Rite Aid Shares Web Visitors’ Info with Third Parties Without Consent, Class Action Says

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action alleges Rite Aid discloses website visitors’ personal and health information to Meta (formerly Facebook) and other third parties without their knowledge or consent.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 78-page lawsuit out of California claims that when customers visit RiteAid.com to fill a prescription, invisible tracking tools embedded into the website secretly transmit information about their medical history, mental and physical condition, and treatment to Meta, Google, TikTok and other companies. According to the filing, this data is used by Rite Aid and the third parties it partners with to improve their targeted advertising capabilities.

The pharmacy chain’s alleged data-sharing practices run contrary to its privacy policies, which explicitly state that the company must obtain written authorization from customers before using or disclosing their health information for marketing purposes, the case says.

Per the filing, Rita Aid’s website contains a snippet of programming code known as the Meta pixel that sends to the social media giant data about each visitor as they interact with the page. The suit also alleges that the defendant uses similar technologies, such as Google Tag Manager, to transmit website users’ behavior to Google and other unauthorized third parties.

The complaint specifies that these “software-based wiretap” devices begin tracking customers after they sign into their RiteAid.com account and click on the “Refill Your Rx” button. By capturing consumers’ interactions with the site – i.e., the buttons, links, pages and tabs they click and view, and the search terms entered into text boxes – these tools reveal confidential information about an individual’s medical searches and treatment requests, the case explains.

As the case tells it, Rite Aid can also capture and disclose visitors’ names, email addresses, phone numbers, IP addresses, device IDs and Facebook IDs, which anyone can use to “quickly and easily” locate, access and view an individual’s Facebook profile.

“This massive breach of confidentiality and privacy has, on information and belief, affected millions of Rite Aid’s customers in the state of California as well as millions more nationwide,” the complaint states, claiming that the mishandling of such sensitive information has the potential to give rise to serious consequences, including “embarrassment, discrimination in the workplace and denial of insurance coverage.”

The filing contends that Rite Aid has violated its own privacy policy promises, the Health Insurance Portability and Accountability Act (HIPAA) and several federal and state statutes by failing to secure website visitors’ permission before tracking and sharing their highly confidential information.

The lawsuit looks to represent anyone in California who used Rite Aid’s website to refill a prescription and whose protected health information was disclosed or transmitted to Meta or any other unauthorized third party.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.