On October 29, 2026, California Attorney General Rob Bonta announced a $1.8 million settlement with Lyft over allegations that the ride-hailing company violated the California Consumer Privacy Act (CCPA) and the state's Unfair Competition Law. The charge is specific: Lyft sold or shared users' personal information for targeted advertising but gave them no way to opt out from inside its mobile app. The settlement requires Lyft to add an in-app opt-out and to notify California consumers of their right to stop the sale of their personal information. It is the California Department of Justice's ninth CCPA enforcement action.
Source: California Attorney General, press release of October 29, 2026, captured October 31, 2026.
What Lyft is alleged to have done
According to the Attorney General's press release, riders and drivers must download the Lyft app and create an account to use the service. Lyft collects names, email addresses or phone numbers, IP addresses, and non-precise geolocation such as city, state, region, or zip code. The state says that since mid-2023 Lyft has also been selling or sharing that information to target and display ads within the app.
The problem was the exit. The only way for a consumer to opt out, per the press release, was to follow a series of links from the in-app privacy policy to a "Do Not Sell or Share My Personal Information" webpage. Because users have to log in to use the app, Lyft already knew who they were, yet the web form still asked them to re-enter their login and submit further personal information. The Attorney General called that an unnecessary barrier to exercising CCPA rights.
Figure 1: The opt-out path described in the state's complaint, from the app to a mobile browser page.
The complaint puts the legal point plainly: an opt-out method has to reflect how the business primarily interacts with consumers, and a business offering its services through a mobile app must provide an easy-to-execute opt-out method within that app. It cites Civil Code section 1798.120 and the California Consumer Privacy Act regulations, and it describes Lyft as offering its services exclusively through its app.
What the settlement requires
The press release lists two terms: $1.8 million in civil penalties, and an in-app opt-out option plus notice to California consumers of their right to not have their personal information sold. The release describes the deal as resolving allegations, and it does not say Lyft admitted wrongdoing. The settlement PDF is a scanned image, so we could not read its full injunctive language, and this article relies on the press release and the complaint for the terms described here.
For scale, the complaint asks the court to assess civil penalties of $2,663 per violation of the CCPA, or $7,988 for each intentional violation and each violation involving the personal information of minors.
Figure 2: Per-violation civil penalty amounts the state's complaint asks the court to assess. Source: People v. Lyft, Inc., complaint, prayer for relief.
The state says the case grew out of a March 2025 investigative sweep of how companies use geolocation data, including when selling or sharing personal information. Lyft joins General Motors, Sephora, DoorDash, Disney, Jam City, Sling TV, Healthline.com, and Tilting Point Media on the list of CCPA enforcement actions the Attorney General cites. For a ranked view of the dollar amounts, see our CCPA settlements ranked by size, and for the penalty rules behind them, CCPA fines and penalties.
What this means if you own an app
The practical lesson is that your privacy policy is not an opt-out mechanism. If your app sells or shares personal information, including sharing for cross-context behavioral advertising, a user inside the app should be able to find a "Do Not Sell or Share My Personal Information" control without leaving it. The state's position in this case is that a trail of policy links ending at a web page does not satisfy the CCPA when the app is the primary way you deal with customers.
Four checks follow from the complaint. First, put the control in a place users already look, such as the account or privacy settings screen. Second, keep it to minimal steps. Third, if the user is already signed in, do not ask them to log in again or hand over extra details just to stop a sale. Fourth, keep your notice and your policy in step with what the app actually does. Our guide to the Do Not Sell or Share link covers when the obligation applies at all, and the California Privacy Protection Agency enforcement roundup shows the other regulator working the same ground.
Your privacy policy still has to describe the sale and sharing accurately and point to the in-app control. Our Privacy Policy Generator produces the California disclosures and opt-out language, and you then wire the actual toggle into your app.
The information in this article is for informational purposes only and should not be construed as legal advice on any matter, and does not create a lawyer-client relationship.
