OAKLAND, California — Lyft will pay $1.8 million in civil penalties and must give California riders a working in-app way to stop the sale of their personal information, under a settlement Attorney General Rob Bonta announced on Thursday, October 29. The settlement resolves allegations that Lyft violated the California Consumer Privacy Act (CCPA) and the state's Unfair Competition Law by failing to offer consumers the ability to opt out of the sale of their personal information within Lyft's mobile app, the Attorney General's office said.

Source: California Attorney General Rob Bonta, press release, Oct 29, 2026

Since 2023, according to the Attorney General's allegations as reported by Bloomberg Tax, Lyft had been selling users' personal information to target and display ads within the Lyft app, without giving users a way to stop the sale of their data. The 'sale' at issue is not a rider's name on a list passed hand to hand; under the CCPA, sharing personal information for advertising purposes can count as a sale — and California consumers have a legal right to say no to it.

Source: Bloomberg Tax, Oct 29, 2026

What Lyft offered instead, the Attorney General said, was a roadblock: to reach Lyft's 'Do Not Sell or Share My Personal Information' webpage, a consumer had to dig through the in-app Privacy Policy to find the route out of the app — a cumbersome process that, in the Attorney General's assessment, does not satisfy the CCPA's requirements that opting out be easy. The settlement's headline obligation follows directly from that finding: the opt-out must now live inside the app itself.

What Lyft must now do

In addition to the $1.8 million in civil penalties, the settlement requires Lyft to provide an in-app opt-out option and to notify California consumers of their right not to have their personal information sold. 'Under California's nation-leading privacy law, consumers have the right to say no to the sale and sharing of their data, and businesses cannot throw up unnecessary roadblocks,' Attorney General Bonta said in announcing the settlement. The allegations were resolved by settlement; the Attorney General's release describes them as allegations, and this report does the same.

Where the case came from: the 2025 geolocation sweep

The Lyft settlement stems from a March 2025 investigative sweep by the Attorney General's office into how companies use geolocation data, including in the context of selling or sharing consumers' personal information. Location data is among the most sensitive categories a phone produces: for a rideshare app, it can show where a person lives, works, worships and seeks medical care. That is why this case matters beyond one app's settings menu — it is a ruling, in settlement form, on how visible and how easy the exit from data-selling has to be for the business model built on that location trail.

The law underneath: what the CCPA guarantees

The California Consumer Privacy Act vests California consumers with control over the personal information businesses collect about them, including the right to request that businesses stop selling or sharing it, the Attorney General's office explains. The Lyft case turns on a practical point inside that right: an opt-out that exists only in theory, buried behind an in-app policy document and an external webpage, is not the opt-out the law promises. California consumers can read about their CCPA rights at oag.ca.gov/ccpa and can report a suspected violation to the Attorney General online at oag.ca.gov/report, the office notes.

The ninth CCPA action — a pattern, not a one-off

Thursday's settlement is the California Department of Justice's ninth enforcement action under the CCPA, the Attorney General said. The office's earlier CCPA settlements include General Motors — itself the subject of a separate, much larger $220 million multistate settlement announced the same day over the sale of drivers' location and behaviour data — as well as Sephora, DoorDash and Disney, mobile gaming company Jam City, streaming service Sling TV, website publisher Healthline.com and entertainment company Tilting Point Media. Read together, the sequence shows a regulator working the same seam across industries: data collected for one stated purpose quietly monetised for another.

Why it matters for California's riders — and its drivers

California is Awaaz Punjab's largest US readership hub, and rideshare and delivery apps are both a daily transport tool and a livelihood across the Punjabi diaspora in the Central Valley and the Bay Area. The personal information at issue in this case is the data of the app's users — the people whose trips, pickup points and destinations make the service run. A settlement that forces the opt-out into the app, and forces the company to tell users the right exists, changes what every California user will actually see the next time they open their privacy settings.

What happens next

Lyft must pay the $1.8 million in civil penalties and implement the in-app opt-out and consumer notification the settlement requires. California users should expect the 'Do Not Sell or Share' control to become reachable from inside the app rather than only through the external webpage, and anyone who believes a business is ignoring an opt-out can file a complaint with the Attorney General. For the Attorney General's office, the case closes one file from the March 2025 geolocation sweep — and its ninth CCPA action signals the sweep's method, testing whether a stated privacy right works in practice, will be applied to other apps that trade in location data.