Lyft's $1.8 Million CCPA Settlement: What Businesses Should Know

California Attorney General Rob Bonta announced a $1.8 million settlement with Lyft on October 29, 2026, over the steps its app required of consumers who wanted to opt out of the sale or sharing of their personal information. The claims were brought under the CCPA and the Unfair Competition Law.

The operative standard is 11 CCR § 7004, which requires a request method that is easy to execute, takes minimal steps, and does not demand more information than necessary. Opting out cannot be harder than opting in.

Why California Investigated Lyft's Privacy Practices

California's investigation followed a March 2025 enforcement sweep examining how businesses collect and share consumer information, including geolocation data. According to the Attorney General, Lyft had been selling or sharing personal information for targeted advertising since mid-2023 without offering users a direct in-app method to opt out. Consumers instead had to navigate through the app's privacy policy to reach a separate webpage.

What the CCPA Requires for Opt-Out Requests

The California Consumer Privacy Act gives consumers the right to direct covered businesses not to sell or share their personal information. Businesses must provide compliant methods for exercising those rights and cannot impose unnecessary obstacles. California alleged that Lyft's process was unnecessarily burdensome because users had to leave the app and provide additional personal information despite already being logged into their accounts.

Why an In-App Opt-Out Matters

For a business operating primarily through a mobile application, the accessibility of privacy controls is an important compliance consideration. California's enforcement action emphasizes that businesses should evaluate how easily consumers can find and use privacy controls within the services they regularly access.

What the $1.8 Million Settlement Requires

The settlement includes $1.8 million in civil penalties and requires Lyft to provide an in-app option for consumers to opt out of the sale or sharing of personal information. Lyft must also notify California consumers of their right to prevent their personal information from being sold. The agreement resolves the state's allegations concerning Lyft's previous opt-out process.

What Businesses Should Review

Companies that collect consumer information through mobile apps or digital platforms should review their privacy settings, advertising data practices, and opt-out procedures. Businesses should consider whether users can easily locate privacy controls, whether requests require unnecessary information, and whether the process works consistently across mobile apps and websites. The settlement demonstrates that providing a privacy policy alone may not satisfy applicable CCPA requirements.

How SJKP Can Help

SJKP can assist businesses with data privacy compliance, consumer protection matters, and regulatory risks involving personal information. Companies operating mobile applications, online platforms, or advertising services can work with counsel to review privacy policies, consumer opt-out procedures, and compliance obligations under the CCPA and other applicable privacy laws.