Lyft will pay $1.8 million in civil penalties to settle allegations that it sold and shared California users’ personal information for in-app advertising without giving them a way to opt out inside the app. California Attorney General Rob Bonta announced the settlement on October 29, 2026. Beyond the penalty, Lyft must add an in-app opt-out and tell California consumers they have the right to stop the sale of their personal information.
The case is small by the standards of recent privacy penalties, but its theory reaches far beyond rideshare. Lyft did offer an opt-out. It just put it somewhere its users almost never go. For a company whose entire service runs through a mobile app, the attorney general’s office said, a web form reached through a chain of privacy-policy links was not good enough.
What the attorney general alleged
According to the attorney general’s announcement, riders and drivers both have to download the Lyft app and create an account to use the service. Lyft collects names, email addresses or phone numbers, IP addresses and non-precise geolocation such as city, state, region or ZIP code.
Since mid-2023, the office said, Lyft has been selling or sharing that personal information to target and display ads within the app. The app itself had no opt-out control. A consumer who wanted to stop the sale had to open the in-app privacy policy, follow a series of links out to Lyft’s “Do Not Sell or Share My Personal Information” webpage, then log in again and submit more personal information, even though Lyft already knew who they were because the app requires an account.
The attorney general described that path as an illegal and unnecessary barrier. In his statement, Bonta said consumers “had to detour through a privacy policy, re-enter personal information, and transfer from the app to webpage just to exercise a right the law guarantees them.” He added that businesses “cannot throw up unnecessary roadblocks.”
The claims were brought under the California Consumer Privacy Act and the state’s Unfair Competition Law. The announcement describes them as allegations resolved by settlement. It does not say Lyft admitted wrongdoing, and Lyft’s public response was not included in the release.
What Lyft has to do
- Pay $1.8 million in civil penalties.
- Provide an opt-out of sale and sharing inside the Lyft app.
- Notify California consumers of their right to not have their personal information sold.
The release does not list a compliance-monitoring period, a deadline for the in-app control, or whether the terms cover the Lyft Driver app separately. Those details would be in the court filing, and companies benchmarking their own programs should read it once it is available rather than assume the public summary is the whole order.
How the case started: a location-data sweep
The investigation grew out of a March 2025 sweep in which the attorney general’s office examined how companies use geolocation data, including when they sell or share it. That origin is worth noting. Lyft’s alleged problem was not about precise location at all. The data named in the release is coarse location plus ordinary identifiers. Investigators looking at one issue found a different one, which is exactly how sweeps tend to work: regulators open an app, look for the controls the law requires, and write up whatever is missing.
The Lyft case follows a run of California settlements in which the conduct at issue was the mechanics of an opt-out rather than the data itself. Our coverage of the Sling TV penalty and the Jam City mobile gaming settlement covers similar ground, and the Healthline case showed how the state treats opt-outs that do not actually stop data from flowing to advertisers. California’s $12.75 million GM settlement in May 2026, which the office called its eighth CCPA enforcement action, listed Sephora, DoorDash, Disney, Jam City, Sling TV, Healthline and Tilting Point Media as earlier cases.
The rule Lyft ran into
The CCPA regulations are specific about where an opt-out has to live. Section 7026(a) of the regulations, in the version in effect since January 1, 2026, requires a business that sells or shares personal information to offer two or more methods for opting out, and says that at least one of them “shall reflect the manner in which the business primarily interacts with the consumer.” For an app-only service, that points to the app.
The same section says opt-out methods must be easy to use and require minimal steps, and that a business may not require a consumer to create an account or provide more information than is needed to carry out the request. It also says a business cannot demand a verifiable consumer request for an opt-out, which is the identity-checking process reserved for access and deletion requests. Lyft’s alleged requirement that logged-in users sign in again and submit more data runs straight into that language.
Readers who want the background on the right itself can start with our explainers on the CPRA opt-out right and what “Do Not Sell” covers after the CPRA amendments.
Five questions every app-first business should answer this week
The Lyft facts map onto a short internal review. None of these questions requires new software to answer, only someone willing to open the app and try.
- Where do your users actually interact with you? If most sessions happen in a mobile app, a smart TV app or a connected device, the opt-out has to be reachable there. A link in a website footer does not satisfy a rule written around the primary channel.
- How many taps does it take? Count them, starting from the app’s home screen. Then count the taps needed to share data or turn on ads personalization. The regulations require symmetry in choice, and regulators compare the two paths.
- Do you ask signed-in users to prove who they are again? If the app already knows the account, the opt-out should attach to the account without a second login or extra form fields.
- Does the opt-out stop the ads stack, or just record a preference? In-app advertising usually runs through SDKs. Test whether opted-out users still send identifiers to ad partners. A toggle that changes a database flag but leaves the SDK calling home is the failure regulators found in earlier cases.
- Is the choice carried across devices and channels? A user who opts out in the app and then books on the web should not be treated as a new, un-opted-out person.
Why “we have a form” is no longer a defense
A common reading of the CCPA in its early years was that offering a working web form, linked from the privacy policy, was enough. The Lyft settlement shows the enforcement agencies reading the regulations more literally. The form has to be in the right place, it has to be short, and it cannot ask for information the company already holds.
The practical lesson is that a privacy program cannot be audited only from the website. Many compliance reviews still start with a browser crawl, check the footer for the “Do Not Sell or Share” link, confirm the Global Privacy Control signal is honored and stop there. For a company like Lyft, that review would have passed while missing the channel where the conduct occurred. App store listings, in-app settings menus, onboarding screens and in-app ad placements all need the same scrutiny the website gets.
It also shows that remediation needs proof. Adding an opt-out button is the easy part. Showing that a user who taps it stops appearing in ad requests is harder, and that evidence is what a regulator will ask for if the issue comes back.
Where Captain Compliance fits
Captain Compliance’s CCPA compliance tools are built around the checks enforcement has focused on: opt-out handling, Global Privacy Control, subject rights workflows and the vendor contracts that a sale or share depends on. Teams use the platform to document where personal information goes, which partners receive it and whether an opt-out actually reaches those partners. Software supports a program but does not make one compliant on its own, and an in-app control still has to be built and tested by the team that owns the app.
Frequently asked questions
Did Lyft sell precise location data?
The attorney general’s release names non-precise geolocation, such as city, state, region or ZIP code, along with names, contact details and IP addresses. It does not allege a sale of precise geolocation.
Does every app now need an in-app opt-out?
If the business sells or shares personal information and primarily interacts with consumers through the app, the regulations require at least one opt-out method that reflects that channel. A business that does not sell or share has no opt-out obligation for those purposes, though other CCPA duties still apply.
Can a business ask for an email address before processing an opt-out?
Only to the extent the information is necessary to identify whose data should stop being sold or shared. If the business can comply without more information, as with a signed-in app user, the regulations say it must do so.
Does the settlement cover drivers as well as riders?
The release says both riders and drivers must download the app and create an account, and refers to “consumers” throughout. It does not separately describe how the in-app opt-out will work for the driver app. Check the filed settlement for that detail.
How fast must a business act on an opt-out?
Under Section 7026(f) of the CCPA regulations in effect since January 1, 2026, a business must stop selling or sharing the consumer’s personal information as soon as feasibly possible, and no later than 15 business days after receiving the request. It must also notify third parties that received the data after the request but before the opt-out took effect, and direct them to comply.
The detour is the violation
Lyft’s opt-out existed. A determined user could find it. California’s position is that a right reachable only by people willing to leave the product, hunt through a policy and log in twice is not a right the company actually offered. Every business that has moved its customers into an app now has to decide whether its privacy controls moved with them, or whether they are still sitting on a webpage that most users will never see.
