Lyft to Pay $1.8 Million Over California Privacy Violations and In-App Opt-Out Hurdles

Rideshare company Lyft will pay $1.8 million in civil penalties to resolve claims that it violated state privacy and consumer protection laws. California Attorney General Rob Bonta announced the settlement on October 29, 2026, following allegations that the company failed to provide an accessible way for consumers to opt out of the sale and sharing of their personal information inside its mobile app.

State regulators found that Lyft breached both the California Consumer Privacy Act (CCPA) and California’s Unfair Competition Law. The enforcement action marks the ninth CCPA settlement brought by the California Department of Justice, following previous cases involving companies such as DoorDash, Sephora, Disney, and General Motors.

How Lyft Restricted In-App Privacy Controls

To use Lyft’s services, both riders and drivers must download the mobile application and create an account. In doing so, the company collects user information, including names, phone numbers, email addresses, IP addresses, and non-precise geolocation details such as city, state, or zip code. Starting in mid-2023, Lyft began selling and sharing this personal information to target and display ads within the app.

However, state investigators discovered that Lyft failed to give users a way to stop this data sharing from inside the app itself. Instead, consumers wanting to protect their data had to click through links in the company’s privacy policy, leave the app, and navigate to an external webpage. Even though Lyft already knew the user’s identity through their account, the website required people to log in again and submit further personal information just to submit the request.

State officials concluded these hurdles violated California law. Attorney General Bonta criticized the company’s barriers, noting that the process was “cumbersome and confusing — and in California, it’s illegal.”

Settlement Terms and Required Changes

The resolution stems from an investigative sweep launched in March 2025 focused on how companies use and share consumer geolocation data. Under the agreement, Lyft must pay $1.8 million in civil penalties. In addition to the monetary penalty, the company is required to make substantive operational changes.

Lyft must build an opt-out mechanism directly into its mobile application, allowing users to exercise their privacy preferences without being redirected to external web browsers. The company must also provide clear notice to California consumers explaining their legal right to prevent the sale and sharing of their personal information.

What This Means for California App Users

The settlement reinforces that companies operating on mobile devices cannot place unnecessary burdens on consumer privacy rights. Under the CCPA, California residents have the legal right to stop businesses from selling or sharing their personal information, and businesses are prohibited from throwing up roadblocks to derail those choices.

California drivers and riders who use Lyft should soon see direct in-app opt-out controls, as well as formal notices outlining their privacy protections. Consumers who want to stop data sharing across multiple platforms can also submit complaints regarding CCPA violations directly to the California Attorney General. Additionally, Californians can use the state’s Delete Request and Opt-out Platform (DROP) through CalPrivacy to request data deletion across more than 575 registered data brokers in a single submission.

When a business fails to respect consumer data rights or handles sensitive personal information in questionable ways, speaking with an attorney experienced in privacy and consumer protection law can help clarify your options and protect your legal interests.

This article is general information based on California Attorney General and court or agency records available at publication time. It is not legal advice; laws and deadlines differ by state and by case. Published October 30, 2026.