California Attorney General Rob Bonta announced on Oct. 29 a settlement with Lyft that includes $1.8 million in civil penalties. It resolves allegations that the ride-hailing company violated the California Consumer Privacy Act and the Unfair Competition Law by selling and sharing users’ personal information without giving them a way to opt out inside the app. The announcement carries no statement from Lyft.
What does California say Lyft did with users’ data?
Since mid-2023, the attorney general’s office says, Lyft sold or shared users’ personal information so it could target and show ads inside its app. Riders and drivers both must create accounts, and Lyft collects names, emails, phone numbers, IP addresses and non-precise location, meaning a city, state, region or ZIP code.
The app had no opt-out. People who wanted out had to follow links from the in-app privacy policy to a “Do Not Sell or Share My Personal Information” web page. There they had to log in again and submit more personal information, even though Lyft already knew who they were. “This is cumbersome and confusing — and in California, it’s illegal,” Bonta said.
What must Lyft change, and when is the money due?
Beyond the $1.8 million, the settlement requires Lyft to offer an in-app opt-out and to notify California consumers of their right to say no to the sale of their data. The announcement gives no compliance deadline and does not say when the penalty is due.
That leaves a practical question for anyone with a ride-hailing, food-delivery or streaming account: if a company is allowed to bury the opt-out behind a login and a second form, what are other apps doing with the same details? Bonta’s office says consumers “have the right to say no to the sale and sharing of their data.”
Retirement deadlines, in your inbox: Miss an enrollment or claim deadline and the money can be gone. Join the Retirement Money Brief and we’ll send you our 2026 Government Check Reality Tracker as a welcome gift.
Get the Brief + the check tracker →
We may earn a commission from links on this page.
How did a location-data sweep end up here?
The Lyft case grew out of a March 2025 investigative sweep of the location data industry, which looked at how companies use geolocation data, including when they sell or share personal information. The attorney general calls it the California Department of Justice’s ninth enforcement action under the privacy law.
The earlier settlements involved General Motors, Sephora, DoorDash, Disney, Jam City, Sling TV, Healthline.com and Tilting Point Media. Lyft is the ninth name on that list. The announcement links the settlement and a file-stamped complaint, and points consumers to the office’s guide on opting out.
The location data Lyft collects is described as non-precise, a city, state, region or ZIP code, so it points to an area and not a street address. The case turned on the sale and sharing of that data for advertising and on how hard it was to say no.
How can someone stop an app from selling their data?
California’s privacy rights, as the attorney general explains them, include the right to opt out of the sale or sharing of personal information. A business that sells or shares data must post a “Do Not Sell or Share My Personal Information” link, and the person does not need an account or identity verification to use it. The business must act on the request within 15 business days and generally must wait 12 months before asking the person to opt back in.
Businesses that collect data online must also honor a browser-based global privacy control as a valid opt-out request. Examples the attorney general lists include the Firefox, DuckDuckGo and Brave browsers and EFF’s Privacy Badger extension. For data brokers, CalPrivacy’s Delete Request and Opt-out Platform sends one deletion and opt-out request to more than 575 registered brokers.
Californians who think a company is breaking the law can file a complaint at oag.ca.gov/report. The attorney general does not represent individuals or give individual legal advice. These rights are California law, so people in other states depend on what their own state provides.
Where do the names and phone numbers an app sells end up?
Names, emails, phone numbers and IP addresses are the details a phishing email or a spoofed call leans on to sound like someone who knows the target. An opt-out slows the spread of that information, but it does not lock the accounts a thief would go after.
The story turns here from privacy to protection. “Scam-Proof Your Accounts in a Weekend” is a 13-page guide with ten moves in weekend order, including how to freeze your credit at all three bureaus and how to lock your bank logins with two-step login, alerts and a verbal password.
Get the weekend guide to freeze your credit and lock your bank logins →
This article was produced with AI assistance and edited for accuracy against the sources linked above.
Warren Cohen is a finance writer based in Phoenix, Arizona, covering personal finance topics including credit, banking, and beginner investing. He earned his degree in business administration from Arizona State University and began his career working in consumer finance, where he gained direct experience with lending and credit systems. He now writes for personal finance websites and fintech platforms, focusing on clear, practical content that helps readers make informed financial decisions.
