People who accessed CVS websites or the CVS mobile app in the United States before July 27, 2026, may be included in a proposed digital-privacy settlement involving CVS Pharmacy and advertising technology company Criteo. Class members can submit a claim for up to $5 without documentation or up to $10 with reasonable proof of class membership.
The deadline to submit a claim online or by mail is November 16, 2026. The separate deadline to opt out or object is November 1, 2026. Payments can be reduced proportionately if the approved claims and other covered settlement costs exceed the agreement's $20.5 million maximum.
The lawsuit alleges that technology embedded in CVS digital properties disclosed users' health or private information, personal information, browsing data, identifiers, or other data to Criteo or other third parties. CVS and Criteo deny violating the law. The court has not decided which side is right, and the settlement still requires final approval.
Key facts
- Case: Brewer et al. v. CVS Pharmacy, Inc. and Criteo Corp., No. CACE-26-008094
- Court: Circuit Court of the 17th Judicial Circuit in and for Broward County, Florida
- Who may be included: All living people who accessed CVS digital properties in the United States before July 27, 2026, subject to the settlement definition and exclusions
- Covered digital properties: CVS.com, CVSHealth.com, the CVS mobile app, and other CVS digital or web-based properties
- Benefit without documentation: Up to $5
- Benefit with reasonable documentation: Up to $10
- Maximum settlement obligation: $20.5 million, including approved claims, administration, attorneys' fees and costs, and service awards
- One-payment rule: No more than one cash payment per household
- Opt-out and objection deadline: November 1, 2026
- Claim deadline: November 16, 2026
- Final approval hearing: December 1, 2026, at 9:30 a.m. Eastern Time
- Current status: Proposed settlement awaiting final approval
In this article
- What happened
- Who CVS and Criteo are
- How the CVS digital properties work
- What the lawsuit alleges
- What laws and privacy concepts are involved
- Who may be included
- What the settlement offers
- How to file a claim
- Case timeline and current status
- What remains disputed or unknown
- What happens next
- Frequently asked questions
What happened
Four plaintiffs brought a proposed class action against CVS Pharmacy, Inc. and Criteo Corp. over the alleged operation of technology embedded in CVS websites and the CVS app. According to the filed settlement agreement, the plaintiffs claim that the technology disclosed several categories of user data to Criteo or other technology providers or third parties.
The parties did not litigate the case through a trial. The agreement says counsel discussed an early resolution before the complaint was filed, participated in mediation on March 17, 2026, and continued negotiating afterward. The plaintiffs filed the complaint on May 15, 2026. The parties then entered a settlement that remains subject to the court's approval.
The court-authorized notice describes the case as a proposed settlement, not a judgment that either defendant broke the law. CVS and Criteo deny liability and wrongdoing. The settlement lets the defendants resolve the covered claims while avoiding continued litigation costs and lets class members seek limited cash benefits without waiting for a trial and possible appeals.
What changed The court-authorized claim process is open. Class members who want a cash benefit must submit a valid claim by November 16, but payments will not be issued unless the settlement becomes final.
Who CVS and Criteo are
CVS Pharmacy operates retail pharmacy services and digital tools that consumers use for prescriptions, appointments, shopping, rewards, and other health-related tasks. CVS's official app page says users can refill and track prescriptions, schedule MinuteClinic appointments and vaccinations, manage ExtraCare rewards, and arrange delivery or store pickup. Those functions explain why a dispute about data transmitted from CVS digital properties may concern information connected to health interests as well as ordinary browsing activity.
Criteo is an advertising technology company. The settlement agreement describes Criteo as providing advertising support, including on the CVS website and app. Criteo describes its broader business as a commerce media platform that helps businesses use data and technology to reach shoppers and measure advertising performance.
The lawsuit does not allege that every visitor used every CVS service or that every covered interaction transmitted the same information. The class definition is based on access to the CVS digital properties before the cutoff date. Whether a particular claim is valid remains subject to the settlement administrator's review.
How the CVS digital properties work
The agreement defines CVS Digital Properties broadly. The term includes CVS.com, CVSHealth.com, the CVS iOS or Android app, and other digital or web-based properties operated by CVS or related entities.
A website or app can contain code supplied by another company for functions such as advertising, analytics, measurement, or personalization. This case concerns the plaintiffs' allegation that embedded technology transmitted protected or private data from CVS digital properties to Criteo or other third parties.
The fact that a site uses third-party technology does not itself establish an unlawful interception or disclosure. The legal questions can depend on what information was transmitted, how the technology operated, what notice or consent was provided, and how federal or state law applies. The settlement resolves the asserted and related claims without a finding on those issues.
What the lawsuit alleges
The plaintiffs allege that CVS digital properties disclosed health or private information, personal information, browsing data, identifiers, or other user data to Criteo or other technology providers or third parties. The asserted claims include an alleged violation of the federal Electronic Communications Privacy Act, state statutory claims, breach of confidence, invasion of privacy, and negligence or negligence per se.
An identifier is data that can distinguish or help recognize a user, device, account, or browser. Browsing data can describe pages viewed, searches made, selections, or other interactions. The settlement documents group several types of data in the allegations, but they do not establish in the notice that every class member had the same specific data disclosed.
The defendants deny the allegations and expressly disclaim fault or liability. The court has not determined that the challenged technology intercepted a communication, that the transmitted information was legally protected, that consent was absent, or that any person suffered a particular loss.
Allegations are not findings The settlement documents record the plaintiffs' claims and the defendants' denials. They do not establish that CVS or Criteo unlawfully disclosed any particular person's information.
What laws and privacy concepts are involved
The complaint includes a claim under the Electronic Communications Privacy Act, or ECPA. ECPA is a federal law that includes restrictions on certain interceptions and disclosures of electronic communications. In this case, the plaintiffs invoke that framework in connection with technology allegedly embedded in CVS digital properties.
A breach of confidence claim generally concerns information allegedly shared in circumstances where a duty of confidentiality existed. Invasion of privacy is a category of claims addressing alleged interference with a person's private affairs. Negligence per se is a theory under which an alleged violation of a statute or regulation may be used to establish part of a negligence claim when the legal requirements are met.
Those descriptions explain the claims, not their merits. The settlement avoids a decision about whether the technologies and data at issue satisfy each legal element. It also avoids a decision about defenses that CVS or Criteo might have raised if litigation continued.
Who may be included
The court-authorized definition covers all living individuals who accessed the CVS Digital Properties in the United States before July 27, 2026. The agreement's definition of the digital properties includes CVS.com, CVSHealth.com, the CVS app, and other CVS digital or web-based properties.
The definition does not require the notice to identify a particular prescription, medical condition, purchase, or page. It also does not mean every visitor automatically receives money. A person must submit a valid claim, and the administrator will determine whether the submission meets the settlement's requirements.
The agreement allows only one cash payment per household. It defines a household as all people residing at the same mailing address. That rule can matter when several people at one address accessed CVS digital properties.
Anyone uncertain about class membership can review the official notice or contact the settlement administrator. Class Action Pulse cannot determine whether an individual qualifies or whether submitted documentation will be accepted.
The class is access-based The definition turns on accessing a covered CVS digital property in the United States before July 27, 2026. It does not promise that every visitor's claim will be approved.
What the settlement offers
A class member may choose one of two cash-payment paths:
- Cash Payment A: Up to $10 with reasonable documentation supporting membership in the settlement class.
- Cash Payment B: Up to $5 without documentation.
The agreement gives nonexclusive examples of documentation that may support interaction with CVS digital properties, including browser history or screenshots. The official claim process controls what a claimant must provide, and the administrator may review a submission for completeness, duplication, or fraud.
The agreement calls $20.5 million the Maximum Cash Payment. That does not mean $20.5 million will be divided only among claimants. The cap includes cash payments, settlement administration costs, court-approved attorneys' fees and costs, and service awards. Class counsel may request fees and expenses up to 37.5% of the maximum, and service awards of up to $2,500 for each class representative. The court can award less.
If the total covered benefits and costs exceed the maximum, cash payments will be reduced proportionately. The agreement also says residual money remaining after valid claims and other covered benefits are paid will revert to the defendants under a separate allocation between CVS and Criteo.
The $20.5 million figure is a cap It includes claims and other approved settlement costs. Individual benefits are listed as “up to” $5 or $10 and may be reduced if total obligations exceed the maximum.
How to file a claim
Claims can be submitted at the court-authorized website, CVSDigitalPrivacySettlement.com. The site also provides a paper claim form that can be mailed to the administrator.
An online claim must be submitted by 11:59 p.m. Eastern Standard Time on November 16, 2026. A mailed claim must be postmarked by November 16. The official materials list PayPal, Venmo, Zelle, or check as payment options for approved claims.
People who want to exclude themselves must send a valid exclusion request by November 1. Exclusion means giving up settlement benefits while preserving any individual rights that may otherwise exist, subject to applicable law. An objection is different. A class member who objects remains in the settlement and asks the court not to approve some or all of it. Objections are also due November 1 and must satisfy detailed filing and service requirements in the official notice.
Class members who remain in the settlement will release covered claims if the agreement becomes final, whether or not they submit a claim. The release is more detailed than this article. Anyone weighing exclusion, objection, or separate litigation should read the settlement agreement and consider speaking with a lawyer.
Case timeline and current status
- Before March 2026: The agreement says plaintiffs' counsel contacted defense counsel about possible early resolution before filing the complaint.
- March 17, 2026: The parties attended mediation with a JAMS mediator.
- Following mediation: The parties continued negotiations and reached agreement on material settlement terms.
- May 15, 2026: The plaintiffs filed the putative class complaint in Broward County Circuit Court.
- July 27, 2026: The cutoff date used in the settlement class definition.
- November 1, 2026: Deadline to request exclusion or object.
- November 16, 2026: Deadline to submit a claim.
- December 1, 2026: Scheduled final approval hearing.
A putative class action is a case filed on behalf of a proposed group before the court has finally approved or certified that group for litigation. Here, the court authorized notice and a claims process for settlement purposes. It has not entered final approval or decided the underlying allegations.
The final hearing is scheduled to occur virtually at 9:30 a.m. Eastern Time. The official site warns that the court may change the date or time. Class members should check the settlement website for current information.
What remains disputed or unknown
CVS and Criteo deny violating any law and deny the lawsuit's allegations. The settlement is not an admission of liability. The court has not decided what information any specific user's interaction transmitted, whether the transmission was legally actionable, or whether the plaintiffs could prove their claims at trial.
The final amount for an approved claimant is also unknown. The advertised values are maximums. The payment can be reduced if claims and other approved costs exceed the $20.5 million cap.
The court has not yet approved the requested attorneys' fees, costs, or service awards. It also has not finally approved the settlement. Claims can be rejected or reduced under the administrator's procedures, and payment timing depends on final approval and any appeals.
What happens next
Class members who want a cash benefit must submit a claim by November 16. Anyone considering exclusion or an objection faces the earlier November 1 deadline.
At the December 1 hearing, the court will consider whether the settlement is fair, reasonable, and adequate, along with the request for attorneys' fees, costs, and service awards and any valid objections. If the court grants final approval and the agreement becomes effective, approved payments are scheduled for 120 days after final approval or completion of any appeal process.
This article provides legal news and general information. It does not determine class membership, guarantee payment, or recommend whether anyone should claim, object, exclude themselves, or pursue separate legal action.
Frequently asked questions
Who may qualify for the CVS digital privacy settlement?
All living people who accessed CVS digital properties in the United States before July 27, 2026, may be included, subject to the official definition, exclusions, household rule, and claim review.
How much can a claimant receive?
A valid claimant may receive up to $5 without documentation or up to $10 with reasonable proof of class membership. Payments can be reduced proportionately.
What counts as proof?
The agreement gives browser history and screenshots as examples of reasonable documentation showing interaction with CVS digital properties. The official claim form and administrator determine whether a submission is sufficient.
Can more than one person at an address claim?
The agreement allows no more than one cash payment per household, defined as all people residing at the same mailing address.
What is the claim deadline?
Online claims must be submitted and mailed claims postmarked by November 16, 2026. Requests for exclusion and objections are due November 1.
Has the settlement received final approval?
No. The settlement awaits a final approval hearing scheduled for December 1, 2026. The defendants deny wrongdoing, and the court has not decided the merits of the allegations.