CVS agrees to $20.5 million privacy class action settlement

CVS Pharmacy Inc. has agreed to a $20.5 million settlement to resolve a class action lawsuit alleging the company disclosed users’ personal information to third parties without consent. The lawsuit claims that technology embedded in CVS websites and mobile applications shared private health data, browsing history, and other identifiers with the advertising firm Criteo Corp and other third parties.

Eligible class members include U.S. residents who accessed CVS.com, CVSHealth.com, or the CVS mobile app prior to July 27, 2026. While CVS maintains it did not violate any laws, it has agreed to the settlement.

Claimants can receive $5 without providing documentation. Those who can provide proof of interaction—such as browser history, dated screenshots, or email receipts—may be eligible for up to $10. The deadline to submit a claim is November 16, 2026, with a final approval hearing scheduled for December 1, 2026.