Lyft, Inc. (NASDAQ: LYFT) is a publicly traded, Delaware-incorporated rideshare, bike, and scooter platform. Its privacy policy (last updated July 1, 2026) describes collection of precise device location from riders and drivers, including background collection during rides and, for drivers, for a period after exiting driver mode; ride and payment records are retained at least seven years. Lyft states it does not sell personal information for money, but discloses that ad-related sharing may constitute a "sale" or "sharing" under U.S. state laws; its state addendum lists identifiers, commercial information, internet activity, geolocation, and inferences as sold or shared for cross-context behavioral advertising with parties such as Google or Meta, and Lyft runs its own in-app ad business (Lyft Ads). Lyft honors Global Privacy Control signals and says it does not sell or share sensitive personal information for behavioral advertising. In October 2024 the FTC announced a proposed settlement with a $2.1 million civil penalty over deceptive driver-earnings advertising claims.
TRACK RECORD
1 ENFORCEMENT ACTION
[2024-10-25]
On October 25, 2024, the FTC announced that Lyft agreed to a DOJ-filed proposed court settlement over allegations it made deceptive claims about driver earnings, requiring a $2.1 million civil penalty and evidence-backed earnings claims; the matter concerned advertising claims to drivers, not a privacy or data-security violation.
Lyft's state-law privacy addendum discloses that sensitive personal information - including Social Security numbers, driver's license numbers, precise geolocation, and biometric information used to uniquely identify individuals - has been collected and disclosed to service providers and other recipients in the past 12 months.
Lyft's Privacy Policy (last updated July 1, 2026) states that the app collects the device's precise location from riders while the app is open and running in the background from ride request until the ride ends, and from drivers whenever the app is open, including for a limited time after exiting driver mode to detect ride incidents.
Lyft maintains a public privacy homepage that explains in plain language what personal information it collects, how it uses and shares it, and provides FAQs and self-service paths for accessing, correcting, and deleting personal information.
Lyft, Inc. is a Delaware-incorporated public company headquartered in San Francisco whose Class A common stock trades on the Nasdaq Global Select Market under the symbol LYFT, per its SEC Form 10-K annual report for fiscal year 2025, filed February 2026.
Lyft's California privacy addendum discloses that in the preceding 12 months Lyft may have sold or shared identifiers, commercial information, internet activity, geolocation information, and inferences with third parties for cross-context behavioral advertising or analytics, including advertising publishers such as Google or Meta; the same addendum states Lyft does not sell or share sensitive personal information for behavioral advertising.
Lyft's Privacy Policy (last updated July 1, 2026) states that Lyft does not sell personal information to third parties for money and does not act as a data broker, but acknowledges that sharing personal information with third parties to deliver personalized ads on and off the Lyft Platform may constitute "sharing" or the "sale" of personal information for targeted advertising under certain U.S. state privacy laws.
On October 25, 2024, the FTC announced that Lyft agreed to a DOJ-filed proposed court settlement over allegations it made deceptive claims about driver earnings, requiring a $2.1 million civil penalty and evidence-backed earnings claims; the matter concerned advertising claims to drivers, not a privacy or data-security violation.
In Item 1C (Cybersecurity) of its FY2025 Form 10-K, Lyft describes a documented security program including a CISO responsible for managing cybersecurity risk, an incident-response policy, a vulnerability management process, and regular risk assessments with monthly management reviews, overseen by the board's audit committee.
Lyft operates an advertising business, Lyft Ads, whose own marketing site sells in-app visual ads, in-app sponsored map ads, sponsored rides, car wrap and bikeshare branding, and "Targeting & Audiences" products against Lyft's rider base, described as a high-intent audience of 50 million riders taking over 2 million daily trips.
Lyft's state-law privacy addendum commits to treating browser-based opt-out preference signals such as Global Privacy Control (GPC) as valid requests to opt out of the sharing of personal information linked to that browser and any associated consumer profile.
Lyft's Privacy Policy (last updated July 1, 2026) states that Lyft collects information through cookies, tracking pixels, data analytics tools like Google Analytics, SDKs, and other third-party tracking technologies operating both on and off the Lyft Platform, including to track how users interact with advertisements.