INDIANAPOLIS – A class action lawsuit claims online pharmacy Rite Aid shared the private health information of customers with social media websites and other customers.

According to the lawsuit, when customers visit the Rite Aid website to request a prescription be filled, they are instantly tracked. The website, with tracking tools that are invisible to the consumer, is allegedly gathering names, phone numbers, emails, addresses, birthdays, medical conditions, treatments, providers, information and more. 

The sale and purchase of Americans’ personal information is a billion-dollar industry, and Rite Aid was allegedly selling collected information to Meta, Google, TikTok and more. Those sites are interested in that kind of information because it helps them target you for advertising.

Even if you don’t use Rite Aid, this case illustrates the importance of knowing the privacy and sharing policies of any website you visit, especially if you have to log in with private information.

The Rite Aid website has an option where you can check “do not sell or share my personal information.” However, it is virtually hidden at the bottom of the page. Further down on the page, the privacy statement says, “We may otherwise continue to share your personal information with our affiliates in service providers, and as otherwise directed by you, for the purpose as described in our policy.”

It’s not exactly clear what that means.

The policy also says Rite Aid may charge a “reasonable fee” to comply with a privacy request.

While there is no national privacy law to protect against this, Indiana recently became the seventh state to pass a comprehensive privacy law. It allows Hoosiers to opt out of the processing and sale of personal data for targeted ads. However, the law doesn’t take effect until 2026, and company websites are getting better at getting around such laws all the time. It’s certainly no time to start letting your guard down.