Lyft Hit With $1.8 Million Privacy Settlement — What California Customers Should Know

October 30, 2026

Lyft privacy settlement — Lyft agreed to pay $1.8 million in civil penalties after California officials alleged that the rideshare company made it unnecessarily difficult for consumers to opt out of the sale or sharing of their personal information. Jonathan Weiss/Shutterstock

If you use Lyft to get around town, you probably expect the company to know your name, phone number, and where you need a ride. But you might not realize that some of your personal information could also be used for targeted advertising. Now, California officials say Lyft made it unnecessarily difficult for customers to stop the sale or sharing of their information, resulting in a $1.8 million settlement.

On October 29, 2026, California Attorney General Rob Bonta announced the settlement, resolving allegations that Lyft violated the California Consumer Privacy Act (CCPA) and the state’s Unfair Competition Law.

The case highlights an important issue for consumers: Even when companies provide privacy controls, those protections may be difficult to find or use.

Here’s what happened, what Lyft must change, and how California residents can exercise their privacy rights.

Why California Took Action Against Lyft

The investigation centered on how Lyft allowed customers and drivers to opt out of the sale or sharing of their personal information. According to the California Department of Justice, Lyft had been selling or sharing consumer information for targeted advertising within its mobile application since mid-2023. However, users couldn’t exercise their opt-out rights directly within the app, even though they were required to use it to access Lyft’s services. Instead, they had to navigate through multiple privacy policy links before reaching a separate webpage. California officials determined that this process created unnecessary barriers that violated the state’s privacy requirements.

Customers Had to Navigate a Complicated Opt-Out Process

For someone trying to protect their information, opting out wasn’t as simple as changing a setting in the Lyft app. The Attorney General’s investigation found that consumers were directed through the app’s Privacy Policy to a separate webpage labeled “Do Not Sell or Share My Personal Information.” Once there, they had to re-enter login credentials and provide additional personal information, despite already being authenticated through Lyft’s app. California officials argued that requiring these extra steps discouraged consumers from exercising rights guaranteed under state law. The case demonstrates why accessibility matters when businesses provide privacy controls.

What Personal Information Was Involved?

Lyft collects several categories of personal information from riders and drivers who create accounts. According to the state’s announcement, this includes names, email addresses, phone numbers, IP addresses, and non-precise location information such as cities, states, regions, and ZIP codes. The Attorney General alleged that Lyft sold or shared consumer information for advertising purposes without providing an adequate in-app opt-out method. Although the investigation originated from a broader examination of geolocation practices, the announcement doesn’t establish that Lyft sold precise ride histories or real-time GPS coordinates. Understanding that distinction is important because consumers deserve accurate information about which privacy practices were involved.

Lyft Must Pay $1.8 Million and Change Its Privacy Controls

Under the settlement, Lyft must pay $1.8 million in civil penalties and make changes to how consumers exercise their privacy rights. The company is required to provide an opt-out option within its mobile app rather than forcing users to navigate to a separate webpage. Lyft must also notify California consumers about their right to prevent the sale or sharing of personal information. The settlement addresses the company’s alleged violations of California privacy law, but the Attorney General’s announcement doesn’t describe a direct reimbursement program for affected customers. Consumers should therefore avoid assuming they qualify for a settlement payment simply because they previously used Lyft.

Why This Matters for Your Financial Privacy

Personal information has commercial value because businesses can use it to understand consumer behavior, personalize advertising, and develop marketing strategies. Although targeted advertising isn’t necessarily fraudulent, consumers may reasonably want more control over how their personal details are used. Information such as contact details and location data can also create privacy concerns when it circulates among companies or data brokers. The Federal Trade Commission encourages consumers to review privacy settings and consider how much information they share through websites and mobile applications. Protecting your data won’t guarantee protection from scams or identity theft, but it can be one part of a broader financial security strategy.

California Residents Have Additional Privacy Protections

The California Consumer Privacy Act gives eligible consumers several rights involving the personal information businesses collect and use. According to the California Attorney General’s CCPA guidance, these include rights to know, delete, and correct certain personal information, as well as the right to opt out of its sale or sharing, subject to applicable exceptions. Businesses covered by the law must provide appropriate methods for consumers to exercise those rights. Californians who believe a business is violating privacy requirements can submit a complaint through the Attorney General’s reporting portal. Consumers outside California may have different rights depending on their state’s privacy laws and the company’s policies.

A New California Tool Can Help Limit Data Broker Exposure

The Attorney General also highlighted a separate privacy tool designed to help Californians manage information held by registered data brokers. Called the Delete Request and Opt-out Platform, or DROP, the service was developed by California’s privacy regulator, CalPrivacy. According to the state’s announcement, eligible California residents can use the platform to send one deletion request covering more than 575 registered data brokers. The tool is intended to simplify a process that would otherwise require consumers to contact numerous businesses individually. Residents interested in the service can learn more through the official DROP website, although deletion obligations and exceptions depend on applicable law.

What Lyft Users Should Do Now

California Lyft users concerned about their information should review the privacy controls available within their accounts and look for options concerning the sale or sharing of personal data. If an expected opt-out option isn’t available, consumers can consult Lyft’s privacy resources or contact the company for assistance. It’s also worth reviewing privacy settings in other transportation, shopping, financial, and delivery apps that may collect similar categories of information. Avoid responding to unsolicited messages promising compensation from the Lyft settlement unless the information can be verified through an official source. Consumers who believe their California privacy rights have been violated can contact the Attorney General’s office for information about submitting a complaint.

The Bigger Lesson From Lyft’s Privacy Settlement

The $1.8 million Lyft settlement reinforces that privacy rights must be practical for consumers to exercise, not simply buried in complicated menus or legal disclosures. California officials determined that Lyft’s opt-out process created unnecessary obstacles for people trying to control how their personal information was used. The required changes should make those choices more accessible to California riders and drivers. For consumers, the case is also a reminder to review privacy settings, understand how companies use personal data, and take advantage of protections available under state law. Your personal information has value, and understanding your rights is an important part of protecting your financial and digital privacy.

Do you regularly check the privacy settings on apps like Lyft, Uber, or food delivery services? Have you ever had trouble finding a company’s opt-out option? Share your experience in the comments.