Third-Party Advertising Data Sharing

What it is

Lyft may share your personal information with advertising companies who can use it to show you targeted ads across other websites and apps, not just within Lyft.

Why it matters (compliance & governance perspective)

This provision permits your Lyft usage data, which includes trip history and location, to be combined with data from other sources by advertising partners to build profiles used to target you with ads across the broader internet.

Consumer impact (what this means for users)

Your trip history, location data, and other personal information may be shared with advertising partners who use it for cross-site behavioral advertising, meaning your Lyft activity could influence the ads you see on unrelated websites and platforms.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: Under CPRA, sharing personal data with third parties for cross-context behavioral advertising constitutes 'sharing' subject to opt-out rights, distinct from the right to opt out of 'sale.' The FTC's guidance on surveillance-based advertising treats broad data sharing for ad targeting as a potentially unfair practice when involving sensitive data categories including location. GDPR requires a lawful basis (typically explicit consent) for processing personal data for behavioral advertising purposes when the data includes sensitive categories. GOVERNANCE EXPOSURE: Medium to High. The assertion that personal information including location and trip data may be shared with advertising partners for cross-context behavioral advertising creates clear obligations under CPRA's opt-out framework and may implicate GDPR consent requirements for EU users. Compliance depends on whether adequate opt-out mechanisms are in place and whether advertising partner data use is limited by contract. JURISDICTION FLAGS: California (CPRA opt-out right for sharing for cross-context behavioral advertising), EU/EEA (GDPR consent requirement), Virginia, Colorado, and other states with comprehensive privacy laws that include opt-out rights for targeted advertising. CONTRACT AND VENDOR IMPLICATIONS: Data sharing agreements with advertising partners should specify permissible uses, prohibit further transfer without consent, and include deletion obligations. Classification of advertising partners as processors versus independent controllers determines the scope of Lyft's obligations and liability under applicable frameworks. COMPLIANCE CONSIDERATIONS: Compliance teams should confirm that the 'Do Not Sell or Share My Personal Information' opt-out mechanism required under CPRA is implemented on Lyft's website and app, is functional, and that opt-out signals (such as the Global Privacy Control) are honored. Advertising partner agreements should be audited for consistency with stated privacy policy limitations on data use.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Precise and Background Location Data Collection high
• Biometric Data Collection high
• Government and Law Enforcement Disclosure medium
• California Consumer Privacy Rights (CCPA/CPRA) medium
• Data Retention Policy medium
• Children's Privacy low

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.