Consumer Apps · Health/Pharmacy · Regulatory action
CVS Health / CVS app
Headline
CVS Caremark (CVS's own pharmacy-benefits arm) is one of three companies the FTC accused of artificially inflating INSULIN prices through a rebate scheme documented elsewhere in this tracker…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
CVS Caremark (CVS's own pharmacy-benefits arm) is one of three companies the FTC accused of artificially inflating INSULIN prices through a rebate scheme documented elsewhere in this tracker (allegations only: Caremark settled the FTC case on July 14, 2026 with conduct remedies, no monetary penalty and no finding of liability, following Express Scripts' Feb 2026 settlement) — meaning the pharmacy chain millions rely on for prescriptions is also the entity accused of helping make one of the most essential, life-sustaining medications more expensive than it needed to be.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
A 2021 CVS Health DATABASE LEAK exposed OVER ONE BILLION RECORDS — including search queries for specific medications and vaccines — one of the largest-scale exposures found anywhere in this entire 185-company audit by raw record count, though the search-query nature of the exposed data (rather than full medical records) may limit per-person severity relative to, e.g., the 23andMe genetic-data breach elsewhere in this tracker.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. PUBLIC COMPANY (CVS). Service route: c/o General Counsel / Corporate Secretary, Woonsocket, Rhode Island — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy cvs.com/content/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service cvs.com/content/terms-of-use | Not fetched yet | NO (HTML only) |
| Website cvshealth.com | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: Rhode Island. Provisions of RIDTPPA on file:
| Provision | Type | Source |
|---|---|---|
| Universal Opt-Out Mechanism Required at Effective Date R.I. Gen. Laws § 6-48.1 | hard | source |
| Privacy Notice Must Identify Third Parties by Name R.I. Gen. Laws § 6-48.1-3(a)(2) | hard | source |
| Enforcement — AG; Cure Period at Enactment R.I. Gen. Laws § 6-48.1-8 | hard | source |
| Applicability Threshold — Low Thresholds (10k/35k) R.I. Gen. Laws §§ 6-48.1-4 to 6-48.1-7 | threshold | source |