Lyft Privacy Policy

This is Lyft's Privacy Policy, which explains what personal information Lyft collects when you use its rideshare, bike, and scooter services — including your precise GPS location at all times, payment details, phone contacts if you grant access, and records of every trip you take. The most important thing to know is that Lyft shares your precise location data and personal information with third-party advertisers, analytics companies, and potentially government agencies without always requiring a warrant. You can request deletion of your personal data or opt out of the sale of your information by contacting Lyft through their privacy request form at https://privacy.lyft.com.

This document is Lyft's Privacy Policy, governing the collection, use, storage, and sharing of personal data from riders, drivers, and other users of Lyft's ridesharing, bikeshare, and scooter platforms, with legal basis rooted in consent, contractual necessity, and legitimate interests under applicable law. The policy creates obligations for Lyft to provide data access, correction, deletion, and portability rights to users, while obligating users to consent to broad data collection including precise geolocation, device identifiers, trip history, biometric-adjacent data, and communications. Notably, Lyft discloses sharing personal data — including precise location and ride data — with a wide range of third parties including advertisers, analytics providers, and government authorities, which represents a broader-than-typical data sharing scope for a transportation platform. The policy engages CCPA/CPRA (California Civil Code §1798.100 et seq.), GDPR principles for any EU-resident users, COPPA for users under 13, and FTC Act Section 5 unfair and deceptive practices standards; material compliance considerations include the adequacy of consent mechanisms for sensitive location data, the scope of law enforcement disclosures, and the cross-context behavioral advertising opt-out obligations under CPRA. Compliance teams should note the policy's explicit reference to sharing data with the Independent Drivers Guild and the use of oneTrust for consent management, both of which trigger third-party vendor risk assessment obligations.