By David Stauss

Key point: The settlement underscores that businesses that interact with consumers primarily through a mobile app must offer an easy-to-use, in-app opt-out mechanism that does not require unnecessary steps or information.

On October 29, 2026, the California attorney general (AG) announced a $1.8 million settlement with a rideshare company, resolving alleged California Consumer Privacy Act (CCPA) violations based on the company’s opt-out procedures within its mobile app. According to the AG’s press release, the company offered its services exclusively through an app but failed to provide consumers with a way to opt out of selling and sharing within that app, instead directing consumers to the company’s privacy policy on its webpage.

In the below, we provide an overview of the complaint and the settlement terms.

Complaint

According to the complaint, the company exclusively offers its services to consumers through the company’s mobile app. To provide its services, the company collects “significant amounts of personal information,” including names, phone numbers, device identifiers, IP addresses, and geolocation data. In 2023, the company “began disclosing some of this information, such as device identifiers, IP addresses, and coarse geolocation data, to third parties to personally target ads” to the company’s consumers. The AG alleged this disclosure triggered the CCPA’s right to opt out of selling and sharing. Further, the CCPA required the company to provide an app-based opt-out mechanism because the app was the primary means by which the business interacts with consumers.

According to the AG, the company also “placed significant roadblocks in front of consumers attempting to exercise their opt-out rights” from within the app, “by requiring consumers to complete unnecessary steps and provide redundant information.” Specifically, the app required consumers to navigate a series of links within the app’s privacy policy to access a “Do Not Sell or Share My Personal Information” webpage on a mobile browser. If a consumer opted out, the company required the consumer to resubmit their login credentials and verify their identity, even though the consumer was already logged into the app.

The complaint states two causes of action — one for violations of the CCPA and one for violations of California’s unfair competition law (UCL). With respect to the CCPA, the complaint alleges the following violations:

• Failing to provide an easy-to-use method for submitting requests to opt-out of sale/sharing reflecting the manner in which the business primarily interacts with its consumers.
• Failing to provide methods for submitting requests to opt-out of sale/sharing that are easy for consumers to execute, require minimal steps, and do not ask consumers to provide additional information beyond what is necessary to effectuate the opt-out.

With respect to violations of the UCL, the complaint states that the company engaged in “unlawful, unfair, or fraudulent acts or practices, which constitute unfair competition within the meaning of Section 17200 of the Business and Professions Code.”

Settlement

As noted, the company must pay a $1.8 million fine. In addition, the company agreed to injunctive relief terms, including:

Opt-Out Procedures

• Provide clear and conspicuous notice to consumers that the company conducts cross-context behavioral advertising using personal information obtained from third parties, inform consumers of their right to opt out of the sale or sharing of their personal information, and provide an opt-out link.
• Provide a clear and conspicuous in-app opt-out link.
• For consumers who are logged into their account and opt out, effectuate that opt-out choice across all of the company’s services that the company associates with the consumer’s account.
• For consumers who opt out but are not logged in or do not have an account, inform them that it may be necessary to log in to their account, or direct the consumer to provide the minimal amount of personal information necessary, to fully effectuate the consumer’s opt-out choice and, if they do not, effectuate the opt-out for that browser, app, or device and any consumer profile the company associates with those.

Risk Assessments

• Within 180 days, conduct and complete risk assessments for sales or sharing of personal information; processing sensitive personal information; and processing geolocation data associated with a consumer, including manually inputted location data, for advertising.

Privacy Program

• Within 180 days, and for a period of three years thereafter, implement and maintain a program to assess and monitor whether the company is effectively providing methods of opting out of selling and sharing that are consumer-friendly, easy to execute, require minimal steps, and which, as appropriate, fully implement a consumer’s opt-out choice, that the company is providing disclosures and notices that comply with the settlement, and that the company’s use and disclosure of geolocation data associated with consumers continues to be compliant with the CCPA. The company must provide an annual report documenting those findings to the AG.