California's attorney general secured a $1.8 million settlement with Lyft for violating state privacy laws by failing to offer consumers an in-app option to prevent the sale of their personal information.
Lyft collected personal information like name, email, phone number, IP addresses, and geolocation data from riders and drivers. Since mid-2023, the company has been selling or sharing this personal information for targeted advertising. However, users could only request to opt out through a separate webpage in Lyft's privacy policy, requiring them to re-enter login information and leave the app to exercise the right.
"Lyft — a company that offers its services exclusively through an app — was selling and sharing user's personal information for targeted advertising without giving users a way to opt-out from within that app," said Attorney General Bonta. "Under California's nation-leading privacy law, consumers have the right to say no to the sale and sharing of their data, and businesses cannot throw up unnecessary roadblocks."
The settlement requires Lyft to provide an in-app opt-out option and notify California consumers of their right to prevent data sales. The $1.8 million in civil penalties mark the state's ninth enforcement action under the California Consumer Privacy Act. The settlement stems from a March 2025 investigative sweep concerning how companies use geolocation data.