CVS Digital Privacy Settlement 2026: If you’ve ever refilled a prescription through the CVS app, booked a flu shot on CVS.com, or just looked up whether the store down the road carries a certain brand of sunscreen, there’s a decent chance you’re owed a few dollars. Not a life-changing amount, but real money, and the window to ask for it closes on Monday, November 16, 2026. That’s about two weeks from now.
The money comes from a $20.5 million class action settlement over claims that CVS let an advertising company track people on its websites and app. CVS says it did nothing wrong. The people who sued say otherwise. A Florida judge has signed off on the deal so far, but not for good, and the final decision is still a month away.
Below is everything worth knowing, drawn from the official settlement website, the court documents it links to, and reporting from outlets like CNBC, The Hill, AARP and USA Today. I’ve tried to keep it plain. These notices are long and full of legal phrasing, and most people just want to know three things: Do I qualify? How much? What do I have to do?
Highlight of CVS Digital Privacy Settlement 2026
- Who qualifies: Anyone in the U.S. who accessed CVS.com, CVSHealth.com, or the CVS app before July 27, 2026.
- What you can get: Up to $5 with no proof, or up to $10 if you can document that you used the site or app.
- Claim deadline: November 16, 2026. Online claims are due by 11:59 p.m. Eastern. Mailed claims must be postmarked by that date.
- Limit: One claim per household.
- Final approval hearing: December 1, 2026, at 9:30 a.m. Eastern, by Zoom.
- Official website: CVSDigitalPrivacySettlement.com
- Payment timing: Roughly 120 days after the settlement is finally approved and any appeals are resolved.
One more date to know about, and it’s today: November 1 was the deadline to opt out of the settlement or object to it. More on that further down.
CVS Digital Privacy Settlement 2026 History
The case is called Brewer, et al. v. CVS Pharmacy, Inc. and Criteo Corp. It sits in the Circuit Court of the 17th Judicial Circuit in Broward County, Florida, under Case No. CACE-26-008094. Judge Shari A. Olefson is overseeing it.
The plaintiffs claim that tracking technology embedded in CVS’s websites and mobile app passed information about visitors to Criteo, a digital advertising company, and possibly to other outside technology providers. According to the settlement materials, that information could include browsing activity, personal identifiers, and in some cases health-related details. The lawsuit raised claims under the federal Electronic Communications Privacy Act, along with state-law claims for invasion of privacy, breach of confidence, and negligence.
If you’ve read anything about “tracking pixels” in the last few years, this will sound familiar. A pixel is a tiny piece of code that a website installs so an outside company can see what visitors do on the page. Advertisers love them, because they let a company follow you from one site to another and serve you ads for the thing you just looked at. Privacy lawyers don’t love them, especially when the website in question is a pharmacy. Searching for a medication or scheduling a vaccine appointment isn’t quite the same as browsing sneakers, and a wave of lawsuits against hospitals, telehealth companies and pharmacy chains has made that argument over and over.
CVS doesn’t agree with the claims. A company spokesperson told USA Today and other outlets that CVS stands by its privacy practices and believes they comply with applicable laws, adding that the settlement resolves claims based on legal theories challenging common online industry practices. In a statement to CNBC Select, the company said it settled to avoid the expense and distraction of a long court fight. Criteo has denied wrongdoing too. The court hasn’t decided who’s right, and it isn’t going to. That’s what a settlement means.
One detail that surprised me: according to reporting by Settlement Insight, which went through the settlement agreement, this case was largely settled before it was formally filed. The lawyers for the plaintiffs reached out to CVS and Criteo first, the sides mediated in March 2026 through JAMS, and the complaint wasn’t filed until May 15. Judge Olefson granted preliminary approval on July 27, which is the date that now defines who’s in the class. That’s not unusual in privacy litigation, but it explains why things moved so fast.
Newfoundland and Labrador Disability Benefit Payment Dates, Amount, Eligibility and How to Apply?
BC Income and Disability Assistance Payment Dates, Amounts, Eligibility and How to Apply
Did You Buy Generic Drugs? How to File a Sun and Taro Price Fixing Settlement Claim Before Nov. 9
22% Social Security Cut: What It Means for Your Monthly Check
Who qualifies for CVS Digital Privacy Settlement 2026
The settlement class is defined as all living individuals who accessed the CVS digital properties in the United States before July 27, 2026. The “digital properties” are:
- CVS.com, the main retail and pharmacy website
- CVSHealth.com, the corporate site
- The CVS mobile app
That’s the whole test. You don’t need to have bought anything. You don’t need an account, a loyalty card, or a prescription filled at CVS. You don’t need to have visited more than once. If you opened the site or the app from a computer, phone or tablet while you were in the United States before that cutoff date, you’re in the class.
This is a bigger group than it sounds. The settlement agreement itself describes CVS as a company with more than 36 million customers, and the class reaches beyond customers to anyone who simply visited the websites. People looked up store hours. They checked the weekly ad. They scheduled a COVID booster, printed photos, compared allergy medicine prices. All of that counts.
A couple of things that do not count on their own:
- Walking into a CVS store and paying at the register. An in-store purchase doesn’t establish that you accessed the website or app. If you also checked your ExtraCare rewards on the app or looked something up on the site, that’s different.
- Visiting after July 27, 2026. The class closes at the preliminary approval date.
Who’s left out: CVS and Criteo officers, directors and employees, the judge and court staff, government entities, and anyone who formally opted out.
“I never got an email”
Lots of people got an email titled “Legal Notice of Class Action Settlement” with a personal Login ID and PIN in it, and a lot of those people assumed it was spam. (More on scams below.) But not getting the email doesn’t mean you’re out. The class is defined by what you did, not by what landed in your inbox. If you believe you used the site or app, you can still file a claim on the official website without a Login ID or PIN.
Payment Amount for CVS Digital Privacy Settlement 2026
Two payment tiers, and the only difference between them is paperwork.
Up to $5 if you don’t provide any documentation. You just attest that you’re a class member.
Up to $10 if you can provide reasonable documentation showing you accessed CVS’s digital properties.
Both amounts are “up to,” and that phrase matters. If more people file than the settlement can cover, the payments get cut back proportionally. The agreement calls this a pro rata reduction. I’ll explain below why that could happen.
Also worth stating clearly: one payment per household. The settlement defines a household as everyone living at the same mailing address. If you and your spouse and your two teenagers all use the CVS app, your household gets one payment, not four. Duplicate claims from the same address will be denied. So it’s worth a quick conversation at home before anyone files separately.
As for how you’ll be paid, the settlement site lists PayPal, Venmo, Zelle, and a paper check as options. Checks expire if you don’t cash them within 180 days. And the FAQ notes you may be responsible for any taxes that apply, which for a payment this size is something to mention more than something to worry about.
Documents required for CVS Digital Privacy Settlement 2026
According to the settlement documents, reasonable documentation can include things like:
- Browser history showing visits to CVS.com
- Dated screenshots, for example of your CVS account, an app screen, or an order page
- Email receipts or confirmations from online purchases or appointments
A statement from you saying “I used the app” doesn’t count as documentation on its own. That’s basically the $5 tier.
Here’s a thing that’s easy to miss, and it’s a friendly rule: if you submit proof for the $10 and the administrator decides it isn’t good enough, and you don’t fix it, your claim isn’t thrown out. It gets treated as a $5 claim instead. So there’s really no downside to trying.
Where to look for proof, if you want to try for the $10:
- Your email. Search your inbox for “CVS.” Order confirmations, shipping notices, photo-print receipts, vaccine appointment reminders and prescription-ready notices are all good candidates. Take a screenshot that shows the date.
- Your browser history. Chrome, Safari and Edge all let you search history by site. Type “cvs” and see what comes up. Be aware that many people clear history regularly, and some browsers only keep 90 days, so this may or may not work.
- The CVS app or account. Your order history and prescription history sit inside your account. A screenshot of a past order with a visible date should do the job. If none of that turns up, don’t sweat it. File for the $5. Since the class definition is about access, not harm, you aren’t being asked to prove that your data went anywhere.
$3000 Stimulus Payment 2026: Full Fact-Check & Current Status!
CalFresh Payment Schedule and Recertification: Deposit Dates, Renewal Steps and the New Work Rules
Cash App $15 Million Settlement Is Finally Paying Out: Who Qualifies and What to Expect
How to file a claim, step by step process
The whole thing takes about five minutes if you’re not hunting for proof.
Online (the easy way):
- Go to CVSDigitalPrivacySettlement.com. Type it in yourself rather than clicking a link in an email or text.
- Find the claim form. If you got a notice with a Login ID and PIN, enter them. If you didn’t, there’s an option to file without them.
- Fill in your name, address and contact details.
- Confirm you accessed the CVS digital properties before July 27, 2026.
- If you have documentation, upload it for the $10 tier. If not, skip it.
- Choose how you’d like to be paid: PayPal, Venmo, Zelle or check.
- Submit, and save the confirmation.
By mail:
Download the PDF claim form from the website, print it, fill it out and send it to:
CVS Digital Privacy Settlement c/o Settlement Administrator P.O. Box 1110 Costa Mesa, CA 92628
The envelope has to be postmarked by November 16. If you can’t print, you can email the administrator at info@CVSDigitalPrivacySettlement.com and ask for a form. The settlement administrator is Simpluris, and its phone number, listed on the settlement site, is (888) 654-1271.
A small flag on dates. At least one widely syndicated news report gave the mail-in deadline as November 6. That doesn’t match the official claim form, which says online or postmarked by November 16. If you’re mailing, though, don’t cut it close. Send it this week.
Important Dates
| Date | What happens |
|---|---|
| July 27, 2026 | Preliminary approval; the class cutoff date |
| October 17, 2026 | Deadline for class counsel to post their fee request on the settlement website |
| November 1, 2026 | Opt-out and objection deadline |
| November 16, 2026 | Claim deadline (online by 11:59 p.m. Eastern, or postmarked) |
| December 1, 2026, 9:30 a.m. Eastern | Final approval hearing by Zoom |
| About 120 days after final approval | Payments go out, if there are no appeals |
Do the math and you land somewhere around spring 2027 for money in hand, assuming the judge approves the deal on or soon after December 1 and nobody appeals. Appeals would push that back. The official site says the hearing date can change, so if you care, check it for updates in late November.
Opting out, objecting, or doing nothing
Everyone in the class has three options, and the first one has already expired as of today.
File a claim and stay in. This is what most people will do. You get a payment, and in exchange you give up the right to sue CVS, Criteo and the other released parties over the claims in this case. That applies whether or not you file, as long as you don’t opt out, so the practical question is whether you’d like to be paid for the release.
Opt out. The deadline was November 1, so if you’re reading this on the day this article is published, check the settlement website immediately to see the exact cutoff time. Opting out means you get no money from the settlement, but you keep the right to bring your own lawsuit. For most people who used a pharmacy website, that isn’t a realistic path. A solo suit over a few tracking cookies is expensive and slow. If you had a particular reason to be alarmed, for example you believe sensitive health information about you specifically was exposed, then talking to a lawyer before the deadline would have made sense.
Object. Same deadline. If you stay in the settlement but think the terms are unfair (the lawyers’ cut gets complaints in cases like this), you can file a written objection with the court. The rules for doing that are detailed. Objections go to the court and to lawyers on both sides, and the FAQ asks for specific disclosures. Objecting only makes sense if you’re staying in, since someone who opts out is no longer part of the case.
Do nothing. You get no money, and you’re still bound by the release. That’s the worst of both worlds, which is why filing the claim is the sensible choice for most people.
The News about that $20.5 million
You’ll see “$20.5 million settlement” in headlines. It’s accurate but easy to misread. Here’s what the settlement agreement says, as summarized by Settlement Insight and consistent with the other coverage I found.
The $20.5 million is a ceiling, not a guaranteed pot to be divided. The agreement calls it the “Maximum Cash Payment,” and it has to cover everything: the payments to class members, the cost of running the claims process, the attorneys’ fees and expenses the court approves, and service awards to the people who brought the suit.
Class counsel can ask for up to 37.5 percent of that amount in fees. That works out to roughly $7.7 million. The class representatives can request service awards of up to $2,500 each. The fee request was due to be posted on the settlement website by October 17, and the judge will rule on it at or around the December 1 hearing. If you want to see exactly what the lawyers asked for, it’s in the “Important Documents” section of the official site. I haven’t seen the final filed number, so I’m not going to guess at it.
Take out fees and administration costs, and the pool left for claimants is somewhere around $12.8 million. At $5 a household, that’s enough for about 2.5 million claims. At $10, it’s roughly 1.3 million. If the number of valid claims goes above what the fund can pay, everyone’s payment shrinks.
The opposite scenario is the one that gets less attention. If relatively few people file, which is what usually happens in these settlements, the money doesn’t roll over to claimants or to a charity. The agreement says any leftover funds revert to the defendants, to be handled under a separate arrangement between CVS and Criteo. So the people who never file don’t help anyone but the companies. Whether that bothers you is your call. It’s just useful to know how the structure works.
Watch out for scams
Whenever a settlement this big goes public, copycats follow. A few ground rules that apply here and everywhere:
- Filing a claim is free. Nobody legitimate will ask for a fee, a “processing charge,” or your credit card number.
- The only real website is CVSDigitalPrivacySettlement.com. Type it manually. Be suspicious of lookalike domains and of links in texts.
- You will not be asked for your Social Security number or bank login. Payment is through PayPal, Venmo, Zelle or a mailed check, and the claim form asks for payment details you’d expect for that.
- Check the email carefully. The real notice used the subject line “Legal Notice of Class Action Settlement” and included a Login ID and PIN. Reports from people who got it show it matched the notice on the official site. But a sender name can be faked, so go to the website directly rather than clicking through.
- Be wary of anyone offering to file for you. Some “claim services” will charge a cut. You don’t need one.
When in doubt, call the administrator’s number listed on the settlement website, or email the address given there.
FAQ’s
Do I need to have an account or have bought something?
No. Accessing the site or app before July 27, 2026 is enough.
My spouse and I both used the app. Can we both file?
No. One payment per household, meaning per mailing address.
I live in a different state than Florida. Does that matter?
No. The case is in Florida court, but the class covers people who accessed the properties anywhere in the United States.
I never got a notice. Am I out of luck?
No. File on the official website without a Login ID and PIN, or mail the paper form.
Is the payout guaranteed?
No. The judge still has to give final approval, and the amount could be reduced. If there’s an appeal, things slow down.
When will I be paid?
The notice says 120 days after final approval and the end of any appeals. That points to spring 2027 at the earliest.
Where do I get reliable updates?
Only from CVSDigitalPrivacySettlement.com. Check it after the December 1 hearing.
If you’ve touched CVS online in any way before late July, filing takes a few minutes and could pay you $5 to $10 for it. You have until Monday, November 16, to submit, and I’d suggest doing it this week so it’s not sitting on a to-do list while the days run out.
The bigger story here isn’t the five bucks. It’s that a pharmacy giant and an ad-tech company agreed to pay up to $20.5 million, with no admission of fault, to resolve claims that the stuff you click on at a drugstore website might have followed you around the internet. You can decide for yourself how much weight to give that. But the claim form is free, the deadline is firm, and no one else is going to file it for you.
