Lyft to Pay $1.8M in California CCPA Opt-Out Settlement

Lyft to Pay $1.8M in California CCPA Opt-Out Settlement

California's attorney general announced a settlement with Lyft on October 29, 2026 resolving allegations that the rideshare company gave its users no in-app way to opt out of the sale or sharing of their personal information. The San Francisco Superior Court entered the stipulated judgment the same day.

Information last verified on November 2, 2026. This is a developing story; we update it as the record changes.

Status: Settled, and the judgment has been entered. The California Department of Justice filed its complaint in People of the State of California v. Lyft, Inc., San Francisco County Superior Court No. CGC-26-641775, on October 28, 2026. The stipulated Final Judgment and Permanent Injunction, signed by Judge Christine Van Aken, carries the Superior Court clerk's file stamp of October 29, 2026, and the word "proposed" is struck from its caption. Lyft did not admit liability and both sides waived their right to appeal.

Jurisdiction scope: This article covers California law: the California Consumer Privacy Act at Civil Code section 1798.100 and following, its implementing regulations at title 11 of the California Code of Regulations, and California's Unfair Competition Law at Business and Professions Code section 17200. It does not govern any other state. A consumer outside California has only the rights their own state's law gives them. For the standing California rule rather than this week's news, see our explainer on how the opt-out right works in practice.

What Happened

On October 28, 2026 the California Department of Justice filed a two-count complaint against Lyft, Inc. in San Francisco County Superior Court, case number CGC-26-641775, seeking an injunction and civil penalties under the CCPA and the Unfair Competition Law. One day later the court signed and filed a stipulated Final Judgment and Permanent Injunction carrying $1.8 million in civil penalties and a set of injunctive terms. Attorney General Rob Bonta announced the resolution the same day.

The complaint's theory is narrow and mechanical. Lyft offers its service only through a mobile app. Riders and drivers must download the app and create an account, and a person who is both rider and driver has one linked account. Starting in mid-2023, according to the complaint, Lyft began disclosing device identifiers, IP addresses and coarse geolocation data to third parties so it could target ads inside its own app, which the complaint says let Lyft charge more for those ads. The attorney general's announcement describes that location data as non-precise, "such as city, state, region, or zip code". Those disclosures triggered the CCPA opt-out right.

Lyft's only opt-out path, the complaint alleges, ran out of the app. According to the complaint, a consumer had to find a series of links inside the in-app privacy policy, land on a "Do Not Sell or Share My Personal Information" web page in a mobile browser, and then re-enter login credentials and verify their identity, even though they were already signed in to the app and Lyft already knew who they were.

"Under California's nation-leading privacy law, consumers have the right to say no to the sale and sharing of their data, and businesses cannot throw up unnecessary roadblocks." Source: Attorney General Rob Bonta, California Department of Justice press release, October 29, 2026

The complaint also notes a limit on the allegation that is easy to miss. As part of the sweep, the attorney general "found that while Lyft did not sell or share consumers' precise geolocation information, Lyft did sell or share customers coarse geolocation, and its apps did not contain CCPA-compliant opt-outs." The case is about the opt-out mechanism, not about precise location tracking.

Nothing in the judgment is a finding against Lyft. It was entered, in its own recital, "without the taking of proof and without trial or adjudication of any fact or law," and "without DEFENDANT admitting any liability." Lyft appeared through Alysa Z. Hutnik of Kelley Drye & Warren LLP. Both sides waived appeal, and the court retained jurisdiction to construe, modify and enforce the judgment.

What the Law Actually Says

The CCPA gives a California consumer the right "at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer's personal information" (Cal. Civ. Code § 1798.120(a)(1)). A business that sells or shares must also tell consumers that it does so and that they have the right to opt out (§ 1798.120(b)). That right sits inside a larger scheme of access, deletion and correction rights, which we set out in a plain-language guide to what the statute covers.

Section 1798.135 is where the mechanics live, and two of its commands are the ones this case turns on. Subdivision (a)(1) requires a "clear and conspicuous link" on the business's internet homepages titled "Do Not Sell or Share My Personal Information," and subdivision (a)(3) lets a business use a single combined link instead. Subdivision (c)(1) then bars a business from requiring "a consumer to create an account or provide additional information beyond what is necessary in order to direct the business not to sell or share the consumer's personal information."

The statute is written around websites. The regulations are what extend it to an app. Under title 11, section 7026(a) of the California Code of Regulations, a business must offer two or more designated methods for submitting opt-out requests, and "at least one method offered shall reflect the manner in which the business primarily interacts with the consumer." Section 7026(b) adds that the methods "shall be easy for consumers to execute, shall require minimal steps," and section 7026(d) states flatly that "a business shall not require a verifiable consumer request for a request to opt-out of sale/sharing." Section 7013 provides that clicking the opt-out link must either opt the consumer out immediately or take them to a page where they can learn about and make that choice. Once a valid request arrives, section 7026(f)(1) gives the business no more than 15 business days to stop selling or sharing.

Read together, that is the rule the attorney general applied: a company whose entire relationship with the consumer happens in an app has to put a working opt-out in the app, and cannot make the consumer re-prove who they are to use it.

Two different penalty provisions sit behind CCPA enforcement, and they are routinely confused. The attorney general sues in court under Civil Code section 1798.199.90, which authorizes an injunction plus a civil penalty of up to $2,500 per violation or $7,500 "for each intentional violation and each violation involving the personal information of minor consumers," which "shall be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General." The California Privacy Protection Agency, a separate regulator that the state now brands CalPrivacy, imposes administrative fines under section 1798.155 at the same base figures. Both sets of figures are CPI-adjusted every odd-numbered year under section 1798.199.95(d); the agency's December 17, 2024 notice set the current amounts at $2,663 and $7,988 effective January 1, 2025, and those are the per-violation numbers the Lyft complaint pleaded. Under section 1798.199.90(b), 95 percent of a penalty the attorney general recovers goes to a subfund supporting that office's enforcement of the statute and 5 percent to a grant subfund, and a CCPA penalty action by the People produces no payout to consumers in any event. Under section 1798.199.90(b)(1)(B) part of that 95 percent can instead reimburse the agency's investigative costs in a joint matter.

One widely repeated claim about this regime is simply out of date. The original 2018 CCPA gave businesses 30 days to cure a noticed violation before the attorney general could sue. No such provision appears in the statute as it now reads, and the attorney general flagged the change as it was happening: the Sephora announcement in August 2022 described the cure period as "currently allowed" and said businesses' right to avoid liability by curing violations "after they are caught is expiring," and by the February 2024 DoorDash settlement the office stated plainly that "violations cannot be cured." What survives is narrower and belongs to someone else. Section 1798.199.45(a) lets the privacy agency, in its discretion, "decide to provide a business with a time period to cure the alleged violation," and section 1798.150 keeps a 30-day cure in the private right of action for data breaches. Neither gives a business a right to cure before an attorney general suit.

The Nine CCPA Enforcement Actions So Far

The press release calls Lyft the California Department of Justice's ninth CCPA enforcement action. Each of the nine is announced on the attorney general's own site, and the list is the honest way to judge whether $1.8 million is a large number here.

Two points about that table. The General Motors figure was a joint settlement with the district attorneys of San Francisco, Los Angeles, Napa and Sonoma counties, with support from the privacy agency, so it is not a pure Department of Justice recovery. And the superlative in this field expires fast: Disney was announced in February 2026 as the "Largest CCPA Settlement in California History," and General Motors took that title three months later. Lyft at $1.8 million is the third largest of the nine, about one seventh of the General Motors number.

What Happens Next

The judgment's obligations run on its own calendar, starting from the October 29, 2026 entry date.

• On or before November 28, 2026: payment of the $1,800,000 by wire transfer to the Attorney General's Office.
• On or before December 28, 2026: the one-time notice to California consumers who used the app between January 1, 2020 and October 29, 2026 and have not opted out, including a direct link to the opt-out method.
• On or before April 27, 2027, which is 180 days after entry: completed risk assessments under title 11, section 7150 of the regulations covering three activities named in the judgment, which are sales or sharing of personal information, processing of sensitive personal information, and processing of consumer geolocation data for advertising, "including manually inputted location data."
• By April 27, 2027, and for three years after: a program to assess and monitor whether the opt-out methods actually work, whether the disclosures comply with the judgment, and whether the handling of consumer geolocation data stays compliant. Separately, for three years from entry, so through October 29, 2029, Lyft must document those results and share them with the People in an annual report. Those reports are confidential by the judgment's own terms and exempt from disclosure under the California Public Records Act.

Alongside the deadlines, the injunction imposes standing duties: honoring opt-out preference signals for logged-in consumers across all Lyft services tied to their Lyft account, treating a logged-out consumer's opt-out as covering that browser, application or device and any pseudonymous profile tied to it, giving consumers a way to confirm their request was processed, notifying downstream third parties of an opt-out and directing them to comply and pass it on, and avoiding "language and choice architecture likely to confuse or deceive" consumers into thinking some other setting, such as cookie or e-mail preferences, is the opt-out.

We also checked whether the privacy agency has brought its own case against Lyft. We found none in its announcements or newsroom, which is not the same as there being none. The agency's recent enforcement has run mostly in a different lane, against data brokers, including the pair of stipulated orders it entered on August 10, 2026. What it has published closest to this matter is adjacent rather than overlapping: on July 21, 2026 it announced that its Audits Division had opened its first sectoral privacy audit, aimed at gig economy platforms including "app-based transportation, delivery, and task services," and focused on whether those platforms honor consumers' and workers' right of access. No company is named in that announcement.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The legally interesting part of this settlement is not the dollar figure. It is that the medium-matching duty the case turns on lives in a regulation rather than in the code section the statute devotes to opt-out mechanics.

Section 1798.135(a)(1) speaks about a link on "internet homepages." A company that sells rides through an app and nothing else can satisfy that sentence literally while leaving its users no practical route to the choice the statute grants them. What closes that gap is a regulation, section 7026(a), and its medium-matching clause is the load-bearing text in this case: the obligation to put the control where the customer actually is comes from the rulebook, not the code section. The same is true of the second element, since the verifiable-request bar is likewise a regulation, section 7026(d), though the statute reaches adjacent ground at section 1798.135(c)(1). Businesses that audit their compliance against the statute alone will keep missing both.

There is also a design lesson in the complaint's description of Lyft's flow. Each individual step in it, a privacy policy link, a dedicated opt-out page, an identity check, looks defensible on its own and even cautious. Added together, on the regulations as written, friction is not a compliance cushion; requiring more steps and more information than necessary is itself the alleged violation.

Judged against the enforcement list above, $1.8 million is a mid-range number in a program whose largest recovery is seven times bigger. What the judgment adds beyond money is duration and paperwork: risk assessments under the agency's newer rules, three years of monitoring, and annual reporting into October 2029. That structure may well cost more internal attention than the penalty does.

Two limits are worth stating plainly. First, nothing here establishes that Lyft broke the law. A stipulated judgment entered without adjudication, with an express no-admission clause, resolves a dispute; it does not decide it, and it creates no precedent a later court must follow. Second, the one-time notice is the only part of this that reaches riders and drivers directly. There is no fund, no claim form and no individual remedy in the judgment, and anyone who receives a notice about it in the coming weeks should expect information about a setting, not a payment.

How This Affects You

Generally, and without regard to anyone's particular situation: if you are a California resident, the CCPA gives you the right to direct a business that sells or shares your personal information not to do so (§ 1798.120(a)(1)), and the business cannot make you create an account or hand over more information than is necessary to act on that direction (§ 1798.135(c)(1)). The regulations say the method has to match how the company normally deals with you, which for an app-based service means the control should be reachable in the app rather than only on a website (11 CCR § 7026(a)).

The right is prospective. A business must stop selling or sharing as soon as feasibly possible, and in no event later than 15 business days after a valid request (11 CCR § 7026(f)(1)); it does not undo transfers that already happened. An opt-out preference signal such as Global Privacy Control counts as a request, and consumers under 16 are covered by an opt-in rule rather than an opt-out one where the business has actual knowledge of their age (§ 1798.120(c)).

California's Department of Justice takes complaints about CCPA violations at its reporting page, and the privacy agency takes them separately. Neither the attorney general nor this article can tell you whether a particular company's opt-out satisfies the law; for a dispute about your own data, talk to a lawyer licensed in California.

This is general legal information, not legal advice. It covers California's Consumer Privacy Act and Unfair Competition Law and reflects sources verified on November 2, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• How California's opt-out of sale and sharing actually works
• A plain-language guide to what the CCPA covers
• The privacy agency's parallel data broker enforcement
• California data privacy law hub

---

Last updated: 2026-11-02. This is a developing story; details verified as of 2026-11-02.

Frequently Asked Questions

How much did Lyft pay in the California CCPA settlement?

$1,800,000 in civil penalties, payable to the California Attorney General's Office within 30 days of the October 29, 2026 entry of judgment under Civil Code section 1798.199.90. Under section 1798.199.90(b), 95 percent goes to a subfund supporting the attorney general's privacy enforcement and 5 percent to a grant subfund.

Can Lyft riders or drivers get money from this settlement?

No. The $1.8 million is a civil penalty paid to the state, and the judgment establishes no claims process, fund or individual remedy. The only consumer-facing obligation is a one-time notice about opt-out rights, due on or before December 28, 2026.

Did Lyft admit it violated the CCPA?

No. The stipulated Final Judgment and Permanent Injunction states it was entered without the taking of proof, without trial or adjudication of any fact or law, and without the defendant admitting any liability. The conduct described in the California Department of Justice's complaint remains an allegation.

What does the CCPA require an app to do about opt-outs?

Title 11, section 7026(a) of the California Code of Regulations requires at least one opt-out method that reflects how the business primarily interacts with consumers, so an app-only service needs an in-app method. Section 7026(b) requires minimal steps, and section 7026(d) bars requiring a verifiable consumer request to opt out.

Is $1.8 million the largest CCPA settlement?

No. Of the nine CCPA enforcement actions the California Department of Justice has announced, the $12.75 million General Motors settlement of May 8, 2026 is the largest and the $2.75 million Disney settlement of February 11, 2026 is second. Lyft's $1.8 million is third.

Does a business still get 30 days to cure a CCPA violation?

Not before an attorney general action. The 30-day cure period the original 2018 statute provided no longer appears in the current text, and the attorney general's February 2024 DoorDash announcement stated that violations cannot be cured. What remains is narrower: Civil Code section 1798.199.45(a) lets the California Privacy Protection Agency choose to allow time to cure, and section 1798.150 keeps a 30-day cure in the private right of action for data breaches.

Has the California Privacy Protection Agency also acted against Lyft?

We found no CPPA action against Lyft in the agency's published announcements or newsroom as of November 2, 2026, which is not a confirmation that none exists. The agency did announce on July 21, 2026 that it opened its first sectoral privacy audit of gig economy platforms, including app-based transportation services, without naming any company.

Which court entered the Lyft judgment?

The Superior Court of California, County of San Francisco, in People of the State of California v. Lyft, Inc., case number CGC-26-641775. The Final Judgment and Permanent Injunction is signed by Judge Christine Van Aken and carries the court's file stamp of October 29, 2026, one day after the complaint was filed.