GoodRx Safety, Regulation & Compliance Posture

What GoodRx Actually Does and How It Makes Money

GoodRx aggregates prescription drug prices from pharmacy benefit managers (PBMs) and displays competing discount codes that consumers can present at the pharmacy counter. The service is free to use. GoodRx earns revenue when a consumer fills a prescription using one of its codes, collecting a commission from the pharmacy or PBM that processed the transaction.

This model means GoodRx is not an insurer, a pharmacy, or a drug manufacturer. It operates as a technology intermediary. GoodRx's annual report (Form 10-K) filed with the SEC shows prescription transactions generating the large majority of company revenue. The remaining revenue comes from its subscription product (GoodRx Gold), advertising, and the GoodRx Care telehealth platform.

One point consumers often miss: GoodRx discount codes are not insurance. They function as negotiated cash-pay rates. If you have insurance, your copay might be lower or higher than the GoodRx price depending on your formulary tier and deductible status. The FDA does not regulate discount card programs, which fall outside the scope of pharmaceutical manufacturing or distribution oversight.

The 2023 FTC Enforcement Action

The most significant regulatory event in GoodRx's history is the FTC's February 2023 enforcement action. Between 2017 and 2020, GoodRx shared users' personal health information, including medication names, health conditions, and prescription purchase history, with third-party advertising platforms such as Facebook (Meta), Google, and Criteo. The company used this data to target users with health-related advertisements.

The FTC alleged that GoodRx violated the Health Breach Notification Rule by failing to notify consumers that their data had been shared. This was the first-ever enforcement of the Health Breach Notification Rule against a digital health company. The FTC's complaint stated that GoodRx had promised users their health information would never be sold or shared for advertising purposes.

GoodRx agreed to a $1.5 million civil penalty. It was also permanently prohibited from sharing user health data for advertising and required to instruct third parties to delete previously shared data. The order mandated implementation of a comprehensive privacy program with recurring independent assessments.

The enforcement message was blunt: digital health platforms cannot treat consumer health data as a marketing asset, even when those platforms fall outside traditional HIPAA coverage. That reading has shaped enforcement posture across the digital health sector since 2023.

HIPAA Coverage Gaps and What They Mean for Users

A common misconception is that GoodRx's coupon platform operates under HIPAA protections. It does not. HIPAA applies to covered entities (health plans, healthcare providers who transmit claims electronically, and healthcare clearinghouses) and their business associates. GoodRx's discount code service does not transmit insurance claims.

This distinction matters. When you hand a GoodRx code to your pharmacist, the pharmacy itself is bound by HIPAA. But the data GoodRx collects through its app and website (your searches, the medications you look up, your location) falls under the FTC Act and state consumer protection laws rather than HIPAA's Privacy Rule.

GoodRx Care, the company's telehealth arm, occupies a different regulatory position. Because GoodRx Care providers prescribe medications and bill for clinical services, those interactions are subject to HIPAA and state medical board oversight. The prescribing providers on GoodRx Care hold active state medical licenses and are required to follow the same standard of care as in-person clinicians.

After the FTC settlement, GoodRx updated its privacy policy and introduced a "Do Not Sell My Information" option consistent with the California Consumer Privacy Act (CCPA). The company also began publishing annual transparency reports detailing data requests from law enforcement agencies.

Drug Pricing Accuracy and Pharmacy Network Reliability

Consumer reviews on platforms like Trustpilot and the Better Business Bureau frequently cite pricing discrepancies as a concern. The GoodRx app displays estimated prices, but the actual cost at the register can differ. Peer-reviewed research on prescription drug discount cards shows they can meaningfully reduce out-of-pocket costs for generic medications, but the savings vary substantially by drug, dose, and pharmacy.

GoodRx works with over 70,000 pharmacies in its network, including CVS, Walgreens, Walmart, Rite Aid, and most independent pharmacies. Pricing is updated regularly, but real-time accuracy depends on the PBM contracts underlying each code. Some pharmacies may decline certain discount codes or require specific billing procedures, which can create friction at the point of sale.

A separate cross-sectional analysis of direct-to-consumer online pharmacies compared availability and cash prices for common and expensive generics across platforms and found wide spread between the cheapest and most expensive options. For brand-name medications, the savings were less consistent, with manufacturer copay cards or patient assistance programs often providing better value.

Better Business Bureau records show a steady stream of complaints, primarily related to pricing discrepancies and customer service response times, most of them answered through the BBB resolution process.

GoodRx vs. Alternatives: How Competitors Compare

Several platforms compete directly with GoodRx in the prescription discount space. Each has a different compliance profile and pricing model.

RxSaver (by RetailMeNot) operates on a nearly identical PBM aggregation model. RxSaver has not faced FTC enforcement actions, but its privacy policy permits sharing de-identified data with marketing partners, a practice that falls in a gray area after the GoodRx ruling.

Amazon Pharmacy bundles prescription pricing for Prime members at $139/year. Amazon's pharmacy operations are licensed and HIPAA-covered because Amazon Pharmacy functions as an actual dispensing pharmacy, not just a discount aggregator. This gives Amazon Pharmacy users stronger baseline privacy protections for their prescription data.

Cost Plus Drugs (Mark Cuban) uses a transparent pricing model: drug cost plus a 15% margin plus a $5 pharmacist fee plus shipping. Because Cost Plus operates its own pharmacy (licensed in all 50 states), it is a HIPAA-covered entity. The Cost Plus Drugs model eliminates PBM intermediaries entirely, which removes the variable pricing that consumers sometimes encounter with GoodRx.

SingleCare is GoodRx's closest structural competitor. SingleCare partners with many of the same PBMs and pharmacy chains. Like GoodRx, SingleCare is not HIPAA-covered for its discount services. SingleCare has not been subject to FTC enforcement, though its data practices are governed by the same regulatory framework.

For consumers prioritizing data privacy, Amazon Pharmacy and Cost Plus Drugs offer structurally stronger protections because they operate as licensed pharmacies. For consumers seeking the widest range of price comparisons, GoodRx and SingleCare remain the most comprehensive aggregators.

State-Level Regulatory Considerations

Prescription discount card programs are regulated at the state level in many jurisdictions. Many states require discount card programs to register with the state insurance department or pharmacy board. GoodRx is registered as a prescription drug discount card program in all states that require registration, according to its public filings.

Some states impose specific disclosure requirements. California's CCPA and its successor, the California Privacy Rights Act (CPRA), give residents the right to opt out of data sales and to request deletion of personal information. State regulators have actively enforced these statutes against digital health companies.

Oregon, Washington, and Connecticut have enacted health data privacy laws modeled partly on the lessons of the GoodRx enforcement. Washington's My Health My Data Act, effective March 2024, explicitly covers consumer health data held by non-HIPAA entities, including discount platforms. GoodRx updated its data handling procedures to comply with these new state laws prior to their effective dates, per its 2024 annual report.

Clinical Safety of GoodRx Care Telehealth Services

GoodRx Care (formerly HeyDoctor) offers virtual consultations for conditions including urinary tract infections, erectile dysfunction, hair loss, birth control, and cold sores. Providers can prescribe medications during these visits.

The clinical safety of any telehealth service depends on three factors: provider credentialing, prescribing appropriateness, and follow-up protocols. GoodRx Care states that all providers are board-certified physicians, nurse practitioners, or physician assistants licensed in the patient's state. Telehealth best practice calls for verified provider credentials, complete clinical documentation, and clear protocols for referral to in-person care when needed.

One limitation of GoodRx Care's model is the scope of conditions treated. The platform focuses on straightforward, protocol-driven conditions. For complex medical needs, hormone therapy management, or conditions requiring lab monitoring, a platform like HealthRX.com that pairs ongoing clinical oversight with prescribing may be a better fit. The Endocrine Society's testosterone therapy guideline recommends baseline and follow-up lab monitoring (hematocrit, PSA, lipids), which episodic telehealth visit models are not designed to manage.

Patient surveys of telehealth visits generally report high satisfaction, though satisfaction drops when patients need follow-up that the platform does not provide. GoodRx Care does not currently offer ongoing care coordination or chronic disease management programs.

Data Security Practices Post-Settlement

Following the FTC order, GoodRx implemented several technical and organizational changes. The company appointed a Chief Privacy Officer, engaged independent assessors (as mandated by the FTC), and restructured its SDK integrations to remove advertising trackers from health-related data flows.

GoodRx's current privacy policy states that the company does not share personal health information with advertising platforms. The policy discloses that GoodRx does share data with PBMs and pharmacy partners for transaction processing, which is necessary for the discount service to function.

The company also points to independent security assessments of its core platform covering access controls, encryption, and monitoring. SOC 2, one such audit framework, is widely used in health technology, though it is not a substitute for HIPAA compliance.

For users who want to minimize data exposure, GoodRx allows account deletion through its app settings. Users can also use GoodRx's coupon codes without creating an account by searching prices on the website and presenting the printed or screenshot code at the pharmacy, though this approach limits access to some features.

Who Should Use GoodRx and Who Should Look Elsewhere

GoodRx works best for uninsured or underinsured consumers filling generic prescriptions at retail pharmacies. KFF analyses count more than 25 million Americans under age 65 without health insurance, and generic drugs make up roughly 90% of all U.S. prescriptions dispensed, according to the FDA. For this population, GoodRx can reduce out-of-pocket costs by 40% to 80% on common generics like metformin, lisinopril, and atorvastatin.

GoodRx is less useful for patients on specialty medications, biologics, or brand-name drugs still under patent. These medications are often priced above $500 per month, and manufacturer patient assistance programs or specialty pharmacy benefits typically offer deeper discounts than PBM-negotiated cash prices.

Patients managing ongoing hormone therapy, GLP-1 medications, or testosterone replacement should consider platforms that integrate clinical monitoring with prescription management. GoodRx can help with the pharmacy transaction, but it does not provide the lab oversight, dose titration, or provider continuity that evidence-based protocols require. Endocrine Society and AACE guidelines both emphasize the need for structured follow-up in hormone prescribing, a service model that goes beyond discount code aggregation.