Lyft’s $1.8 Million CCPA Settlement: If Your Service Lives in an App, Your Opt-Out Must Too

The Settlement at a Glance

On October 29, 2026, California Attorney General Rob Bonta announced a $1.8 million settlement with Lyft resolving allegations that the rideshare company violated the California Consumer Privacy Act (CCPA) and California’s Unfair Competition Law. The core problem was straightforward: Lyft delivers its service entirely through a mobile app, yet consumers who wanted to stop Lyft from selling or sharing their data could not do so inside that app.

The case is the California Department of Justice’s ninth CCPA enforcement action. It also arrives as the California Privacy Protection Agency (CalPrivacy) prepares to vote on rules that push in the same direction. For any business whose customers live in an app, the message is that the opt-out has to live there too, and that it has to actually work everywhere the business tracks the consumer.

We previously wrote about the Attorney General’s record settlement with Disney and CalPrivacy’s actions against Ford and PlayOn Sports. The Lyft settlement draws on themes from each of them.

What the Attorney General Alleged

The investigation grew out of the Attorney General’s March 2025 investigative sweep of apps, ad networks, and data brokers handling location data. According to the complaint, filed in San Francisco Superior Court, the key facts are as follows:

• The data. Beginning in mid-2023, Lyft disclosed device identifiers, IP addresses, and coarse geolocation (city, region, or ZIP-level location) to third parties to target ads to passengers inside the Lyft app. The AG noted that this let Lyft charge more for in-app advertising and created a new revenue stream. Lyft did not sell or share precise geolocation, but the coarse data alone was enough to trigger opt-out rights. (For why identifiers and IP addresses count, see our discussion of what qualifies as “personal information”.)
• No native control. Lyft offers its service only through its rider and driver apps, but neither app had an in-app setting to opt out of sale or sharing.
• The detour. To opt out, a consumer had to open Lyft’s in-app privacy policy, follow a series of links, and land on a “Do Not Sell or Share My Personal Information” webpage in a mobile browser.
• Redundant verification. Once there, consumers had to log in again and verify their identity before the opt-out took effect, even though they were already signed into the app and Lyft already knew who they were.

The AG framed these facts as two violations of the CCPA and its regulations: failing to offer an opt-out method that reflects how the business primarily interacts with consumers, and failing to offer a method that is easy to execute, requires minimal steps, and asks for no more information than necessary (Civil Code §§ 1798.120 and 1798.135; 11 C.C.R. §§ 7013 and 7026). The complaint’s central theme is intuitive, and regulators have repeated it with growing impatience. If a gig platform can deliver its service with one tap, it can let consumers opt out with one tap. As Bonta put it, the process was “cumbersome and confusing — and in California, it’s illegal.”

The re-verification point deserves emphasis. The CCPA regulations already prohibit requiring a verifiable consumer request to opt out, which is the same issue that cost Ford $375,703 before CalPrivacy earlier this year. Asking an already-authenticated user to authenticate again is friction regulators now treat as a violation in its own right.

What the Settlement Requires

Beyond the $1.8 million in civil penalties, the stipulated judgment requires Lyft to tell California consumers about their right to stop the sale of their data and to overhaul how opt-outs work. In summary, Lyft must:

1. Put the opt-out in the app. Provide a clear and conspicuous in-app opt-out link that takes effect immediately.
2. Apply logged-in opt-outs account-wide. When a consumer opts out while logged in on the website or app, including through an opt-out preference signal such as Global Privacy Control (GPC), honor that choice across every service tied to the consumer’s account.
3. Handle logged-out and account-less consumers. When a consumer opts out while logged out, or has no account, tell them that logging in may be necessary or ask only for the minimal information needed to process the request.
4. Fall back to the device and its profiles. If the consumer declines to log in or provide information, or has no account, apply the opt-out to that browser, app, or device and to any profile associated with it, including pseudonymous profiles used for sale, sharing, or cross-context behavioral advertising.
5. Let consumers confirm the result. Provide a way to verify that the opt-out was processed, for example in the account’s settings or preferences menu.
6. Keep other choices from muddying the opt-out. Where Lyft offers other privacy controls, such as cookie preferences, email marketing settings, or vendor-specific choices, avoid wording and design that could lead consumers to think those choices are required to opt out, or that they count as an opt-out.
7. Pass the request downstream. Notify every third party that received the consumer’s data between the opt-out request and Lyft’s compliance, direct them to honor it, and direct them to forward it to anyone they shared the data with during that window.

Several of these terms restate obligations already in the CCPA regulations. Downstream notification tracks 11 C.C.R. § 7026(f)(2), and the confirmation requirement reflects the rule, effective January 1, 2026, that businesses show consumers their opt-out was honored. The choice-architecture term echoes the regulators’ longstanding position that a cookie banner is not, by itself, a valid way to opt out of sale or sharing, a theme we explored in When the Banner Says One Thing and the Website Does Another.

Our Takeaway: The Settlement Goes Further Than the Complaint

The most notable feature of the Lyft settlement is what it adds. The complaint is narrow: it alleges a missing in-app opt-out and a burdensome off-app process. It says nothing about Lyft failing to apply opt-outs across devices or accounts. Yet the settlement imposes detailed cross-device, cross-account, and pseudonymous-profile requirements anyway.

Those terms closely resemble the Attorney General’s February 2026 settlement with Disney. There, the cross-device problem was the heart of the case: Disney’s opt-out toggles, webform, and GPC handling each applied only to a single service or device, even for logged-in users. As we noted in our analysis of the Disney settlement, the AG expects one request to stop selling and sharing everywhere the business can connect the consumer.

The practical lesson is that the Disney terms are becoming a template. When the AG resolves an opt-out case, businesses should expect the full package of account-wide effectuation, logged-out fallbacks, pseudonymous-profile coverage, and confirmation, regardless of which specific failure prompted the investigation.

The Lyft facts show why this matters even outside a multi-service media company. According to the complaint, a person who both rides and drives with Lyft has a single account linking their passenger and driver profiles across two separate apps. An opt-out that stopped at one app, or one device, would leave data flowing from the other.

CalPrivacy Is Heading the Same Way

California has two CCPA enforcers, and the second one is moving toward the same standard by regulation. CalPrivacy staff released proposed amendments to the opt-out preference signal regulations for the agency’s November 5–6, 2026 board meeting, where the board may vote to open formal rulemaking with a public comment period. The draft is not yet law, but it signals how the agency reads existing obligations. Among other things, it would:

• Name GPC expressly as an example of a signal businesses must honor.
• Extend signals across linked devices. In one new example, a retailer uses fingerprinting or similar matching to link a shopper’s laptop and phone into a pseudonymous profile without any login. Once the user enables GPC on their laptop, the retailer must stop selling and sharing data tied to both devices.
• Limit the duty where nothing is linked. A business that keeps data in unlinked, device-specific form need only apply the signal to that device, and need not collect more data to link devices.
• Shut down cookie syncing by third-party trackers once a signal is received.
• Address tag sequencing. A site that lets advertising pixels fire before its consent management platform checks for GPC has not complied as soon as feasibly possible.
• Protect the signal in browsers. Browser features that act for the consumer must not block or contradict the consumer’s signal.

Read together with the Lyft and Disney settlements, the direction is clear: the more a business knows about who a consumer is and which devices they use, the further an opt-out must reach. Pseudonymous tracking is not a way around that; it is the reason the obligation extends.

Two further developments raise the stakes. In July 2026, CalPrivacy launched its first sectoral audit, aimed at gig economy platforms, meaning rideshare, delivery, and task apps now face scrutiny from both regulators. And California’s Opt Me Out Act (AB 566) will require browsers to offer a built-in opt-out preference signal starting January 1, 2027, which should sharply increase the volume of signals businesses receive (see our GPC and universal opt-out page).

Practical Steps for App-First Businesses

Companies that sell or “share” (as is regulatorily defined) personal information, particularly those that operate primarily through mobile apps, connected TV apps, or other non-browser interfaces, should consider the following:

1. Map where you actually interact with consumers. If the app is the main channel, the opt-out belongs in the app’s settings, not behind a privacy policy link that opens a browser. Our post on the Jam City settlement covers similar issues for app developers.
2. Remove re-authentication. Do not make a logged-in user sign in again, or verify their identity, to opt out. Ask only for what you truly need to process the request.
3. Trace every identity link you maintain. List the accounts, apps, brands, devices, and pseudonymous profiles you connect, then confirm an opt-out from any one entry point stops sale and sharing across all of them.
4. Build the logged-out path. Decide what you show a consumer who is not signed in, and make sure a declined login still produces a device- and profile-level opt-out.
5. Test GPC end to end. Confirm the signal is read before advertising tags fire, that it suppresses cookie syncing, and that it carries to the account when the user is known.
6. Show the result. Give consumers a visible confirmation, such as an “Opt-Out Request Honored” message or a settings toggle reflecting their status.
7. Separate the controls. Keep cookie settings, email preferences, and vendor choices visually and functionally distinct from the “Do Not Sell or Share” choice, and avoid wording that blurs them.
8. Close the loop with third parties. Confirm you can notify downstream recipients of opt-outs, and that your data processing agreements and ad-tech contracts require them to honor and forward those requests.
9. Update your documentation. Make sure your privacy policy accurately describes how opt-outs and signals are processed, and that your privacy risk assessments cover selling and sharing as the 2026 regulations require.

The common thread is verification in practice. Regulators are not just checking whether an opt-out link exists; they are testing whether data stops flowing after a consumer uses it.

Looking Ahead

The Lyft settlement adds to a fast-growing body of California opt-out enforcement, including Tractor Supply, Healthline, Disney, PlayOn, Ford, and the Attorney General’s $12.75 million settlement with General Motors. A running list is on our CCPA page. Each case narrows the gap between having an opt-out and having one that works the way consumers use the product.

RICHT advises businesses on CCPA compliance, targeted advertising, opt-out preference signals, and consumer privacy rights requests, from initial data mapping through testing of live opt-out flows. For a broader view of the current landscape, see The 2026 Privacy Law and Compliance State of Play.

---

This post is for general informational purposes only and is not legal advice. Readers should consult counsel about their specific facts and circumstances.

---