The CVS Settlement Email Matches the Court-Ordered Notice: Up to $10 for Having Used CVS.com or the App, One Claim Per Household — and the $20.5 Million “Maximum” Includes Up to 37.5% for the Lawyers. Claims Close November 16.

If you got an email with the subject line “Legal Notice of Class Action Settlement” from a sender whose display name begins “CVS Digital Privacy Settl…” (cut off in the posted screenshots), carrying a personal Login ID and PIN and the heading “Notice of Proposed Class Action Settlement,” it matches the court-ordered notice in this case. We have seen only the sender's display name, not its address, and a display name can be copied, so file through the official website rather than a link in the email. Copies that recipients posted in the r/CVS forum on September 23 and 24 — one titled “Is this some kind of scam?” — carry the same heading as the court-approved notice on the settlement website and open with “Our Records Indicate You Accessed The CVS Digital Properties In The United States Prior to July 27, 2026 and May Be Entitled to a Payment From a Class Action Settlement,” which mirrors that notice's own headline.

The timing fits the court's order. The preliminary approval order required the notice program to begin within 45 days of July 27 — by September 10 — and to be finished at least 45 days before the December 1 hearing, by October 17. The settlement agreement provides for email notice where CVS and Criteo have addresses. Emails were arriving by September 12 and still arriving around September 21–23, when The Hill, FOX 9 and Patch picked up the story.

No email does not mean no claim. The class is defined by having used the sites, not by receiving notice, and the settlement website lets people without a Login ID and PIN file a claim without logging in. The safe habit is the same either way: type CVSDigitalPrivacySettlement.com into your browser yourself instead of clicking a link, and remember that no legitimate settlement charges a fee to file. One widely syndicated report gave the mail-in deadline as November 6; the official deadline for online and postmarked claims is November 16, 2026.

CVS does not concede anything. “We stand by our privacy practices … The settlement resolves claims based on legal theories that challenge common online industry practices,” spokesperson Amy Thibault told USA Today network papers on September 24.

The procedural history in the settlement agreement is short and worth reading in order. Plaintiffs' counsel contacted CVS and Criteo before filing anything. The parties agreed to mediate before Robert A. Meyer of JAMS and did so on March 17, 2026. They kept negotiating for several weeks and reached terms. Only then, on May 15, 2026, did the plaintiffs — Justin Brewer, Ariel Brooks, Alex Sisti and Marc Weinberger — file a putative class complaint in Broward County, alleging violation of the federal Electronic Communications Privacy Act, state statutory claims, breach of confidence, invasion of privacy and negligence. Judge Shari A. Olefson granted preliminary approval on July 27, 2026, which is why the class is defined by that date.

The substance is the now-familiar one. The lawsuit concerns “the alleged disclosure of health or private information, personal information, browsing data, identifiers, or other data of users of the CVS Digital Properties to Criteo or other technology providers or third parties through technology embedded on any of the CVS Digital Properties.” Criteo is described in the agreement as “a digital advertising company that provides advertising support, including on the CVS Website and CVS App.” CVS, the same document notes, is “a health solutions company with over thirty-six (36) million customers” — a figure that matters below. Both defendants deny violating any law; the court has decided nothing about who is right.

The class is “all living individuals who accessed the CVS Digital Properties in the United States at any time prior to the date of Preliminary Approval” — July 27, 2026. There is no purchase requirement, no account requirement and no minimum number of visits. Buying shampoo at a CVS counter does not qualify; opening the app once does. The only exclusions are the defendants' officers, directors and employees, the judge and court staff, governmental entities, and anyone who opts out.

The two payments differ only in paperwork, and the paperwork is about membership, not loss:

• Cash Payment A — $10 “unless there is a downward pro rata adjustment,” for anyone who submits “reasonable documentation supporting their membership in the Settlement Class.” The agreement's own examples are browser search history, screenshots showing dates, and email receipts of online purchases. Your own sworn statement does not count as documentation on its own. If the administrator rejects the proof and you do not cure it, the claim is treated as a Cash Payment B claim rather than thrown out.
• Cash Payment B — $5, same pro rata caveat, with no documentation at all.

Then the clause that most write-ups skip: “Only one Cash Payment per household shall be permitted,” where household “shall mean all persons residing at the same mailing address.” A family of four who all used the app files one claim, not four. Payment comes by PayPal, Venmo, Zelle or check; checks void 180 days after issue; the FAQ adds that you “may be responsible for any applicable taxes.”

The agreement defines the Maximum Cash Payment as “the Twenty Million Five Hundred Thousand U.S. Dollars ($20,500,000.00) that Defendants are making available for the payment of Settlement Class Member Benefits under the Settlement, which includes Cash Payments, Settlement Administration Costs, and any Court-approved attorneys' fees, costs, and Service Awards.” Three things follow from that sentence.

First, the fee comes out of it. Class counsel will ask for up to 37.5 percent of the Maximum Cash Payment — $7,687,500 — plus service awards for the class representatives capped at $2,500. The motion will be posted on the settlement site by October 17. Administration costs, which are not quantified in the public documents, come out of the same ceiling. Our arithmetic: before administration, no more than about $12.8 million is available for claimants. At $5 a claim that is roughly 2.56 million households; at $10, about 1.28 million. Set against the 36 million customers the agreement itself cites — and cvs.com's audience is broader than its customer base — the $5 holds only if fewer than about 7 percent of households file. Above that, “all Cash Payments for Settlement Class Members who submitted Valid Claims will be reduced pro rata.”

Second, and unlike a common fund, nothing is guaranteed to be spent. “Any residual funds remaining after all Valid Claims have been paid and all other Settlement Class Member Benefits have been satisfied shall revert to Defendants to be distributed in accordance with a separate agreement between CVS and Criteo.” If few people claim, the defendants keep the difference. There is no cy pres, no charity, no redistribution to claimants above $10.

Third, the “up to” on the settlement site is not boilerplate. It is the mechanism. A reader deciding whether $5 is worth two minutes should know that the two minutes are the whole cost, that the $5 can shrink, and that the money nobody claims is not lost to the class in the abstract — it is returned to the companies that were sued.

All of the settlement's dates are ahead as of September 28, 2026.

Opting out matters only if you intend to sue CVS or Criteo yourself over the same tracking; it forfeits the payment and preserves nothing else most people would want. Objecting is for people who stay in and dislike the terms — the fee share is the obvious target — and the objection rules are unusually demanding, down to listing every class settlement your lawyer objected to in the past five years. The claim deadline is the one that costs money. Do nothing by November 16 and you receive nothing while still releasing your claims, because everyone who did not opt out is bound.

On timing: the Effective Date is 30 days after the final approval order if there are no objections, later if there are appeals. Payment follows “one hundred and twenty (120) days after the Settlement has been finally approved and/or after any appeals process is complete.” With a December 1 hearing, spring 2027 is the realistic window if nothing is appealed.

The claim form is at CVSDigitalPrivacySettlement.com; a paper form can be downloaded there or requested by email and mailed to CVS Digital Privacy Settlement, c/o Settlement Administrator, P.O. Box 1110, Costa Mesa, CA 92628. The administrator is Simpluris, at (888) 654-1271 and info@CVSDigitalPrivacySettlement.com. Notice went out by email and by publication, so the absence of a letter in your mailbox means nothing. If you want the $10, gather the proof before you start: an order confirmation email from cvs.com, or a screenshot showing a date — of your browser history, for instance — is what the agreement describes.

Class counsel are Jeff Ostrow of Kopelowitz Ostrow P.A. in Fort Lauderdale, Jonathan M. Jagher of Justice Jagher London and Millen LLC, Katrina Carroll of Carroll Shamberg LLC, Mariya Weekes of Milberg PLLC and Yitzchak Kopel of Bursor & Fisher, P.A. CVS is represented by Lauri Mazzuchetti and Whitney Smith of Kelley Drye & Warren LLP; Criteo by Thomas Dillickrath and Tenaya Rodewald of Sheppard, Mullin, Richter & Hampton LLP. The release, once the settlement is final, covers the claims described in Sections II.52 and II.53 of the agreement against both companies and their affiliates — whether or not you file.

One practical note on the proof tier: the documentation has to show your use of the sites, not any harm from it. Nobody is asked to prove that their data reached Criteo. That is what makes this one of the lowest-friction claims on the calendar, and also why the pro rata clause is the part to keep in mind.