Lyft agreed to a $1.8 million California settlement over allegations that its app created unlawful barriers to privacy choices. The company had sold or shared personal information for targeted advertising without offering an in-app opt-out. Users instead had to follow links to a webpage and re-enter information. The settlement requires an in-app option and consumer notification.
Why It Matters
The case turns interface design into a direct compliance issue. Companies cannot assume that a right is accessible merely because it appears somewhere in a privacy policy or website. For leaders: product teams and privacy teams need shared ownership of how consumer rights work in practice. For defenders: include mobile workflows and identity steps when testing privacy controls. Unnecessary friction can become regulatory exposure even when an opt-out technically exists. The larger lesson is that privacy compliance must be usable in the channel where data is collected.
What Defenders Should Do
Test every privacy-rights workflow inside the product and remove unnecessary redirects, logins, and repeated data entry.