Lyft pays $1.8 million in California privacy case. How to opt out of data sales
The state says Lyft made riders leave its app to stop the sale of their data. A free state tool can also ask hundreds of data brokers to delete your information.
Lyft will pay $1.8 million in civil penalties and add a way to opt out of the sale of personal information inside its app, under a settlement announced Oct. 29 by California Attorney General Rob Bonta. The state alleged the ride-hailing company broke the California Consumer Privacy Act (CCPA), the 2018 state law that lets Californians tell businesses not to sell or share their data.
According to the attorney general's office, since mid-2023 Lyft has used riders' and drivers' names, emails, phone numbers, IP addresses and general location, such as city or ZIP code, to show targeted ads in its app. The only way to opt out was to follow links from the app's privacy policy to a webpage and log in again. Bonta said businesses "cannot throw up unnecessary roadblocks." It is the state's ninth CCPA enforcement case.
How to opt out: Under the CCPA, businesses that sell data must post a "Do Not Sell or Share My Personal Information" link and cannot make you create an account to use it, the attorney general's office says. If you can't find the link, check the privacy policy. Complaints can go to the attorney general.
For data brokers, companies that buy and resell personal information, California's free Delete Request and Opt-out Platform, or DROP, sends one deletion request to more than 600 registered brokers. Residents verify their identity, create a profile and submit. Brokers must check DROP at least every 45 days, and status updates can take up to 90 days, CalPrivacy, the state privacy agency, says.
Source: California Attorney General news release, Oct. 29, 2026; CCPA overview; CalPrivacy DROP page.