Lyft pays $1.8 million over hard-to-find ad opt-outs in its app

Lyft will pay $1.8 million to settle claims by California that it made it too hard to say no to targeted ads. Attorney General Rob Bonta announced the deal on October 29, 2026. The state says Lyft sold and shared rider and driver data for advertising, but offered no way to opt out inside the app.

What California says happened

According to the attorney general, people who wanted to opt out had to leave the app. They followed links from the privacy policy to a webpage, then logged in again. The case rests on California's privacy law, the CCPA, and its Unfair Competition Law.

The complaint puts it bluntly: if Lyft and other gig-economy businesses can offer their services with just a tap in an app, they can and must allow consumers to opt out with the same ease.

Location data is part of it

The complaint says Lyft gave third parties location data, device identifiers and IP addresses to target ads. That let Lyft charge more for ads on its app. The location data was not precise. It was city, state, region or zip code level.

Even so, the settlement requires Lyft to assess how it uses location data for ads and to monitor that use for three years. A lawyer who wrote about the case says it suggests the state is watching ad targeting with location data closely, even when the data is not exact.

Other terms in the settlement

• Drivers and riders both count as consumers. Some people use one account for both roles.
• Lyft must review new or changed features that use personal data before launch.
• Assessments of selling or sharing data, sensitive data and location for ads are due within 180 days.
• If someone without an account opts out, Lyft may ask for the minimum details needed. If they decline, the opt-out still covers that browser, app or device.

Why it matters beyond Lyft

The case follows an earlier California action against Disney. The idea in both is that if a company links data across its services to sell ads, it must link the opt-out the same way. A California privacy agency has also proposed rule changes that draw examples from the Disney case.

What to do

For any business with an app, the lesson is simple. If customers can use your service in the app, they should be able to opt out there. Do not make someone who is already logged in verify themselves again. Before linking accounts or data sets, think about how far an opt-out must reach.

Risk assessments have been required in California since January 1, 2026. The first attestations are due April 1, 2028. Businesses that have not started should.