California Attorney General Rob Bonta today announced a settlement with Lyft, resolving allegations that the company violated the California Consumer Privacy Act (CCPA) and California’s Unfair Competition Law by failing to offer consumers the ability to opt out of the sale of their personal information within Lyft’s mobile app. The settlement includes $1.8 million in civil penalties and requires Lyft to provide an in-app opt-out option and notify California consumers of their right to not have their personal information sold.
“Lyft — a company that offers its services exclusively through an app — was selling and sharing user’s personal information for targeted advertising without giving users a way to opt-out from within that app. Instead, consumers had to detour through a privacy policy, re-enter personal information, and transfer from the app to webpage just to exercise a right the law guarantees them. This is cumbersome and confusing — and in California, it’s illegal,” said Attorney General Bonta. “Under California’s nation-leading privacy law, consumers have the right to say no to the sale and sharing of their data, and businesses cannot throw up unnecessary roadblocks.”
Attorney General Bonta’s settlement with Lyft stems from a March 2025 investigative sweep concerning how companies use geolocation data, including in the context of selling or sharing consumers’ personal information. In order to use Lyft, consumers — both riders and drivers — must download the Lyft app and create an account. Lyft then collects and uses personal information like name, email address, or phone number; IP addresses; and non-precise geolocation, such as city, state, region, or zip code. Since mid-2023, Lyft has also been selling or sharing consumers’ personal information to target and display ads within the Lyft app but did not provide an in-app opt-out method. Instead, the only way for a consumer to opt out was to navigate through a series of links from Lyft’s in-app Privacy Policy to access Lyft’s “Do Not Sell or Share My Personal Information” webpage, a cumbersome process that does not satisfy the CCPA’s requirements. And while Lyft knew the identity of consumers who submitted requests through this form because it required them to log in to use its app, Lyft still required consumers to re-enter their log in and submit further personal information to exercise their right to opt out. This was an illegal and unnecessary barrier to the exercise of CCPA rights.
In addition to $1.8 million in civil penalties, the settlement requires Lyft to provide an in-app opt-out option and notify California consumers of their right to not have their personal information sold.
California Consumer Privacy Act
The CCPA vests California consumers with control over the personal information that businesses collect about them, including the right to request that businesses stop selling or sharing their personal information. Learn more about opting out.
Attorney General Bonta is committed to the robust enforcement of California’s nation-leading privacy law. Today’s settlement represents the California Department of Justice’s ninth enforcement action under the CCPA. Attorney General Bonta has also announced settlements with General Motors, Sephora, DoorDash, and Disney as well as mobile app gaming company, Jam City; streaming service, Sling TV; website publisher, Healthline.com; and entertainment company, Tilting Point Media.
For more information about the CCPA, visit oag.ca.gov/ccpa. To report a violation of the CCPA to the Attorney General, consumers can submit a complaint online at oag.ca.gov/report.
Stop, DROP, and Secure Your Data
Californians can now send one request to more than 575 registered data brokers to delete their personal data using a new, easy-to-use online tool. The Delete Request and Opt-out Platform (DROP), developed by CalPrivacy, gives Californians more control over their personal information and helps limit the information that data brokers sell. Formore information about DROP and how Californians can submit a deletion request, visit: privacy.ca.gov/drop.