Published September 19, 2026

You've probably used CVS.com or their app to refill a prescription, check store hours, or look up why your stomach has been hurting. What you didn't know is that an ad-tech company called Criteo was right there with you.

A massive new class-action lawsuit claims that CVS quietly embedded tracking tech into its digital platforms, sending user health info, search queries, and browsing habits to third-party advertisers without asking anyone's permission. CVS and Criteo aren't admitting to any wrongdoing, but they've just agreed to pay $20.5 million to make the problem go away before it hits a courtroom.

If you used their site or app in the US before July 27, 2026, you're officially part of the settlement. A judge still has to give the final green light this December, but the paperwork is already moving.

The Frustrating Part

Nobody actually hacked CVS. This wasn't some sophisticated data breach by cybercriminals. The company installed these tracking pixels on purpose because that's just how modern digital marketing works. They wanted to track ad performance and retarget customers, but they conveniently forgot to clearly tell anyone about it.

And when you're a pharmacy, a "standard tracking pixel" stops being standard. It's logging searches for heart medication, pregnancy tests, or diabetes symptoms — things you definitely don't want feeding into an ad network's algorithm.

This Isn't Just a CVS Problem

Tracking pixels, session recorders, and third-party cookies are the backbone of the modern internet. Almost every major retail and healthcare site uses them to track your clicks. The only reason CVS got caught in the crosshairs is because medical data carries heavy legal sensitivity.

Check What's Actually Running on a Site

You can't check what a specific site like CVS is doing behind the scenes after the fact — no browser exposes that to anyone, including me. What you can check is how exposed your own browser is right now. Run the free Ad Tracker Blocking Test or use the Am I Being Tracked? tool to see how many known trackers can currently reach your browser, and whether your blocker is actually stopping them. Not sure what a "tracking pixel" or "third-party cookie" actually is? Check the glossary of tracking terms for simple definitions.

What Actually Protects You

Stop relying on "Reject All" cookie banners — they often don't even block trackers that already fired before you clicked anything. Turn on Global Privacy Control (GPC) in your browser settings so your opt-out signal is legally binding under privacy laws like CCPA — just know it only covers data that's already been collected, it doesn't stop the tracker from loading on the page in the first place. Better yet, install a proper blocker like uBlock Origin or switch to a privacy-first browser like Brave. Until the underlying business model of the internet changes, taking your privacy into your own hands is pretty much the only option left.

CVS won't be the last company to get caught doing this — it's just the first one to get caught doing it with your medical history. Next time, check before you find out from a lawsuit.