If your service lives in an app, the opt-out has to live there too. California says sending users to a web form and asking them to log in again is not a CCPA opt-out.
Riders and drivers use Lyft only through its mobile app. The complaint alleges that starting in mid-2023 Lyft sold or shared their personal information, including coarse geolocation such as city, state, region or zip code, with third parties to target and display ads in the app. That triggered the CCPA right to opt out. Lyft offered no native in-app setting. The only route was a series of links in the in-app privacy policy to a "Do Not Sell or Share My Personal Information" web page in a mobile browser, where users who were already logged in had to resubmit their login and verify their identity (Complaint; California AG).
| Issue | Allegation |
|---|---|
| Sale or sharing | Personal information, including coarse geolocation, disclosed to third parties for targeted ads from mid-2023 |
| Opt-out method | No in-app opt-out, even though the business interacts with consumers primarily through its app |
| Friction | Users were sent through privacy-policy links to a mobile web form and made to re-enter login credentials and verify identity |
| Origin | Found during the Attorney General's 2025 investigative sweep of apps, ad networks and data brokers using geolocation data; the sweep found Lyft did not sell or share precise geolocation |
| Claims | CCPA opt-out requirements and the UCL |
The AG calls this its ninth CCPA enforcement action (California AG).
Inth's technical interpretation: put the Do Not Sell or Share control where the user already is, tie it to the signed-in account, and make it take effect without asking for credentials or details the app already has. The same state should gate ad SDKs and server-side data sharing.
// Opt-out lives on a web form that asks the signed-in user to log in again
settings.privacyLink = 'https://example.com/do-not-sell';
// In-app toggle writes the opt-out for the signed-in account
settings.onToggle('doNotSellOrShare', async (on) => {
await consent.set({ saleOrShare: on ? 'denied' : 'granted', account: session.userId });
});
| Date | Event |
|---|---|
| Mid-2023 | Lyft begins selling or sharing personal information for in-app targeted ads (alleged) |
| 2025 | Attorney General's investigative sweep on geolocation data (the press release dates it to March 2025) |
| 28 October 2026 | Complaint filed in San Francisco Superior Court (CGC-26-641775) |
| 29 October 2026 | Settlement announced: $1.8 million, in-app opt-out and consumer notice |
Lyft settled. It must pay $1.8 million in civil penalties, provide an in-app opt-out and notify California consumers of their right to stop the sale of their personal information (California AG). The sources reviewed do not say whether Lyft admitted the allegations.
| Item | Amount | Source |
|---|---|---|
| Civil penalties | $1.8 million | California AG |
| Product changes | In-app opt-out and consumer notice | California AG |
Provides an opt-out of sale or sharing that can sit inside your product and writes the choice to the signed-in account, so tags and SDKs read one denied state.
Checks websites for a working Do Not Sell or Share path and for ad and analytics requests after an opt-out. It does not test native app flows.
Opt-out records with choice, account or device, country and policy version.
Start a free scanYour ticks stay on this page. Inth does not save or send them.
The press release and the complaint were opened. The settlement document is a scanned PDF and its text was not read, so its injunctive terms beyond those in the press release are not described here.
Source review: 30 October 2026. This page describes the cited record and procedural stage. It does not audit the company's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.