• The Federal Trade Commission proposed to bar prescription drug comparison site GoodRx from sharing users' health data with third parties for advertising, the agency said Wednesday.
• The "first-of-its-kind proposed order" includes a $1.5 million civil penalty for allegedly violating the agency's Health Breach Notification Rule.
• GoodRx denied wrongdoing and said it has proactively addressed privacy concerns, adding the settlement allowed it to avoid costly litigation.

The Federal Trade Commission proposed to permanently bar prescription drug comparison site GoodRx from sharing users' health data with third parties for advertising purposes, the agency said Wednesday.

In a "first-of-its-kind proposed order," the FTC also said it's imposing a $1.5 million civil penalty for allegedly violating the agency's Health Breach Notification Rule. Under the settlement, GoodRx is required to limit how long it holds onto personal and health information of users, and to ask third parties to delete consumer health data shared with them.

The FTC alleged GoodRx shared personal health information, including user prescription medications and personal health conditions, with companies like Facebook, Google and Criteo since at least 2017, despite promises not to provide user data to advertisers or third parties. The agency also claims GoodRx used personal health data to target its users with personalized ads on Facebook and Instagram. For example, according to the FTC, GoodRx in 2019 uploaded to Facebook a list of information from users, who purchased certain medications, in order to target them with ads.

Criteo said in a statement that it prohibits most types of targeted ad campaigns referenced in the complaint against GoodRx and confirmed that it never received from the company "any personally identifiable information, such as name or email address, or prescription and medical information," connected to Criteo's digital ad services. Meta and Google have also previously said they have policies against advertisers sharing sensitive information with their services or targeting users based on such data.

GoodRx said in a press release that it disagrees with the FTC's allegations and doesn't admit wrongdoing. It said that the settlement allows the company to avoid expensive and time-consuming litigation and that the agreement "will have no material impact on our business."

"The settlement with the FTC focuses on an old issue that was proactively addressed almost three years ago, before the FTC inquiry began," GoodRx said, adding that it made updates to safeguard user safety before it was contacted by the agency.

GoodRX shares were up 3.5% on Wednesday to $5.79. The stock has lost more than three-quarters of its value in the past year.

GoodRx said in a blog post that medical records were not shared through its use of the Facebook pixel, the code websites use for advertising. Even so, GoodRx said, it "led the industry by removing the standard Facebook Javascript pixel almost three years ago."

FTC Commissioners voted 4-0 to refer the proposed order to the Department of Justice to file it on the FTC's behalf.

Subscribe to CNBC on YouTube.

WATCH: The changing face of privacy in the pandemic