California Attorney General Rob Bonta announced a $1.8 million settlement with Lyft on October 29, 2026. The agreement resolves allegations that the ride-hailing company violated the California Consumer Privacy Act and California’s Unfair Competition Law by failing to offer consumers the ability to opt out of the sale of their personal information within the Lyft mobile app.

The terms require the company to provide an in-app opt-out option for the sale of personal information and notify California consumers of their right to prevent the sale of their data. The settlement stems from a March 2025 investigative sweep concerning how companies use geolocation data, including in the context of selling or sharing consumers' personal information. Since mid-2023, Lyft sold or shared consumers’ personal information to target and display ads within its app without providing an in-app opt-out method.

Prior to the settlement, the only way for a consumer to opt out was to navigate through links in the Privacy Policy to a separate webpage. Lyft required consumers to re-enter login credentials and submit further personal information to exercise their right to opt out, despite already knowing their identity. The company collects and uses personal information such as name, email address, phone number, IP addresses, and non-precise geolocation data including city, state, region, or zip code.

"Lyft — a company that offers its services exclusively through an app — was selling and sharing user’s personal information for targeted advertising without giving users a way to opt-out from within that app," Bonta said. "Instead, consumers had to detour through a privacy policy, re-enter personal information, and transfer from the app to webpage just to exercise a right the law guarantees them."

"This is cumbersome and confusing — and in California, it’s illegal," he added. "Under California’s nation-leading privacy law, consumers have the right to say no to the sale and sharing of their data, and businesses cannot throw up unnecessary roadblocks." This settlement is the California Department of Justice's ninth enforcement action under the CCPA.