Open the Lyft app and you can have a car on the way in about three taps. Until recently, telling Lyft to stop selling your data took a lot more work than that. You had to find the privacy policy inside the app, follow a link out to a webpage in your phone’s browser, press the opt-out button, and then log in again and verify who you were. Lyft already knew who you were. You were sitting in its app.
California’s Attorney General decided that gap was the whole problem. On October 29, 2026, Rob Bonta announced a $1.8 million settlement with Lyft over alleged violations of the California Consumer Privacy Act and the state’s Unfair Competition Law. It is the California DOJ’s ninth CCPA enforcement action, and it came out of a March 2025 investigative sweep of the location data industry.
The dollar figure isn’t huge for a company Lyft’s size. The reasoning behind it matters a lot more, because it applies to almost every business that runs ads off customer data.
What the AG says Lyft did
According to the complaint, starting in mid-2023 Lyft disclosed device identifiers, IP addresses and coarse location data from its rider and driver apps to third parties so they could target personalized ads at Lyft users. The complaint says this let Lyft charge more for in-app advertising and opened a new revenue stream.
Under the CCPA, that kind of disclosure counts as selling or sharing personal information, and consumers have the right to say no. Lyft did offer a way to say no. The AG’s issue was where it lived and how hard it was to use:
- There was no opt-out setting inside the app itself.
- The only route was a chain of links in the in-app privacy policy that opened a “Do Not Sell or Share My Personal Information” page in a mobile browser.
- After pressing the button on that page, users had to re-enter their login and verify their identity, even though they were already logged in to the app.
The complaint sums up the state’s position in one line: if gig-economy companies can offer their services “with just a tap in an app,” they can let people opt out just as easily.
Under the settlement, Lyft pays $1.8 million in civil penalties, must build an opt-out into the app, and must tell California consumers about their right to stop the sale of their information.
The real rule: your opt-out has to match your product
If you read the Disney settlement, this will sound familiar. Disney paid $2.75 million after the AG said its opt-outs didn’t reach across all the streaming services and devices where it linked data for advertising. The message there was that if you get the benefit of connecting data across your ecosystem, the opt-out has to travel the same distance.
Lyft applies the same logic to the user experience. Lyft is an app-first business. It talks to its customers almost entirely through a phone screen, and it makes everything else in that experience fast and easy. The AG’s view is that a privacy choice shouldn’t be the one thing that kicks you out to a browser and asks for your password again.
Put simply: the opt-out should be as easy to use, and reach as far, as the advertising does.
California regulators seem to be heading in the same direction formally. CalPrivacy’s November 2026 board meeting includes proposed amendments to the opt-out preference signal regulations, which practitioners are already linking to the reasoning in these two cases.
Five things we’d check on your own site and app this week
We look at a lot of websites and apps after a demand letter or a regulator inquiry shows up. Here is where the Lyft facts tend to show up in the wild.
1. Is the opt-out where your customers actually are? If most of your traffic is in an app, the opt-out needs to be in the app. If people mostly use your website on a phone, test the flow on a phone. A footer link that only works well on a desktop doesn’t match how people actually use your site.
2. Are you asking logged-in users to prove who they are again? The CCPA regulations say opt-out requests shouldn’t require identity verification the way access or deletion requests do. Lyft’s re-login step was central to the complaint. If a signed-in user taps “opt out,” that should be the end of it.
3. What happens when the person isn’t logged in? This is where many companies get stuck. A visitor sends a Global Privacy Control signal from their browser, but you also have their email from a newsletter signup, and that email feeds an ad audience. The cookie banner handles the browser. It does nothing for the email list. According to Frankfurt Kurnit’s read of the settlement, the AG expects a business in that position to tell the consumer what it needs (logging in, or minimal information) to complete the opt-out, and to honor it at least for that browser or device and any linked profiles if the person declines. If you sell or share data tied to people without accounts, you likely need a simple secondary opt-out form, not just a banner.
4. Don’t assume coarse location is safe. Lyft wasn’t accused of selling precise geolocation, which the CCPA treats as sensitive. The complaint is about city, state, region and ZIP code level data used for ad targeting. That was enough to draw an enforcement action. If location of any kind feeds your ad targeting, list where it goes and make sure the opt-out stops it.
5. Think before you merge accounts. Lyft riders and drivers share one account, so data collected while someone drives is tied to their passenger profile. The settlement treats both roles as consumers. Every time you link profiles, apps or data sets, you are also widening how far one person’s opt-out has to reach. Map that before the merge, not after.
Risk assessments are now part of the enforcement playbook
California’s CCPA risk assessment rules took effect January 1, 2026. Reports that the Lyft settlement requires assessments before new or changed features that involve personal information, with assessments covering selling or sharing, sensitive information and location data used for advertising. That makes Lyft at least the third recent California action, after PlayOn and GM, to point directly at the requirement. If your assessments haven’t started, start them. The first attestations are due April 1, 2028, and that deadline will come up faster than it looks.
Where Captain Compliance fits
Most of what went wrong for Lyft is configuration, not intent. The opt-out existed. It just lived in the wrong place and asked for too much. That is the kind of gap a scan finds quickly and a consent platform fixes for good.
Captain Compliance honors Global Privacy Control signals automatically, puts opt-out choices where your visitors already are, and pairs them with a privacy request portal so people without accounts still have a simple way to complete an opt-out. Every choice is logged, so if a regulator or plaintiff’s firm asks what your site did and when, you have the records.
If you’re not sure how your opt-out flow would look to the AG, run a free privacy audit and we’ll show you.
Sources: California Attorney General press release and complaint in People v. Lyft; Frankfurt Kurnit Klein & Selz, Technology Law blog. This article is for general information and is not legal advice.
