01. No opt-out inside the app
Since mid-2023, Lyft sold or shared personal information to target and display ads inside the app, and the app itself offered no opt-out.
Lyft: $1.8M California privacy settlement
California's $1.8 million Lyft settlement resolves allegations that the rideshare app sold or shared personal information for in-app ads without an opt-out inside the app. Lyft must offer that opt-out in the app and tell California consumers they can refuse the sale.
- CCPA
- California
Last updated
Enforcement snapshot
- Amount
- $1.8M
- Regulator
- California Attorney General
- Sector
- Rideshare
- Published
- October 2026
Technical failure modes
What failed
02. The only path left the app
The only opt-out ran from the in-app privacy policy through a series of links to a Do Not Sell or Share webpage. The Attorney General said that process does not meet the CCPA.
03. People had to re-enter information Lyft already had
Lyft required an account to use the app, then still required people to log in again and submit more personal information to opt out.
Remediation path
What Ketch would help validate
Related paths
Related product and solution paths
More enforcement analysis
Other settlements with the same failure modes
Next step
Do not wait for a demand letter to find the gap
The Lyft settlement is the in-app opt-out case. A logged-in app has to offer the sale and share opt-out where the person already is, without a webpage that asks for information the company already holds.
Get Started Free
Get started in less than 5 min