Lyft Reaches $1.8 Million Privacy Deal: What Riders Should Know About Their Information

If you use Lyft to get around, you likely expect the company to collect basics such as your name, phone number, and ride details. What you may not realize is that some of your personal information could also be used for targeted advertising. California officials now say Lyft made it unnecessarily difficult for customers to stop the sale or sharing of their data, leading to a $1.8 million settlement.

California Attorney General Rob Bonta announced the settlement, which resolves allegations that Lyft violated the California Consumer Privacy Act (CCPA) and the state’s Unfair Competition Law.

The case underscores a broader concern for consumers: privacy tools may exist, but they are not always easy to find or use.

Here is a closer look at what happened, what Lyft must change, and how California residents can use their privacy rights.

Why California Acted Against Lyft

The investigation focused on how Lyft allowed customers and drivers to opt out of the sale or sharing of their personal information. According to the California Department of Justice, Lyft had been selling or sharing consumer information for targeted advertising within its mobile app since mid-2023. However, users could not exercise their opt-out rights directly in the app, even though the app was required to use Lyft’s services. Instead, they had to work through several privacy policy links before reaching a separate webpage. California officials said that setup created unnecessary barriers that conflicted with the state’s privacy rules.

Users Faced a Complicated Opt-Out Process

For anyone trying to protect their data, the process was far from a simple app setting. The Attorney General’s investigation found that consumers were sent from Lyft’s Privacy Policy to a separate page labeled “Do Not Sell or Share My Personal Information.” Once there, they had to enter login credentials again and provide additional personal information, even though they were already authenticated through the Lyft app. California officials argued that these extra steps discouraged people from using rights guaranteed under state law. The case shows why privacy controls need to be easy to access if businesses expect consumers to use them.

What Information Was at Issue?

Lyft collects several categories of personal information from riders and drivers who create accounts. According to the state’s announcement, this includes names, email addresses, phone numbers, IP addresses, and general location details such as cities, states, regions, and ZIP codes. The Attorney General alleged that Lyft sold or shared consumer information for advertising purposes without offering an adequate in-app opt-out method. Although the investigation began as part of a broader review of geolocation practices, the announcement does not say Lyft sold precise ride histories or real-time GPS coordinates. That distinction matters because consumers deserve clear information about which privacy practices were involved.

Lyft Must Pay and Update Its Privacy Controls

Under the settlement, Lyft must pay $1.8 million in civil penalties and change how consumers can exercise their privacy rights. The company must provide an opt-out option inside its mobile app instead of pushing users to a separate website. Lyft must also notify California consumers about their right to stop the sale or sharing of personal information. The settlement addresses the alleged violations of California privacy law, but the Attorney General’s announcement does not describe a direct reimbursement program for affected customers. Consumers should not assume they qualify for a settlement payment simply because they used Lyft.

Why the Case Matters for Financial Privacy

Personal information has commercial value because businesses can use it to track behavior, tailor advertisements, and shape marketing plans. Targeted advertising is not necessarily deceptive, but many consumers want more control over how their information is used. Details such as contact information and location data can also create privacy concerns when shared among companies or data brokers. People should be cautious about unsolicited messages promising compensation from the Lyft settlement unless the information is confirmed through an official source. Consumers who believe their California privacy rights were violated can contact the Attorney General’s office for guidance on filing a complaint.

Another Tool for California Residents

The Lyft settlement comes as California continues expanding ways for residents to control their personal information. The state’s Delete Request and Opt-out Platform, known as DROP, allows eligible California residents to submit one deletion request to more than 575 registered data brokers. Built by the California Privacy Protection Agency, the platform is designed to make it easier for consumers to limit the personal information data brokers keep and sell. Residents can learn more through the official DROP website. The tool is separate from Lyft’s settlement and does not automatically erase every piece of information held by every business.

How to Check Your Privacy Settings

Lyft users should review the app’s privacy settings and look for options related to the sale or sharing of personal information. California residents have specific rights under the CCPA, including the ability to request that covered businesses stop selling or sharing their data. If you cannot find an opt-out option, check the company’s privacy policy or contact customer support for help. You can also review the California Attorney General’s CCPA resources to better understand the protections available under state law. Spending a few minutes reviewing privacy settings in rideshare, shopping, and delivery apps can help you make more informed choices about how your information is used.

The Broader Lesson From the Settlement

The $1.8 million Lyft settlement makes clear that privacy rights must be practical to use, not buried in complex menus or legal language. California officials concluded that Lyft’s opt-out process created unnecessary obstacles for people trying to control how their personal information was used. The required changes are meant to make those choices easier to access for California riders and drivers. For consumers, the case is also a reminder to review privacy settings, understand how companies use personal data, and use the protections available under state law. Your personal information has value, and knowing your rights is an important part of protecting your digital and financial privacy.