CVS $20.5 million digital privacy settlement: See if you qualify and learn how to protect your data

Millions of CVS Pharmacy customers may be eligible for part of a $20.5 million class action settlement the chain has agreed to pay over claims it unlawfully shared consumer data with third parties.

In a complaint, multiple plaintiffs alleged user data from CVS digital properties was sold to advertising technology company Criteo in violation of the Federal Wiretap Act, the California Invasion of Privacy Act and other statutes.

CVS, which has more than 36 million customers nationwide, has not admitted any wrongdoing in the case. In a statement to CNBC Select, the company said it stands by its privacy practices and agreed to resolve the matter "to avoid the expense and distraction of prolonged litigation."

See if you're eligible for payment in the CVS settlement, how much you could receive and how to keep your data out of unwanted hands.

According to the settlement website, any U.S. resident who accessed CVS digital properties prior to July 27, 2026, may be eligible for a payout.

CVS digital properties include:

• The CVS website (CVS.com) and CVS app
• CVS Health website (CVSHealth.com)

You could be eligible for a payment of up to $10 if you can provide documentation that you are a settlement class member, such as email receipts or browser history records. Without documentation, you may be eligible for a $5 payment.

The final amount is subject to deductions for attorneys' fees and other costs. Payment may be issued via PayPal, Venmo, Zelle, or paper check.

Eligible class members must submit a claim online or by mail by 11:59 p.m. ET on Nov. 16, 2026.

Claim forms can be submitted online here, or you can download the form and mail it to the settlement administrator at:

CVS Digital Privacy Settlement
c/o Settlement Administrator
P.O. Box 1110
Costa Mesa, CA 92628

If you don't want to be part of the settlement or want to reserve your right to sue CVS independently, you'll need to submit a written notice by Nov. 1, 2026.

The final approval hearing is scheduled for Dec. 1, 2026. If the court approves the settlement, cash payments will be issued 120 days after final approval.

Any appeals may slow down the process, however.

Data brokers and other companies collect demographic information, Social Security numbers, driver's licenses, browsing histories, biometrics and employment and education records, among other records.

By law, data brokers must remove your information upon request. You can do it yourself for free, but finding the right page, submitting a request and verifying it was completed can be tedious and confusing.

Data removal companies like DeleteMe and Incogni advertise that they can remove your personal identifying information (PII) from data brokers' files, reducing the odds that your identity will be compromised.

These platforms can't delete social media or public records (like deeds or bankruptcy filings) and they can't affect what's on the dark web. 

Most strategies focus on responding to identity theft after the fact, but there are some preventative measures you can take. Be mindful of what you share on social media, think carefully before opening email links or attachments and avoid public Wi-Fi if you're shopping or banking online.

Other useful tips include:

1. Follow alerts about cybersecurity incidents. If you are a customer of a targeted business, search online for details about the incident and contact the company directly for more information. Read any alerts you receive carefully and monitor your credit card statements for unusual transactions.

2. Check your credit reports. It can take a long time for an incident to be reported. The first AT&T breach took place in 2019, for example, but wasn't confirmed by the company until 2024. Review your credit reports for signs of suspicious activity. 

• Your credit card company or bank should provide updated credit score information for free.
• You can get free copies of your reports from each of the three major bureaus at AnnualCreditReport.com.
• You can get a free credit report from Experian® every 30 days and CreditWise from Capital One provides free access to your TransUnion credit report. Equifax offers two free credit reports per year with myEquifax.
• For regular updates on all three reports, consider subscribing to a paid identity theft protection service like PrivacyGuard® or Experian IdentityWorks℠*. 

3. Get a password manager. Password managers store your usernames, passwords and email addresses. Services like Keeper and Dashlane add dark web monitoring, email masking and other benefits.

4. Freeze your credit. Even if you're not part of a recent data breach or digital privacy case, freezing your credit reports prevents anyone from opening a new account in your name. It doesn't affect your credit score and you can unfreeze your accounts whenever you want.

• Equifax: Visit the Equifax Consumer Services Center or call 800-349-9960.
• Experian: Contact Experian's security freeze center or call 888-397-3742.
• TransUnion: Visit the TransUnion website or call 888-909-8872.

Identity monitoring service Aura can freeze your credit without requiring you to contact the credit bureaus. It also offers a range of other security features, including a password generator, email aliases, a VPN, robocall filters and malware protection. 

5. Make sure your anti-virus protection is up to date. More than 300,000 new types of malicious software are discovered daily, according to IT security research institute AV-TEST. Antivirus software like Bitdefender Antivirus Plus and Norton AntiVirus Plus can help protect your devices from a variety of threats.

Why trust CNBC Select?

At CNBC Select, our mission is to provide our readers with high-quality service journalism and comprehensive consumer advice so they can make informed financial decisions. Every cybersecurity article is based on rigorous reporting by our team of expert writers and editors. While CNBC Select earns a commission from affiliate partners on many offers and links, we create all our content without input from our commercial team or any outside third parties, and we pride ourselves on our journalistic standards and ethics.

Catch up on CNBC Select's in-depth coverage of credit cards, banking and money, and follow us on TikTok, Facebook, Instagram and Twitter to stay up to date.

* IMPORTANT INFORMATION A credit card is required to start your free 30-day trial membership *† in Experian IdentityWorksSM <<Plus / Premium>>. You may cancel your trial membership at any time within 30 days without charge. If you decide not to cancel, your membership will continue and you will be billed <<$PRICE>> for each month that you continue your membership. You may easily cancel your trial membership online anytime within the trial period without charge.