Lyft and the California Consumer Privacy Act
summary
Lyft builds an event-driven, federated system on AWS for CCPA exports and erasures that goes live in early 2020 and serves a platform with ~18M riders. A central federated orchestrator uses a simple state machine and protobuf payloads to sequence per-service delete/export tasks; a data store catalog identifies targets and an analytics orchestrator proxies bulk offline jobs with checkpointing and idempotent operations. The team avoids two‑phase commits, vaults legally retained records, and reports the system works reliably in production.
AI-written summary · about
chapters (9)
- 0:00Intro
- 0:27Lyft In A Nutshell
- 2:32Export & Deletion Strategic Goals
- 5:55Shared Responsibility model
- 10:21Bake Privacy into SDLC
- 11:54Balancing Competing Needs
- 12:54Need for analytics orchestration
- 14:54Engineering lessons learned
- 16:17We built & launched it
related talks
34mHow Lyft built a streaming data platform with Flink on Kubernetes
22mCCPA: State privacy law effects on cloud development
38mHighly Scalable Consumer Applications using Cloud Native Open Source Tools
25mData collaboration with Federated Learning
26mHow to go serverless in a post-GDPR world
25mKeynote: Cloud Native Updates
47mState of CalPrivacy: Clarifying Regulation & Enforcement in 2026
19mDesigning for Civic Trust: An Infrastructure to Help Long Beach Residents Manage Their...