Lyft Privacy Policy - State Information and Rights
Last updated: December, 12, 2022
This page contains additional information relevant for specific state laws and regulations regarding data privacy, including rights that may be available to some residents of these states. The information below applies if you are a resident of the specific state, and the relevant rights will be available from the date that the state laws and regulations become effective. This is an addendum to the content provided in and forms part of Lyft's Privacy Policy.
CALIFORNIA
Categories of Personal Information Disclosed and Categories of Third Parties to Whom it was Disclosed. The categories of personal information that may have been disclosed to a third party for a business purpose, as well as the purposes for disclosing that information, are provided in section 4 of our Privacy Policy. The chart below specifies which categories of personal information were disclosed to which categories of third parties:
| Categories of Third Parties | ||||||||
|---|---|---|---|---|---|---|---|---|
| Drivers (if you are a Rider) | Riders (if you are a Driver) | Other Riders (if you take a shared ride) | People who refer you to Lyft | Third Party who requests or pays for your ride | Parties to whom you request to share or link accounts | Other parties with whom you intentionally interact (e.g., to obtain a vehicle service) | ||
| Categories of Personal Information | Information you provide as part of your Lyft account (e.g., name) | X | X | X | X | X | X | X |
| Information you provide when you communicate with other users (e.g., texts) | X | X | X | |||||
| Location information | X | X | X | X | X | X | ||
| Information about your use of Lyft | X | X | X | X | X | X | X | |
| Other information you provide to Lyft (e.g., feedback) | X | X | X | |||||
Categories of Personal Information Shared and Categories of Third Parties to Whom it was Shared. The following categories of personal information may have been shared to a third party for the purpose of cross-context behavioral advertising:
- Personal identifiers, such as name, phone number and email address;
- Internet or other electronic network activity information, such as your IP address, type of browser, version of operating system, carrier and/or manufacturer, device identifiers, device event information, make and model of device, and mobile advertising identifiers; and
- Information about you and your use of the Lyft Platform, such as your region and whether you are a rider or driver.
Each of the categories of personal information listed above may be shared with the following categories of third parties for the purpose of cross-context behavioral advertising:
- Advertising publishers that place advertisements on our behalf, such as Google or Meta;
- Advertising partners that place advertisements on the Lyft Platform on behalf of other advertisers; and
- Parties that provide statistical and analytic information regarding the effectiveness of our marketing.
Lyft is not directed to children, and we don’t knowingly collect personal information from children under the age of 16; accordingly we don’t knowingly share the personal information from children under the age of 16 for cross-context behavioral advertising nor do we sell that information. If we find out that a child under 16 has given us personal information, we will take steps to delete that information. If you believe that a child under the age of 16 has given us personal information, please contact us at our Help Center.
Sensitive Personal Information. Lyft does not use or disclose sensitive personal information other than to provide you the Lyft Platform and as permitted by California law. Lyft does not sell or share sensitive personal information for the purpose of cross-context behavioral advertising.
Deidentified Information. As mentioned in our Privacy Policy, personal information does not include information that is deidentified. When we receive or use deidentified information, we maintain it in deidentified form and do not attempt to reidentify the information.
Retention of Personal Information. We retain your information for as long as necessary to provide you and our other users the Lyft Platform. This means we keep your profile information for as long as you maintain an account. We retain transactional information such as rides and payments for at least seven years to ensure we can perform legitimate business functions, such as accounting for tax obligations. We also retain your information as necessary to comply with our legal obligations, resolve disputes and enforce our terms and policies.
Your California Rights Regarding Your Personal Information. California law provides some California residents with the rights listed below. To exercise these rights see the “Exercising Your California Privacy Rights” section below or visit our privacy homepage. For metrics regarding rights requests, see here.
Right to Know. You have the right to know and see what personal information we have collected about you, including:
- The categories of personal information we have collected about you;
- The categories of sources from which the personal information is collected;
- The business or commercial purpose for collecting or sharing your personal information;
- The categories of third parties with whom we have disclosed your personal information; and
- The specific pieces of personal information we have collected about you.
Right to Delete. You have the right to request that we delete the personal information we have collected from you (and direct our service providers to do the same).
Right to Correct. You have the right to request that we correct inaccurate personal information.
Right to Opt Out of Sharing. You have the right to opt out of the sharing of your personal information to a third party for cross-context behavioral advertising.
Other Rights. You can request certain information about our disclosure of personal information to third parties for their own direct marketing purposes during the preceding calendar year. This request is free and may be made once a year. You also have the right not to be discriminated against for exercising any of the rights listed above.
Exercising Your California Privacy Rights. To request access to or deletion of your personal information, or to exercise any other privacy rights under California law, please contact us using one of the following methods:
Website: You may visit our privacy homepage to authenticate and exercise rights via our website.
Email webform: You may write to us to exercise rights.
To opt out of the sharing of personal information for cross-context behavioral advertising, you may also visit here.
To respond to some rights we may need to verify your request either by asking you to log in and authenticate your account or otherwise verify your identity by providing information about yourself or your account. Authorized agents can make a request on your behalf if you have given them legal power of attorney or we are provided proof of signed permission, verification of your identity, and, in some cases, confirmation that you provided the agent permission to submit the request.
Response Timing and Format. We aim to respond to a consumer request in relation to these rights within 45 days of receiving that request. If we require more time, we will inform you of the reason and extension period in writing.
COLORADO
Effective July 1, 2023
Your Colorado Rights Regarding Your Personal Data. Colorado law provides some Colorado residents with the rights listed below. To exercise these rights see the “Exercising Your Colorado Privacy Rights” section below or visit our privacy homepage.
Right to Know. You have the right to know and see what personal data we have collected about you in a portable format.
Right to Correct. You have the right to request that we correct inaccurate personal data.
Right to Delete. You have the right to request that we delete the personal data we have collected about you.
Right to Opt Out. You have the right to opt out of targeted advertising and the sale of your data (as defined under Colorado law).
Exercising Your Colorado Privacy Rights. To request access to or deletion of your personal data, or to exercise any other privacy rights under Colorado law, please contact us using one of the following methods:
Website: You may visit our privacy homepage to authenticate and exercise rights via our website.
Email webform: You may write to us to exercise rights.
To opt out of targeted advertising and the sale of personal data, you may also visit here.
To appeal our decision regarding a request related to these rights, you may write to us.
To respond to some rights we may need to verify your request either by asking you to log in and authenticate your account or otherwise verify your identity by providing information about yourself or your account. Authorized agents can make a request on your behalf if you have given them legal power of attorney or we are provided proof of signed permission, verification of your identity, and, in some cases, confirmation that you provided the agent permission to submit the request.
CONNECTICUT
Effective July 1, 2023
Your Connecticut Rights Regarding Your Personal Data. Connecticut law provides some Connecticut residents with the rights listed below. To exercise these rights see the “Exercising Your Connecticut Privacy Rights” section below or visit our privacy homepage.
Right to Know. You have the right to know and see what personal data we have collected about you in a portable format.
Right to Correct. You have the right to request that we correct inaccurate personal data.
Right to Delete. You have the right to request that we delete the personal data we have collected about you.
Right to Opt Out. You have the right to opt out of targeted advertising and the sale of your data (as defined under Connecticut law).
Exercising Your Connecticut Privacy Rights. To request access to or deletion of your personal data, or to exercise any other privacy rights under Connecticut law, please contact us using one of the following methods:
Website: You may visit our privacy homepage to authenticate and exercise rights via our website.
Email webform: You may write to us to exercise rights.
To opt out of targeted advertising and the sale of personal data, you may also visit here.
To appeal our decision regarding a request related to these rights, you may write to us.
UTAH
Effective December 31, 2023Your Utah Rights Regarding Your Personal Data. Utah law provides some Utah residents with the rights listed below. To exercise these rights see the “Exercising Your Utah Privacy Rights” section below or visit our privacy homepage.
Right to Know. You have the right to know and see what personal data we have collected about you in a portable format.
Right to Delete. You have the right to request that we delete the personal data we have collected about you.
Right to Opt Out. You have the right to opt out of targeted advertising (as defined under Utah law).
Exercising Your Utah Privacy Rights. To request access to or deletion of your personal data, or to exercise any other privacy rights under Utah law, please contact us using one of the following methods:
Website: You may visit our privacy homepage to authenticate and exercise rights via our website.
Email webform: You may write to usto exercise rights.
To opt out of targeted advertising, you may also visit here.
VIRGINIA
Effective January 1, 2023
Your Virginia Rights Regarding Your Personal Data. Virginia law provides some Virginia residents with the rights listed below. To exercise these rights see the “Exercising Your Virginia Privacy Rights” section below or visit our privacy homepage.
Right to Know. You have the right to know and see what personal data we have collected about you.
Right to Correct. You have the right to request that we correct inaccurate personal data.
Right to Delete. You have the right to request that we delete the personal data we have collected about you.
Right to Opt Out. You have the right to opt out of targeted advertising and the sale of your data (as defined under Virginia law).
Exercising Your Virginia Privacy Rights. To request access to or deletion of your personal data, or to exercise any other privacy rights under Virginia law, please contact us using one of the following methods:
Website: You may visit our privacy homepage to authenticate and exercise rights via our website.
Email webform: You may write to us to exercise rights.
To opt out of targeted advertising and the sale of personal data, you may also visit here.
To appeal our decision regarding a request related to these rights, you may write to us.