CVS Class Action Lawsuit: Pharmacy Accused of "Wiretapping" Mobile App Users

Case Overview: A class action lawsuit claims CVS secretly tracked user data through a third-party software, violating the California Invasion of Privacy Act.

Consumers Affected: California residents who used the CVS Pharmacy app and had their data intercepted by Quantum Metric.

Court: U.S. District Court for the Northern District of California

CVS is under fire for allegedly enabling the secret interception of its mobile app users’ sensitive information through a third-party tracking system. A new lawsuit accuses the pharmacy giant of violating the California Invasion of Privacy Act by allowing Quantum Metric, Inc. (QM), an analytics service provider, to collect users’ personal and medical data without their knowledge or consent.

The lawsuit claims QM’s software, integrated into the CVS Pharmacy app, intercepted sensitive information in real-time, including users’ names, addresses, prescriptions, and browsing activity. 

CVS Accused of Secretly Tracking User Data Through Third-Party Software

California residents Ariel Brooks and Nora Borowsky filed the proposed class action lawsuit against the pharmacy, saying they both had their privacy breached by its practices. 

Brooks accessed the CVS Pharmacy app on her Android device in October 2024 to browse over-the-counter products and refill prescriptions. Borowsky, a long-time user of the app on her iOS device, reported similar activities in November 2024.

Both plaintiffs allege that their private communications with CVS were intercepted by QM’s software in real-time, capturing sensitive data such as their full names, email addresses, physical addresses, and specific medications viewed or purchased.

Neither Brooks nor Borowsky was informed of or consented to this data interception. The lawsuit alleges that CVS’s implementation of QM’s tracking system represents a significant breach of consumer trust.

Lawsuit Alleges CVS Violated California Privacy Law

QM’s software offers features like session replay, which creates detailed “video recordings” of user interactions on websites and apps. By capturing every click, scroll, and typed word, the software generates a comprehensive record of user sessions, according to the lawsuit.

In CVS’s case, the lawsuit claims that QM intercepted unencrypted personal and medical information in real-time, enabling detailed tracking of user behaviors and preferences. This information could reportedly be tied to specific individuals, raising significant privacy concerns.

The plaintiffs argue that CVS failed to properly configure QM’s tracking system to safeguard user data, leading to the exposure of sensitive information like prescription histories and vaccination records.

Other Companies Face Similar Lawsuits Over Data Tracking Practices

CVS isn’t the only company facing legal challenges over data tracking. Telehealth provider GoodRx recently agreed to a $25 million settlement after being accused of sharing users’ health information with third parties like Google and Facebook.

News outlets such as Politico, The Hill, and the LA Times have also been hit with lawsuits alleging unauthorized tracking of user data for targeted advertising purposes. Retailers like Puma and Home Depot have faced similar claims.

In their lawsuit, Brooks and Borowsky want to represent California residents who used the CVS app and had their electronic communications intercepted or recorded by QM. They are suing for violations of the California Invasion of Privacy Act, and seeking damages, interest, costs, and fees. 

Case Details

• Lawsuits: Brooks, et al. v. CVS Health Corporation and CVS Pharmacy, Inc., 
• Case Numbers: 4:24-cv-08990-DMR
• Court: U.S. District Court for the Northern District of California

Plaintiffs' Attorneys

• Ines Diaz Villafana and L. Timothy Fisher (Bursor & Fisher, P.A.)

Do you use the CVS Pharmacy app? What are your thoughts on this lawsuit? Share your opinion in the comments below.