Inc. and Criteo Corp. accused the companies of embedding pixels, software development kits and other technologies from Criteo and additional vendors. These tools allegedly captured and transmitted details including users’ names, email addresses, phone numbers, IP addresses, browsing history and specific interactions with health-related content. (ClassAction.org)
The complaint pointed to violations of the Electronic Communications Privacy Act and various state privacy statutes. It argued that CVS failed to obtain the necessary consent before allowing third parties to intercept what amounted to private communications. Sensitive medical searches or account logins on a pharmacy site carry different expectations than browsing shoes or books.
CVS denies any wrongdoing. In a statement to USA Today, spokesperson Amy Thibault said the company “stand[s] by our privacy practices and believe they comply with applicable laws. The settlement resolves claims based on legal theories that challenge common online industry practices.”
Yet the sheer breadth of the class — every living person who accessed those digital properties in the United States prior to the cutoff date — signals how routine such tracking became. And how exposed health data can be even without a traditional data breach.
Recent reporting adds weight to the concerns. A September 24 article in the HIPAA Journal detailed how the lawsuit alleged CVS worked with multiple trackers including Adobe, Criteo, Medallia and Quantum Metric. These tools reportedly intercepted, eavesdropped on or recorded sensitive personal and medical communications. The piece notes mediation began in March 2026 and continued for weeks before terms were reached.
So the settlement isn’t an admission. It’s a business decision. Ongoing litigation costs money. Uncertainty around privacy rules in healthcare adds risk. And regulators have sharpened their focus on digital tracking in medical contexts.
The original CNET coverage from earlier this year framed the payout at around $20 million and emphasized the ease of claiming for regular CVS online customers. Updated reports confirm the ceiling now sits at $20.5 million. Claims opened in mid-September. The deadline to file sits at November 16, 2026. A final approval hearing is scheduled for December 1 before a Florida court.
Eligible individuals can submit forms online at CVSDigitalPrivacySettlement.com or by mail. One claim per household. Payments, if approved and after any appeals, could arrive via check, PayPal, Venmo or Zelle roughly 120 days later. Proof of access boosts the potential award but isn’t required. Simple attestation qualifies someone for the lower tier.
This episode fits a larger pattern. Healthcare organizations have raced to build digital experiences. They collect more data than ever to personalize offers, remind patients about refills and drive loyalty. Yet the infrastructure that powers targeted advertising often clashes with expectations around medical confidentiality.
Patients assume their symptom searches or medication lookups stay within the pharmacy’s controlled environment. When pixels fire and send signals to ad networks, that assumption breaks. Even if names aren’t always attached, the combination of identifiers can paint a detailed picture.
Industry watchers point to increasing scrutiny from both plaintiffs’ lawyers and regulators. The Federal Trade Commission and state attorneys general have signaled that health data receives special protection. Consent must be clear. Tracking must be limited. The line between operational analytics and commercial surveillance grows harder to defend.
And the timing matters. This settlement comes as artificial intelligence tools promise to extract even more value from health data. The same platforms that track behavior today could feed models tomorrow. That raises the stakes.
CVS isn’t alone. Similar suits have targeted other pharmacy chains, hospitals and telehealth providers over website pixels that transmit data to Google, Meta or specialized ad firms. Many settle to avoid drawn-out discovery that might expose additional technical details.
For consumers, the practical takeaway is straightforward. Check your email for notice from the settlement administrator. Visit the official site. Decide whether to spend time gathering proof for the higher payout. The amounts are modest. The precedent is not.
Critics on X called the structure a “racket for the lawyers.” One recent post labeled class actions a “scam” given the gap between the headline fund and individual recoveries. Others simply noted the December hearing date and urged people to file before the cutoff. Public reaction mixes skepticism with mild interest in free money.
Still, the case forces pharmacy executives to examine their vendor contracts. It pushes product teams to audit every script tag on their sites. And it reminds privacy officers that health-adjacent data collected online carries regulatory weight even if the site isn’t strictly covered by HIPAA in every interaction.
CVS will likely continue to invest in its digital offerings. The company operates one of the largest retail pharmacy networks in the country. Its app and website drive significant revenue and customer engagement. The question is whether future implementations will prioritize stricter data controls and clearer disclosures.
For now, millions of Americans who ever logged in or browsed CVS online have a narrow window to claim their piece of the fund. Most will get very little. A few might get $10. The real impact lies in the signal it sends across the health technology sector: tracking practices once considered standard now carry real financial and reputational costs.