The Lyft CCPA Settlement and Your Signed-In Shoppers

Lyft made riders who were already signed in sign in again before it would let them opt out of ad targeting. On October 29, California's Attorney General announced a $1.8 million settlement with Lyft over that second sign-in and the missing opt-out inside its app.

The second sign-in is worth any ecommerce team's attention. Plenty of stores know exactly who some of their shoppers are, and regulators have now said twice this year what they expect when one of those shoppers opts out.

What Lyft did

Every Lyft rider has an account and is signed in whenever they use the app. Starting in mid-2023, Lyft shared riders' device IDs and rough location with third parties to target the ads it shows inside the app, according to the AG's complaint. Under the CCPA that counts as selling and sharing, so riders have the right to opt out.

The app had no opt-out setting. A rider had to open the privacy policy, click through to a "Do Not Sell or Share" page in their phone's browser, and press the button there. Then Lyft asked them to sign in again and verify their identity. The complaint notes that Lyft already knew who they were, since they had been signed in from the start.

Under the settlement, Lyft has to add an opt-out inside the app. When a signed-in rider opts out anywhere, including through a browser privacy signal, Lyft has to apply it to everything connected to their account.

What it costs besides $1.8M

Lyft has 30 days to pay with the rest of the judgment running into 2029.

Within 60 days, Lyft has to send a one-time notice to every app user since January 1, 2020 who hasn't opted out. It explains their right to stop Lyft from selling or sharing their data and links straight to the opt-out. If your brand were in that position, it would be a required email to your entire list explaining how to turn off your ads.

Lyft then has 180 days to complete risk assessments and set up a program that checks whether its opt-outs work. It then reports the results to the AG every year for three years.

Don't count on a warning before any of this. California removed the automatic 30-day cure period for CCPA violations, so fixing things after a regulator contacts you isn't a guaranteed way out.

The AG used the same theory against Disney

In February, Disney paid $2.75 million. A subscriber's devices and streaming services all sit under one Disney account. But when a subscriber opted out, the choice often applied only to the service and device they happened to be using. Disney treated GPC signals the same way, even when the subscriber was logged in.

The regulations already point there for browser signals. The California Privacy Protection Agency's guidance on opt-out preference signals says that when a signed-in customer sends one, such as Global Privacy Control, the business has to apply it to all personal information tied to their account.

Two settlements in less than nine months on the same reasoning is enough of a pattern that we'd encourage everyone to plan for.

What we've seen on ecommerce sites

Lyft at least had an opt-out button.

Between August and October, our team looked at the privacy setups of 11 retail and ecommerce sites from the outside, the way a regulator or a plaintiff's lawyer would. Nine had a problem with the opt-out itself. Four had no online way to opt out at all: one had nothing, two told shoppers to send an email, and one linked to an ad-industry opt-out page. Three had forms that asked for more than an opt-out needs, like name, email, and phone number together. Eight showed no sign that they'd picked up a GPC signal.

So before worrying about whether your opt-out follows a customer across devices, check that it works on one.

How this applies to a store where most people browse anonymously

Most of your traffic isn't signed in, so it's fair to ask whether any of this touches you. It does wherever you know who the shopper is, and for most brands that covers more than the login page. People sign in to manage a subscription or check loyalty points. Klaviyo recognizes people who click through from an email. Checkout collects an email address on every order.

Today's rules are clearest about signed-in customers. Whether they also reach shoppers you've linked across devices without a login is unclear, and no case has tested it. That could change soon. Proposed rules the California Privacy Protection Agency's board takes up on November 5–6 include a retailer example: if a store links a shopper's laptop and phone into one profile, even without a login, a GPC signal from the laptop has to stop selling and sharing on the phone too. A store that keeps each device's data separate wouldn't have to extend it. The rules haven't been adopted yet, but they show where this is headed. Here's where we'd look first.

Start with email, because it's what ties a shopper to your ad accounts. A Conversions API setup sends hashed emails to Meta with purchase events, and your team probably uploads customer lists for retargeting or lookalikes. Neither goes through the browser, so the cookie banner never sees it. Meta has a flag built for this, Limited Data Use, and it covers Conversions API events as well as the pixel. Check whether anything in your stack sets it for customers who opted out. For customer list uploads, either take opted-out customers off the list or flag them with Limited Data Use. Meta's documentation says that flag doesn't carry over between audiences, so each list needs its own.

Next, find where the opt-out is stored. If the banner saves it in a cookie and nowhere else, a customer who opts out on a laptop is opted back in when they open your site on a phone. For signed-in customers, that's the problem Disney paid for.

Then read your opt-out form. If it asks a signed-in customer for an order number or a password, cut it. Lyft's second sign-in was part of the complaint, and CalPrivacy fined Ford $375K in March for making people confirm their email before an opt-out counted.

If you have a shopping app with ad SDKs, it needs its own opt-out setting tied to the account. A link out to the website privacy policy is what Lyft had.

A test you can run to catch any gaps

The regulations say opt-out methods should be tested to make sure they work, and that opting out can't take more steps than opting back in. You can do most of that testing yourself.

1. Open your store in Brave or the DuckDuckGo browser. Both send Global Privacy Control by default, and Firefox has it as a setting. Sign in to a test customer account, then check whether the opt-out shows on the account or only in that browser.
2. Sign in to the same account on your phone in Safari, which doesn't send the signal. See whether you're still opted out.
3. Count the taps from your "Your Privacy Choices" link to a finished opt-out, then count the taps to opt back in. The first number can't be the bigger one.
4. Place a test order as the opted-out customer. Ask whoever runs your Conversions API setup whether that purchase event went to Meta with Limited Data Use set.
5. Pull the last customer list your team uploaded to Meta or Google. Check whether people who opted out were removed first.

If you're running this before your Black Friday code freeze, our BFCM privacy checklist covers the rest of the stack.

What we built for this

TrueVault's opt-out forms have never asked shoppers to sign in or verify who they are. On Shopify, we can also match an opt-out to the logged-in customer, so it follows their account to their other devices. We can do the same on some other platforms. We honor GPC automatically and control which pixels fire after someone opts out. For audiences that sync from Klaviyo, our integration tags every customer who opts out. Add one condition to the segments you send to Meta and Google Ads, and those customers drop out of your audiences on their own, no hand-editing lists.

Want us to look at your site the way we looked at those 11? Request a site review or book a demo.

Sources

• California AG press release on Lyft, Oct 29, 2026
• Complaint, People v. Lyft, Inc.
• Proposed final judgment, People v. Lyft, Inc.
• California AG press release on Disney, Feb 11, 2026
• CPPA guidance on opt-out preference signals
• Cal. Code Regs. tit. 11, § 7004
• Global Privacy Control
• Meta: Data processing options for US users
• Klaviyo: About cookies in Klaviyo
• CPPA proposed text: Opt-out preference signals, Oct 8, 2026

TrueVault is not a law firm, and this post isn't legal advice.