Lyft Privacy Policy - Local Information and Rights
Last updated: December, 13, 2023
This page contains additional information relevant for specific local laws and regulations regarding data privacy, including rights that may be available to some people within these locations. The information below applies as set forth in each local law, and the rights will be available from the date that the relevant laws and regulations become effective. This is an addendum to the content provided in and forms part of Lyft's Privacy Policy. Lyft will not discriminate against any individual for exercising any of their applicable rights regarding data privacy.
CALIFORNIA
Categories of Personal Information Collected and Disclosed. The following chart details which categories of personal information we may have collected from and about California residents in the past 12 months and the categories of recipients to whom we have disclosed each category of information for a business or commercial purpose. The second column in the chart lists by category the type of information described in section 2 of our Privacy Policy, as required by California law. You may also find a list of the sources from which we collect personal information in section 2 of our Privacy Policy and additional details regarding our disclosures of personal information are included in section 4 of our Privacy Policy.
| Categories of Recipients | |||||
|---|---|---|---|---|---|
| Other Lyft users (Riders and Drivers)1 | Our service providers | Our advertising/marketing partners | Other third parties2 | ||
| Categories of Personal Information | Identifiers, including names, physical addresses, online identifiers, IP addresses, phone numbers, and email addresses | X | X | X | X |
| Personal information categories listed in the California Consumer Records statute | X | X | X | X | |
| Commercial information, including ride information, Driver/Rider transaction history, and other information about the use of the Lyft Platform | X | X | X | X | |
| Internet or other electronic network activity information, including browsing information and information about interactions with the Lyft Platform and advertisements | X | X | |||
| Geolocation data (non-precise), such as IP location | X | X | X | X | |
| Audio, electronic, visual, or similar information, such as photos/images and phone call recordings (where permitted by law) | X | X | X | ||
| Professional or employment-related information, such as employer names and business contact information in relation to offering or marketing Lyft Business products and services | X | X | X | ||
| Sensitive personal information, including Social Security numbers, driver’s license numbers, precise geolocation, and biometric information for the purpose of uniquely identifying you | X | X | X | ||
| Inferences, meaning inferences drawn from any of the above-listed categories of information | X | X | |||
(1) “Other Lyft users” includes, for example: Riders (if you are a Driver), Drivers (if you are a Rider), and other Riders (if you are a Rider taking a shared ride), and people who refer you to Lyft
(2) “Other third parties” includes, for example: a third party who requests or pays for your ride, parties to whom you request to share or link accounts, other parties with whom you intentionally interact (e.g., to obtain a vehicle service), and parties to whom you direct us to share information
Categories of Personal Information Sold or Shared and Categories of Third Parties to Whom it was Sold or Shared. We may have sold or shared the following categories of personal information with third parties for the purpose of cross-context behavioral advertising or analytics in the preceding 12 months:
- Identifiers,
- Commercial information,
- Inferences, and
- Internet or other electronic network activity information.
We may have sold or shared each of the categories of personal information listed above with the following categories of third parties for the purpose of cross-context behavioral advertising or analytics:
- Advertising publishers that place advertisements on our behalf, such as Google or Meta;
- Advertising partners that place advertisements on the Lyft Platform on behalf of other advertisers; and
- Parties that provide statistical and analytic information regarding the effectiveness of our marketing and advertising.
Lyft is not directed to children, and we don’t knowingly collect personal information from children under the age of 16; accordingly we don’t knowingly share personal information of children under the age of 16 for cross-context behavioral advertising nor do we sell that information. If we find out that a child under 16 has given us personal information, we will take steps to delete that information. If you believe that a child under the age of 16 has given us personal information, please contact us at our Help Center.
Sensitive Personal Information. Lyft does not use or disclose sensitive personal information other than to provide you the Lyft Platform and as permitted by California law. Lyft does not sell or share sensitive personal information for the purpose of cross-context behavioral advertising.
Deidentified Information. As mentioned in our Privacy Policy, personal information does not include information that is deidentified. When we receive or use deidentified information, we maintain it in deidentified form and do not attempt to reidentify the information.
Retention of Personal Information. We retain your information for as long as necessary to provide you and our other users the Lyft Platform. This means we keep your profile information for as long as you maintain an account. We retain transactional information such as rides and payments for at least seven years to ensure we can perform legitimate business functions, such as accounting for tax obligations. We also retain your information as necessary to comply with our legal obligations, resolve disputes and enforce our terms and policies.
Your California Rights Regarding Your Personal Information. California law provides California residents with certain rights, including those listed below. To exercise these rights see the “Exercising Your California Privacy Rights” section below or visit our privacy homepage. For metrics regarding rights requests, see here.
Right to Know. You have the right to know what personal information we have collected about you, including:
- The categories of personal information we have collected about you,
- The categories of sources from which the personal information is collected,
- The business or commercial purpose for collecting or sharing your personal information,
- The categories of third parties to whom we have disclosed your personal information, and
- The specific pieces of personal information we have collected about you.
Right to Delete. You have the right to request that we delete the personal information we have collected from you (and direct our service providers to do the same).
Right to Correct. You have the right to request that we correct inaccurate personal information.
Right to Opt Out of Sharing. You have the right to opt out of the sharing of your personal information with a third party for cross-context behavioral advertising.
Other Rights. You can request certain information about our disclosure of personal information to third parties for their own direct marketing purposes during the preceding calendar year. This request is free and may be made once a year.
Exercising Your California Privacy Rights. To request access to or deletion of your personal information, or to exercise any other privacy rights listed above, please contact us using one of the following methods:
Website: You may visit our privacy homepage to authenticate your account (where necessary) and exercise rights via our website.
Email webform: You may write to us to exercise rights.
To opt out of the sharing of personal information for cross-context behavioral advertising, you may also visit here. Alternatively, where available you can use certain preference signals to exercise your opt-out right automatically with all businesses that you interact with online, including Lyft. If you enable a browser-based opt-out preference signal that complies with California law, such as the Global Privacy Control (GPC), upon receipt or detection, we will treat the signal as a valid request to opt out of the sharing of personal information linked to that browser and any consumer profile we have associated with that browser. Please note that if you use different browsers or browser profiles, you will have to enable the signal on each one that you use.
To respond to some requests, we may need to verify your request either by asking you to log in and authenticate your account or otherwise verify your identity by providing information about yourself or your account. Authorized agents can make a request on your behalf if you have given them legal power of attorney or we are provided proof of signed permission, verification of your identity, and, in some cases, confirmation that you provided the agent permission to submit the request.
- With respect to a request to know, request to delete, or request to correct, we will process a request from an authorized agent submitted on your behalf if you have given them legal power of attorney or we are provided proof of signed permission, verification of your identity, and, in some cases, confirmation that you provided the agent permission to submit the request.
- With respect to a sharing or selling opt out request, we may request confirmation that you provided the agent permission to submit the request before processing it.
CANADA
Your Canada Rights Regarding Your Personal Information. Federal and provincial Canadian laws provide individuals with some or all of the rights listed below. To exercise these rights see the “Exercising Your Canada Privacy Rights” section below or visit our privacy homepage.
Right to Know. You have the right to know we have processed your personal information and to request access to the personal information we have collected about you.
Right to Correct. You have the right to request that we correct inaccurate personal information.
Right to Delete. In some circumstances, you have the right to request that we delete the personal information we have collected about you.
Right to Opt Out. Depending on the location from which you are using our services, you have the right to opt in or out of targeted advertising (as defined under applicable law) and the use of cookies and similar technologies for non-essential purposes like targeted advertising.
Withdraw Consent. You have the right to withdraw your consent to our collection, use or disclosure of your personal information at any time, subject to contractual and legal restrictions and reasonable notice.
Exercising Your Canada Privacy Rights. Lyft has designated a Data Privacy Officer (DPO) who is accountable for ensuring Lyft’s compliance with its Privacy Policy and applicable laws. The Lyft DPO may delegate their obligations to others from time to time. To contact the Lyft DPO, request access to or deletion of your personal information, or to exercise any other privacy rights under Canada law, please contact us using one of the following methods:
Website: You may visit our privacy homepage to authenticate and exercise rights via our website.
Email webform: You may write to us to exercise rights.
To opt out of targeted advertising or cookies you may also visit here.
To appeal our decision regarding a request related to these rights, you may write to us.
Authorized agents can make a request on your behalf if you have given them legal power of attorney or we are provided proof of signed permission, verification of your identity, and, in some cases, confirmation that you provided the agent permission to submit the request.
Transfer of Data: In providing you with the Lyft services, Lyft or its service providers may process, store or communicate your personal data outside of your province of residence or outside of Canada.
Children: Lyft is not directed to children, and we don’t knowingly collect personal information from children under the age of 16. If we find out that a child under 16 has given us personal information, we will take steps to delete that information. If you believe that a child under the age of 16 has given us personal information, please contact us at our Help Center.
Vos droits à l’égard de vos renseignements personnels au Canada. Les lois provinciales et fédérales canadiennes confèrent aux particuliers une partie ou la totalité des droits énumérés ci-après. Pour exercer ces droits, veuillez consulter la section « Exercice de vos droits à la protection des renseignements personnels au Canada » ci-après ou visiter notre page d’accueil sur le respect de la vie privée.
Droit de savoir. Vous avez le droit de savoir que nous avons traité vos renseignements personnels et de demander l’accès aux renseignements personnels que nous avons recueillis à votre sujet.
Droit de corriger. Vous avez le droit de nous demander de corriger des renseignements personnels inexacts.
Droit de supprimer. Dans certaines circonstances, vous avez le droit de nous demander de supprimer les renseignements personnels que nous avons recueillis à votre sujet.
Droit de refus. Selon l’endroit à partir duquel vous utilisez nos services, vous avez le droit d’accepter ou de refuser la publicité ciblée (au sens des lois applicables) et l’utilisation de témoins et de technologies similaires à des fins non essentielles comme la publicité ciblée.
Révocation du consentement. Vous avez le droit de révoquer votre consentement à la collecte, à l’utilisation ou à la communication de vos renseignements personnels à tout moment, sous réserve de restrictions contractuelles et légales et d’un préavis raisonnable.
Exercice de vos droits à la protection des renseignements personnels au Canada. Lyft a désigné un responsable de la protection des renseignements personnels (un « RPRP ») chargé de s’assurer que Lyft respecte sa Politique de protection des renseignements personnels et les lois applicables. Le RPRP de Lyft peut déléguer ses obligations à d’autres à l’occasion. Pour communiquer avec le RPRP de Lyft, demander l’accès à vos renseignements personnels ou leur suppression, ou exercer tout autre droit à la protection de renseignements personnels en vertu des lois du Canada, veuillez communiquer avec nous de l’une des façons suivantes:
Site Web: Vous pouvez visiter notre page d’accueil sur le respect de la vie privée pour vous authentifier et exercer vos droits par l’intermédiaire de notre site Web.
Formulaire Web par courriel: Vous pouvez nous écrire pour exercer vos droits.
Pour refuser la publicité ciblée ou désactiver les témoins, vous pouvez également cliquer ici.
Pour en appeler de notre décision concernant une demande relative à ces droits, vous pouvez nous écrire.
Les mandataires autorisés peuvent présenter une demande en votre nom si vous leur avez donné une procuration légale ou que nous avons reçu une preuve d’autorisation signée, une vérification de votre identité et, dans certains cas, une confirmation que vous avez donné aux mandataires l’autorisation de présenter la demande.
Transfert de données : En vous fournissant les services Lyft, Lyft ou ses fournisseurs de services peuvent traiter, stocker ou communiquer vos données personnelles à l’extérieur de votre province de résidence ou du Canada.
Enfants : Lyft ne s’adresse pas aux enfants, et elle ne recueille pas sciemment de renseignements personnels auprès d’enfants de moins de 16 ans. Si nous découvrons qu’un enfant de moins de 16 ans nous a transmis des renseignements personnels, nous prendrons des mesures pour supprimer ces renseignements. Si vous croyez qu’un enfant de moins de 16 ans nous a transmis des renseignements personnels, veuillez communiquer avec nous à notre Centre d’aide.
COLORADO
Your Colorado Rights Regarding Your Personal Data. Colorado law provides Colorado residents with certain rights, including those listed below. To exercise the rights listed below see the “Exercising Your Colorado Privacy Rights” section below or visit our privacy homepage.
Rights to Access and Data Portability. You have the right to request details regarding our processing and access to your personal data and to obtain your personal data in a portable format.
Right to Correct. You have the right to request that we correct inaccurate personal data.
Right to Delete. You have the right to request that we delete the personal data we have collected about you.
Right to Opt Out. You have the right to opt out of targeted advertising and the sale of your data (as defined under Colorado law).
Exercising Your Colorado Privacy Rights. To request access to or deletion of your personal data, or to exercise any other privacy right listed above, please contact us using one of the following methods:
Website: You may visit our privacy homepage to authenticate your account and exercise rights via our website.
Email webform: You may write to us to exercise rights.
To opt out of targeted advertising and the sale of personal data, you may also visit here.
To appeal our decision regarding a request related to these rights, you may write to us.
To respond to some rights requests, we may need to verify your request either by asking you to log in and authenticate your account or otherwise verify your identity by providing information about yourself or your account. Authorized agents can make a request on your behalf if you have given them legal power of attorney or we are provided proof of signed permission, verification of your identity, and, in some cases, confirmation that you provided the agent permission to submit the request. Alternatively, where available you can use certain preference signals to exercise your opt-out right automatically with all businesses that you interact with online, including Lyft. If you enable a browser-based opt-out preference signal that complies with Colorado law, such as the Global Privacy Control (GPC), upon receipt or detection, we will treat the signal as a valid request to opt out of the sharing of personal information linked to that browser and any consumer profile we have associated with that browser. Please note that if you use different browsers or browser profiles, you will have to enable the signal on each one that you use.
CONNECTICUT
Your Connecticut Rights Regarding Your Personal Data. Connecticut law provides Connecticut residents with certain rights, including those listed below. To exercise the rights listed below see the “Exercising Your Connecticut Privacy Rights” section below or visit our privacy homepage.
Rights to Access and Data Portability You have the right to request details regarding our processing and access to your personal data and to obtain your personal data in a portable format.
Right to Correct. You have the right to request that we correct inaccurate personal data.
Right to Delete. You have the right to request that we delete the personal data we have collected about you.
Right to Opt Out. You have the right to opt out of targeted advertising and the sale of your data (as defined under Connecticut law).
Exercising Your Connecticut Privacy Rights. To request access to or deletion of your personal data, or to exercise any other privacy right listed above, please contact us using one of the following methods:
Website: You may visit our privacy homepage to authenticate your account and exercise rights via our website.
Email webform: You may write to us to exercise rights.
To opt out of targeted advertising and the sale of personal data, you may also visit here.
To appeal our decision regarding a request related to these rights, you may write to us.
MONTANA
Effective October 1, 2024Your Montana Rights Regarding Your Personal Data. Montana law provides some Montana residents with certain rights, including those listed below. To exercise the rights listed below see the “Exercising Your Montana Privacy Rights” section below or visit our privacy homepage.
Rights to Access and Data Portability. You have the right to request details regarding our processing and access to your personal data and to obtain your personal data in a portable, and to the extent technically feasible, readily usable format.
Right to Correct. You have the right to request that we correct inaccurate personal data.
Right to Delete. You have the right to request that we delete the personal data we have collected about you.
Right to Opt Out. You have the right to opt out of targeted advertising and the sale of your data (as defined under Montana law).
Exercising Your Montana Privacy Rights. To request access to or deletion of your personal data, or to exercise any other privacy right listed above, please contact us using one of the following methods:
Website: You may visit our privacy homepage to authenticate your account and exercise rights via our website.
Email webform: You may write to us to exercise rights.
To opt out of targeted advertising and the sale of your data, you may also visit here. Alternatively, where available you can use certain preference signals to exercise your opt-out right automatically with all businesses that you interact with online, including Lyft. If you enable a browser-based opt-out preference signal that complies with Montana law, such as the Global Privacy Control (GPC), upon receipt or detection, we will by January 1, 2025 or before treat the signal as a valid request to opt out of the sharing of personal information linked to that browser and any consumer profile we have associated with that browser. Please note that if you use different browsers or browser profiles, you will have to enable the signal on each one that you use.
To appeal our decision regarding a request related to these rights, you may write to us.
As applicable, authorized agents can make certain requests on your behalf if you have given them legal power of attorney or we are provided proof of signed permission, verification of your identity, and, in some cases, confirmation that you provided the agent permission to submit the request.
OREGON
Effective July 1, 2024Your Oregon Rights Regarding Your Personal Data. Oregon law provides Oregon residents with certain rights, including those listed below. To exercise the rights listed below see the “Exercising Your Oregon Privacy Rights” section below or visit our privacy homepage.
Right to Access and Data Portability. You have the right to request details regarding our processing and access to your personal data and to obtain your personal data in a portable and, to the extent technically feasible, readily usable format.
Right to Correct. You have the right to request that we correct inaccurate personal data.
Right to Delete. You have the right to request that we delete the personal data we have collected about you.
Right to Opt Out. You have the right to opt out of targeted advertising and the sale of your data (as defined under Oregon law).
Exercising Your Oregon Privacy Rights. To request access to or deletion of your personal data, or to exercise any other privacy right listed above under Oregon law, please contact us using one of the following methods:
Website: You may visit our privacy homepage to authenticate your account and exercise rights via our website.
Email webform: You may write to us to exercise rights.
To opt out of targeted advertising and the sale of your data, you may also visit here. Alternatively, where available you can use certain preference signals to exercise your opt-out right automatically with all businesses that you interact with online, including Lyft. If you enable a browser-based opt-out preference signal that complies with Oregon law, such as the Global Privacy Control (GPC), upon receipt or detection, we will by January 1, 2026 or before treat the signal as a valid request to opt out of the sharing of personal information linked to that browser and any consumer profile we have associated with that browser. Please note that if you use different browsers or browser profiles, you will have to enable the signal on each one that you use.
To appeal our decision regarding a request related to these rights, you may write to us.
As applicable, authorized agents can make certain requests on your behalf if you have given them legal power of attorney or we are provided proof of signed permission, verification of your identity, and, in some cases, confirmation that you provided the agent permission to submit the request.
TEXAS
Effective July 1, 2024Your Texas Rights Regarding Your Personal Data. Texas law provides Texas residents with certain rights, including those listed below. To exercise the rights listed below see the “Exercising Your Texas Privacy Rights” section below or visit our privacy homepage.
Rights to Access and Data Portability. You have the right to request details regarding our processing and access to your personal data and to obtain your personal data in a portable and, to the extent technically feasible, readily usable format.
Right to Correct. You have the right to request that we correct inaccurate personal data.
Right to Delete. You have the right to request that we delete the personal data we have collected about you.
Right to Opt Out. You have the right to opt out of targeted advertising and the sale of your data (as defined under Texas law).
Exercising Your Texas Privacy Rights. To request access to or deletion of your personal data, or to exercise any other privacy right listed above, please contact us using one of the following methods:
Website: You may visit our privacy homepage to authenticate your account and exercise rights via our website.
Email webform: You may write to us to exercise rights.
To opt out of targeted advertising and the sale of your data, you may also visit here. Alternatively, where available you can use certain preference signals to exercise your opt-out right automatically with all businesses that you interact with online, including Lyft. If you enable a browser-based opt-out preference signal that complies with Texas law, such as the Global Privacy Control (GPC), upon receipt or detection, we will by January 1, 2025 or before treat the signal as a valid request to opt out of the sharing of personal information linked to that browser and any consumer profile we have associated with that browser. Please note that if you use different browsers or browser profiles, you will have to enable the signal on each one that you use.
To appeal our decision regarding a request related to these rights, you may write to us.
As applicable, authorized agents can make certain requests on your behalf if you have given them legal power of attorney or we are provided proof of signed permission, verification of your identity, and, in some cases, confirmation that you provided the agent permission to submit the request.
UTAH
Effective December 31, 2023Your Utah Rights Regarding Your Personal Data. Utah law provides Utah residents with certain rights, including those listed below. To exercise the rights listed below see the “Exercising Your Utah Privacy Rights” section below or visit our privacy homepage.
Rights to Access and Data Portability. You have the right to request details regarding our processing and access to your personal data and to obtain your personal data in a portable format.
Right to Delete. You have the right to request that we delete the personal data we have collected about you.
Right to Opt Out. You have the right to opt out of targeted advertising (as defined under Utah law).
Exercising Your Utah Privacy Rights. To request access to or deletion of your personal data, or to exercise any other privacy right listed above, please contact us using one of the following methods:
Website: You may visit our privacy homepage to authenticate your account and exercise rights via our website.
Email webform: You may write to us to exercise rights.
To opt out of targeted advertising, you may also visit here.
VIRGINIA
Your Virginia Rights Regarding Your Personal Data. Virginia law provides Virginia residents with certain rights, including those listed below. To exercise the rights listed below see the “Exercising Your Virginia Privacy Rights” section below or visit our privacy homepage.
Rights to Access and Data Portability. You have the right to request details regarding our processing and access to your personal data and to obtain your personal data in a portable format.
Right to Correct. You have the right to request that we correct inaccurate personal data.
Right to Delete. You have the right to request that we delete the personal data we have collected about you.
Right to Opt Out. You have the right to opt out of targeted advertising and the sale of your data (as defined under Virginia law).
Exercising Your Virginia Privacy Rights. To request access to or deletion of your personal data, or to exercise any other privacy right listed above, please contact us using one of the following methods:
Website: You may visit our privacy homepage to authenticate your account and exercise rights via our website.
Email webform: You may write to us to exercise rights.
To opt out of targeted advertising and the sale of personal data, you may also visit here.
To appeal our decision regarding a request related to these rights, you may write to us.