Update: Editor's note:
Lyft is an independent company; Enteprise acquired its carpool
Ride-sharing company Lyft has been hit with a potential class-action privacy lawsuit for allegedly transmitting data about users to the analytics company Mixpanel.
Lyft's “decision to disclose its users’ sensitive personal information not only demonstrates a brazen disregard for their privacy rights, it also violates the California Privacy
Act,” user Miguel Garcia says in his complaint, filed on Friday in federal court in San Francisco.
California's privacy law includes a 1990 provision that prohibits ride-sharing
companies from disclosing personal information about people without their written consent. The law provides for damages of $5,000 per violation.Garcia's lawsuit names Lyft and parent company, car rental business Enterprise
Holdings, as defendants; together, they operate the ride-sharing service Zimride.
Garcia, a resident of California, alleges in his complaint that Lyft sends Mixpanel information about users' ages,
genders, Zip codes, metropolitan regions, trip details, and a link to their Facebook profiles. (Lyft requires users to sign up for Zimride via Facebook.)
Lyft also allegedly transmits an
alphanumeric identifier called a Distinct ID, which can be used to create behavioral profiles of users in order to send them targeted ads. Garcia argues that Lyft's transmissions to Mixpanel enables
the company to combine information from users' Facebook profiles with the Distinct ID. “In this way, a huge swath of data (like name, address, e-mail address, information about the
individual’s likes and dislikes) can easily be funneled into the user’s Mixpanel profile,” he alleges.
“By transmitting users’ highly sensitive personal
information -- including specific data about their upcoming carpooling/transit routes -- to Mixpanel, Zimride has engaged in a flagrant violation of its users’ privacy,” Garcia says. He
adds that the company doesn't inform users during the sign-up process that it will send details of their trips and other “sensitive personal information” to Mixpanel.
seeking class-action status on behalf of all California residents who have used Lyft. He is asking for monetary damages, as well as an injunction requiring Lyft to stop transmitting data to