[Enforcement library](/enforcement)

# California v. Lyft: an app-only business needs an in-app opt-out

The California AG alleged Lyft sold or shared riders' and drivers' personal information, including coarse geolocation, for targeted in-app ads from mid-2023 without any in-app opt-out. Users had to follow links from the in-app privacy policy to a web form and re-enter login details. Lyft agreed to $1.8 million in civil penalties, an in-app opt-out and notice to California consumers.

## Key facts

- **Regulator or court:** California Attorney General (San Francisco Superior Court)
- **Jurisdiction:** California, US
- **Framework:** CCPA; UCL
- **Record date:** 2026-10-29
- **Procedural status:** Settlement announced 29 October 2026; complaint filed 28 October 2026 (CGC-26-641775)

If your service lives in an app, the opt-out has to live there too. California says sending users to a web form and asking them to log in again is not a CCPA opt-out.

[Start a free scan](/run-free-codebase-scan)

- **Court**: Superior Court of California, County of San Francisco
- **Case number**: CGC-26-641775
- **Parties**: People of the State of California v. Lyft, Inc.
- **Laws**: CCPA (Civ. Code § 1798.100 et seq.); UCL (Bus. & Prof. Code § 17200 et seq.)
- **Stage**: Complaint filed 28 October 2026; settlement announced 29 October 2026
- **Amount**: $1.8 million in civil penalties
- **Source review**: 30 October 2026

## The problem

Riders and drivers use Lyft only through its mobile app. The complaint alleges that starting in mid-2023 Lyft sold or shared their personal information, including coarse geolocation such as city, state, region or zip code, with third parties to target and display ads in the app. That triggered the CCPA right to opt out. Lyft offered no native in-app setting. The only route was a series of links in the in-app privacy policy to a "Do Not Sell or Share My Personal Information" web page in a mobile browser, where users who were already logged in had to resubmit their login and verify their identity ([Complaint](https://oag.ca.gov/system/files/attachments/press-docs/people-v-lyft-file-stamped-complaint.pdf); [California AG](https://oag.ca.gov/news/press-releases/privacy-rights-can%E2%80%99t-be-left-rearview-attorney-general-bonta-secures-18-million)).

## What the complaint alleged

| Issue | Allegation |
| --- | --- |
| Sale or sharing | Personal information, including coarse geolocation, disclosed to third parties for targeted ads from mid-2023 |
| Opt-out method | No in-app opt-out, even though the business interacts with consumers primarily through its app |
| Friction | Users were sent through privacy-policy links to a mobile web form and made to re-enter login credentials and verify identity |
| Origin | Found during the Attorney General's 2025 investigative sweep of apps, ad networks and data brokers using geolocation data; the sweep found Lyft did not sell or share precise geolocation |
| Claims | CCPA opt-out requirements and the UCL |

The AG calls this its ninth CCPA enforcement action ([California AG](https://oag.ca.gov/news/press-releases/privacy-rights-can%E2%80%99t-be-left-rearview-attorney-general-bonta-secures-18-million)).

## Technical issue

- **Data disclosed:** device identifiers, IP addresses and coarse geolocation, used to target ads in the app (alleged).
- **Opt-out path:** in-app privacy policy, then links to a mobile web form, then a second login and identity check (alleged).
- **Required fix:** an in-app opt-out and a notice to California consumers of the right to opt out.

**Inth's technical interpretation:** put the Do Not Sell or Share control where the user already is, tie it to the signed-in account, and make it take effect without asking for credentials or details the app already has. The same state should gate ad SDKs and server-side data sharing.

Sample:

```ts
// Opt-out lives on a web form that asks the signed-in user to log in again
settings.privacyLink = 'https://example.com/do-not-sell';

// In-app toggle writes the opt-out for the signed-in account
settings.onToggle('doNotSellOrShare', async (on) => {
  await consent.set({ saleOrShare: on ? 'denied' : 'granted', account: session.userId });
});
```

## Timeline

| Date | Event |
| --- | --- |
| Mid-2023 | Lyft begins selling or sharing personal information for in-app targeted ads (alleged) |
| 2025 | Attorney General's investigative sweep on geolocation data (the press release dates it to March 2025) |
| 28 October 2026 | Complaint filed in San Francisco Superior Court (CGC-26-641775) |
| 29 October 2026 | Settlement announced: $1.8 million, in-app opt-out and consumer notice |

## Outcome

Lyft settled. It must pay $1.8 million in civil penalties, provide an in-app opt-out and notify California consumers of their right to stop the sale of their personal information ([California AG](https://oag.ca.gov/news/press-releases/privacy-rights-can%E2%80%99t-be-left-rearview-attorney-general-bonta-secures-18-million)). The sources reviewed do not say whether Lyft admitted the allegations.

## What it cost

| Item | Amount | Source |
| --- | --- | --- |
| Civil penalties | $1.8 million | [California AG](https://oag.ca.gov/news/press-releases/privacy-rights-can%E2%80%99t-be-left-rearview-attorney-general-bonta-secures-18-million) |
| Product changes | In-app opt-out and consumer notice | [California AG](https://oag.ca.gov/news/press-releases/privacy-rights-can%E2%80%99t-be-left-rearview-attorney-general-bonta-secures-18-million) |

## Why it matters

- **The opt-out must match how you interact with users.** An app-only business cannot rely on a web form.
- **No re-login for a signed-in user.** Asking for credentials the business already has was pleaded as an unnecessary barrier.
- **Coarse location counts.** The sweep focused on geolocation, and city or zip-level data was enough to trigger the opt-out right here. Compare [General Motors](/enforcement/general-motors), [Sephora](/enforcement/sephora) and [Healthline](/enforcement/healthline).

## How Inth catches this

- **Consent banner**: Provides an opt-out of sale or sharing that can sit inside your product and writes the choice to the signed-in account, so tags and SDKs read one denied state.
- **Website audit**: Checks websites for a working Do Not Sell or Share path and for ad and analytics requests after an opt-out. It does not test native app flows.

### Out of reach

- Inth's audit covers websites, not native mobile apps, which is where Lyft's missing opt-out was.

Opt-out records with choice, account or device, country and policy version.

[Start a free scan](/run-free-codebase-scan)

## Checks for your own systems

Your ticks stay on this page. Inth does not save or send them.

### In the repository

- [ ] Find where Do Not Sell or Share is offered in each app and on the web, and whether it needs a new login.
- [ ] Confirm ad SDKs and server-side data sharing read the opt-out before sending.

### In the browser and network

- [ ] Opt out from inside the app and confirm ad requests carrying identifiers or location stop.
- [ ] Time how many steps the opt-out takes compared with signing up.

### With the people responsible

- [ ] Check whether coarse location or zip-level data is shared with ad partners.
- [ ] Agree on a notice to existing users if the opt-out path changes.

## Sources and limits

- [California AG press release](https://oag.ca.gov/news/press-releases/privacy-rights-can%E2%80%99t-be-left-rearview-attorney-general-bonta-secures-18-million), 29 October 2026
- [Complaint, CGC-26-641775](https://oag.ca.gov/system/files/attachments/press-docs/people-v-lyft-file-stamped-complaint.pdf), filed 28 October 2026
- [Settlement document linked by the AG](https://oag.ca.gov/system/files/attachments/press-docs/caseinfo.pdf)

The press release and the complaint were opened. The settlement document is a scanned PDF and its text was not read, so its injunctive terms beyond those in the press release are not described here.

Source review: 30 October 2026. This page describes the cited record and procedural stage. It does not audit the company's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

## Related cases

[Every case in the Enforcement library](/enforcement)