Lyft had a "Do Not Sell or Share My Personal Information" page. California fined it anyway, because getting there meant leaving the app, finding the privacy policy, and then proving who you were to a company that already knew. If your opt-out works but takes a scenic route, this settlement is about you.
What Happened
On October 29, 2026, Attorney General Rob Bonta announced a $1.8 million settlement with Lyft under the CCPA and California's Unfair Competition Law. It's the Department of Justice's ninth CCPA enforcement action, following settlements with Sephora, DoorDash, Tilting Point Media, Healthline.com, Jam City, Sling TV, Disney and General Motors, and it grew out of the office's March 2025 investigative sweep of the location data industry.
According to the Attorney General, Lyft has sold or shared riders' and drivers' personal information since mid-2023 to target and display ads inside its app. That data included names, email addresses, phone numbers, IP addresses and coarse location such as city or zip code. Yet the app had no opt-out of its own; the only route ran through links in the in-app privacy policy to a web page. And although users were already signed in, that page made them enter their login details again and submit more personal information before Lyft would act on the request. Bonta called the process cumbersome and confusing, adding that "businesses cannot throw up unnecessary roadblocks."
Beyond the penalty, Lyft must add an opt-out inside the app and notify California consumers of their right to opt out of the sale of their personal information.
What Website and App Owners Should Check
Two lessons carry over. The first is placement: the opt-out has to live where people actually use your service. For a website that means the conspicuous link the regulations require on the homepage; for an app it means a control inside the app, not a web page someone reaches by reading a privacy policy. If you ship both, check both, since the AG judged Lyft by the surface its users were on.
The second is what the form asks for. Under § 7026, a request to opt out of sale or sharing isn't a verifiable consumer request, and the business can't demand an account or more information than it needs to process it. So open your own opt-out link in a private window. Does it bounce you to a sign-in screen? Ask for a date of birth, an order number, or a password? Each of those is a roadblock of the same kind the Attorney General just priced. A name and email are usually enough; anything you can already read from a session shouldn't be asked for at all.
Where Privisy Fits
Privisy scans websites, not mobile apps, so it can't tell you whether your iOS build has a toggle in its settings. On the web it covers the same ground as this case. A full audit finds your Do Not Sell or Share link, follows it to the page it opens, and reports whether that page offers a working opt-out. It now also flags an opt-out that sits behind a sign-in wall, requires a password, or asks for identity verification such as a date of birth or government ID, with the regulation it conflicts with named next to the finding.
Walk Your Opt-Out Path
Run a full audit to see where your opt-out link leads and what it asks visitors to hand over before it works.
Get Your Audit