CVS settles class action Web Tracker Privacy lawsuit for $20.5M!

HealthCareInfoSecurity.com reported that “CVS Health and digital advertising firm Criteo have agreed to pay $20.5 million to settle claims that the retail pharmacy giant unlawfully disclosed personal and health information of patients to Criteo through web tracking technology embedded on the company's websites and apps.”  The September 16, 2026 article entitled “CVS, Criteo Settle Web Tracker Data Privacy Suit for $20.5M” (https://tinyurl.com/3vvk5bkv) included these comments:

 The proposed class action litigation, filed in a Florida state court in May, alleged violations of the Electronic Communications Privacy Act, state statutory claims, breach of confidence, invasion of privacy and negligence by both companies.

"Through the third-party code it implemented on the website and app, CVS has, unbeknownst to plaintiffs and without their consent, enabled the third-party trackers' interception, eavesdropping, and/or recording of information about plaintiffs' and class members' medical conditions, immunizations and vaccines, prescriptions and other private information, including their activity searching for and purchasing sensitive healthcare products," the lawsuit claimed.

"By failing to receive the requisite consent, CVS breached its duty of confidentiality and aided the third-party trackers in unlawfully intercepting plaintiff's private information," the complaint alleged. Plaintiffs described the lapse as "egregious violations" of CVS patients' right to a "reasonable expectation of privacy."

Court documents don't indicate how much CVS and Criteo are each contributing to the $20.5 million settlement. Under the proposal, eligible class members include "all living individuals who accessed the CVS Digital Properties in the U.S. prior to July 27, 2026," the date on which the court approved the preliminary settlement.

A final approval hearing for the settlement is set for Dec. 1.

Interesting ending of the class action case!