A settlement of up to $20.5 million will resolve claims that CVS and the advertising technology firm Criteo disclosed the data of CVS website and app users to third parties without consent. The class is defined by something almost everyone has done: opening the site.
There is no purchase requirement. No prescription requirement. No account requirement. If you accessed CVS.com, CVSHealth.com or the CVS mobile app in the United States at any point before 27 July 2026, you fall inside the class definition. Claims close on 16 November 2026.
The class
| Who | All living individuals who accessed CVS digital properties in the United States |
| Which properties | CVS.com, CVSHealth.com and the CVS mobile app |
| When | At any time prior to 27 July 2026 |
| Payment without proof | Up to $5 |
| Payment with proof | Up to $10 |
| Claim deadline | 16 November 2026 |
| Final approval hearing | 1 December 2026 |
What “with proof” actually means here
Doubling $5 to $10 is not a life-changing difference, but the documentation the administrator will accept is unusually easy to produce:
- Browser search history showing visits to a CVS site
- Screenshots that show dates
- Email receipts from online purchases
An order confirmation sitting in your inbox from any CVS online purchase is sufficient. Searching your mail for “CVS” takes about fifteen seconds, and if something comes back, you are in the higher tier.
Why “up to” $20.5 million
The figure is a ceiling rather than a fixed pot. Individual payments are reduced proportionally if the volume of claims is high enough to exhaust the available fund.
With a class this broad, that is a realistic outcome rather than boilerplate. The $5 and $10 numbers should be read as maximums, and the final amount depends on how many of the many millions of eligible people actually file.
The allegation
The case — Brewer et al. v. CVS Pharmacy, Inc. and Criteo Corp., Case No. CACE-26-008094 in Florida — alleged that embedded online tracking technologies on CVS digital properties passed user data to third parties without consent, in breach of the federal Electronic Communications Privacy Act of 1986.
This is the same shape of claim that has produced a run of settlements against large retailers and health systems over the past two years: pixels, tags and software development kits placed on a website for advertising and analytics, which also transmit information about what a visitor looked at.
Why a pharmacy website is a sharper case than a shoe shop. What a person browses on a pharmacy site can imply a great deal about their health. That is why claims of this kind against pharmacies and hospital systems tend to settle rather than be litigated to a verdict — the potential exposure is larger, and so is the reputational cost of arguing about it in public.
The timetable is unusually tight
Most settlements give claimants the better part of a year. This one runs from a settlement announced in September 2026 to a claim deadline of 16 November 2026 and a final approval hearing on 1 December 2026.
That compression matters practically: there is little margin for a posted form to arrive late, and no second window. Filing online is the safer route.
Filing safely
The official address is CVSDigitalPrivacySettlement.com. A settlement whose class is “anyone who visited a website” is close to ideal material for imitation claim sites, so type the address in rather than following a link, and remember the two rules that never change: no legitimate settlement charges a fee to file, and none needs your card number to send you money.
Brewer et al. v. CVS Pharmacy, Inc. and Criteo Corp., Case No. CACE-26-008094, Florida. The settlement of up to $20.5 million covers all living individuals who accessed CVS digital properties, including CVS.com, CVSHealth.com and the CVS mobile app, in the United States at any time prior to 27 July 2026. Claims are due by 16 November 2026 and the final approval hearing is scheduled for 1 December 2026 at CVSDigitalPrivacySettlement.com.
Frequently Asked Questions (FAQ)
Do I need to have bought anything from CVS?
No. The class covers anyone who accessed CVS.com, CVSHealth.com or the CVS mobile app in the United States before 27 July 2026. Visiting is the qualifying act.
How much is the payment?
Up to $5 without proof and up to $10 with proof. Both are maximums — payments are reduced proportionally if claims exhaust the fund.
What counts as proof?
Browser search history showing visits, screenshots showing dates, or email receipts from online purchases.
What is the deadline?
16 November 2026, with the final approval hearing on 1 December 2026.
What was the lawsuit about?
It alleged that CVS and Criteo disclosed website and app user data to third parties without consent through embedded online tracking technologies, in breach of the Electronic Communications Privacy Act of 1986.
Where do I file?
CVSDigitalPrivacySettlement.com. Type the address into your browser rather than following a link from a message, and never pay a fee to file.
