On October 29, 2026, California Attorney General Rob Bonta announced a $1.8 million settlement with Lyft to resolve alleged violations of the CCPA and the Unfair Competition Law.

In a lot of ways, this is a continuation of Disney. With California codifying the Disney concept in the proposed OOPS regulations, these two cases together are a must read. You can read the Lyft press release here, the complaint here, and the settlement here. Below are my key observations.

1. The Opt-Out Must Match the Experience

According to the AG, Lyft sold and shared riders' and drivers' personal information for targeted advertising but did not offer an opt-out within the app. Instead, consumers had to follow links from the app's privacy policy to a webpage and log in again to opt out.

Just like Disney, the Lyft complaint has its own punchy tagline. “If Lyft and other gig-economy businesses can make their services available with just a tap in an app, they can and must allow consumers to opt-out with the same ease.”

This is an extension of the concept from Disney. In Disney, the AG's position was that if you're going to get the benefits of linking data across your advertising ecosystem, you must also apply that linking to opt-outs. Lyft takes the same idea to the user experience. If you're going to make logging in and using your service really easy, you better make opting out easy as well.

We are now seeing this concept codified in regulations. In its November 5, 2026 board materials, CalPrivacy proposed amendments to the opt-out preference signal regulations that are basically putting this concept in, with new examples drawn directly from Disney. The Draft Initial Statement of Reasons: Opt-Out Preference Signals (OOPS) specifically discusses the Disney case and its importance.

The takeaway is to build the scope and ease of your opt-out to match the scope and ease of how your advertising applies across your services. If your business is app-first, the opt-out needs to be in the app. If your advertising follows the consumer across services, the opt-out should too. And don't re-verify someone who is already logged in.

2. What to Do When the Consumer Isn't Logged In

The Lyft settlement also gives more insight on what California expects when a consumer doesn't have an account. Paragraph 25(c) of the settlement provides that when a consumer who is not logged in, or has no account, opts out (including through GPC), Lyft must tell the consumer that it may be necessary to log in, or ask for the minimal personal information necessary, to fully effectuate the opt-out. If the consumer declines, the opt-out applies to that browser, app, or device and any profile associated with it, including pseudonymous advertising profiles.

I think this insight may be helpful to a lot of companies. Companies sometimes collect data like email addresses through a newsletter signup or similar touchpoint where there's no actual account. They then sell or share that data. When a consumer sends a GPC signal, there's no way to tie that signal back to the data collected at that touchpoint.

The takeaway is that California is signaling that the business has to tell the consumer what it needs to make the opt-out complete. If your cookie banner only addresses cookie opt-out for the device, and you have data in your systems associated with the consumer, you may need to have a secondary opt-out form for that data.

3. Geolocation, but Not Precise Geolocation

This case follows GM's lead in dealing with geolocation data. According to the complaint, Lyft disclosed geolocation data, along with device identifiers and IP addresses, to third parties to target ads, which let Lyft charge more for ads on its app.

Unlike GM, which dealt with precise geolocation data, this case deals with non-precise geolocation. The complaint uses the term “coarse geolocation,” which appears to refer to what the press release describes as “non-precise geolocation, such as city, state, region, or zip code.” The complaint is careful to distinguish this type of geolocation from precise geolocation, which is a form of sensitive personal information under the CCPA.

Despite the case not involving precise geolocation data, the settlement still imposes obligations around sensitive personal information. Lyft must conduct risk assessments for processing sensitive personal information and, separately, for processing geolocation data for advertising (including manually inputted location data), and must monitor its use and disclosure of geolocation data for three years. The sensitive personal information requirement may reflect what Lyft collects to run its service. But the separate requirement to assess geolocation for advertising, even coarse geolocation, suggests the AG is looking closely at how location data feeds ad targeting.

The takeaway is to pay attention to geolocation data and advertising. It's on the AG's radar, even when the data isn't precise.

4. Drivers and Riders

Another detail I find interesting is that the case treats Lyft users as consumers in both their driver and rider capacities. The settlement expressly defines “consumer” to include Lyft drivers and riders. According to the complaint, people who use Lyft as both riders and drivers have a single account that links their passenger and driver profiles, so personal information collected about a driver during work is connected to that person's passenger profile.

I wonder whether drivers would have been treated differently had the accounts not been merged. Again, this goes to the bigger concept running through this case and Disney. When you connect systems, you also expand the scope of your opt-out obligations. Before linking accounts, profiles, or data sets, think through what that means for how far a consumer's opt-out has to reach.

5. Risk Assessments Keep Showing Up

Lyft must evaluate all new or changed features and business practices involving personal information, including through risk assessments, before launch, and complete assessments within 180 days for selling or sharing, sensitive personal information, and geolocation used for advertising.

Following PlayOn and GM, this is at least the third action to expressly reference the risk assessment requirement, which has been in effect since January 1, 2026. If your assessments are not underway, they should be. Remember that the first attestations for risk assessments are due April 1, 2028.

6. Cross-Context Behavioral Advertising Using Third-Party Data, Again

As in Disney, the settlement requires Lyft to give notice that it conducts cross-context behavioral advertising using personal information obtained from third parties, and to stop that advertising for consumers who opt out, not just stop selling and sharing. Regulators are scrutinizing both third-party data and data brokers, so both warrant a specific review.