Appeals Court Strikes Down New York City’s Food Delivery Customer Data Law

A New York City law designed to help restaurants compete with powerful delivery apps has been struck down after a federal appeals court found that it violated the First Amendment.

The law required DoorDash, Grubhub and Uber Eats to give restaurants detailed information about customers who placed orders. That information included full names, phone numbers, email addresses, delivery addresses and the contents of each order.

In a unanimous 3-0 decision, the 2nd U.S. Circuit Court of Appeals ruled that the city could not force the platforms to disclose personal information belonging to their customers. The decision upheld a lower court ruling from September 2024 that permanently blocked the law.

The law began as pandemic-era restaurant support.

New York City adopted the Customer Data Law in the summer of 2021, when restaurants were struggling to recover from COVID-19 restrictions.

Court records showed that the city had more than 23,600 restaurants in 2019. Those businesses supported about 317,800 jobs, making the restaurant industry a major part of New York’s economy and culture.

During the pandemic, restaurants became heavily dependent on delivery apps as dining rooms closed or operated at limited capacity. That reliance gave platforms such as DoorDash, Grubhub and Uber Eats greater control over customer relationships.

Restaurants prepared the meals, but the delivery companies generally kept most of the customer information. A restaurant would usually receive only the diner’s first name, the first initial of the last name and details about the order.

City officials argued that this arrangement gave delivery platforms an unfair advantage. The apps could use customer information for advertising and future promotions, while restaurants had little ability to contact the same diners directly.

The city believed giving restaurants access to customer data would help them build independent relationships with diners. Restaurants could then promote special offers or encourage customers to order directly, avoiding the commissions charged by delivery platforms.

Customers had to opt out of sharing with every order.

Under the law, delivery apps had to share personal customer information whenever a restaurant requested it. Customers could stop the disclosure, but they had to opt out during the ordering process.

The rule required apps to display a notice explaining what information would be shared. A customer who did not want the restaurant to receive the data had to reject the sharing request before completing the order.

The appeals court found that this system presumed customers had agreed to share their information. It also forced them to repeat the refusal every time they placed a new order.

Circuit Judge Richard Wesley said the city failed to explain why customers should have to make the same privacy choice again and again. The court noted that a less intrusive system could allow customers to opt in if they wanted restaurants to receive their information.

That distinction became central to the ruling. An opt-out system shares information unless the customer actively objects. An opt-in system keeps information private unless the customer clearly agrees to release it.

The judges concluded that New York chose a broader system than necessary.

Delivery apps framed the dispute as a privacy fight.

DoorDash, Grubhub and Uber Eats sued the city after the law passed. They argued that forcing them to disclose customer information violated their First Amendment rights by compelling them to communicate information they would otherwise keep private.

The platforms also raised concerns about privacy and data security. They warned that thousands of restaurants would receive sensitive information without necessarily having the same security systems used by large technology companies.

A customer’s delivery address can reveal where that person lives or works. Combined with a phone number, email address and order history, the information could become valuable to marketers, scammers or criminals if mishandled.

The companies argued that restaurants could use the data to take customers away from their platforms. Once a restaurant obtained a diner’s contact details, it could advertise directly and encourage future orders outside the app.

That concern highlighted the business battle beneath the privacy arguments. Customer data has become one of the most valuable assets in the delivery industry because it allows companies to study habits, personalize promotions and encourage repeat purchases.

The First Amendment protected more than words.

New York City argued that the law only required delivery platforms to disclose information related to the service they provided. The city wanted the court to apply a more relaxed legal standard commonly used for basic commercial disclosures.

The appeals court rejected that argument. It found that the law did not simply require the apps to explain prices, fees, or terms of service.

Instead, it forced them to disclose facts about third parties. The information belonged to customers using the marketplace, not to the marketplace itself.

Because the law compelled the platforms to transmit customer information, the court treated the requirement as a form of regulated speech. It then considered whether the policy directly advanced a substantial government interest without placing a greater burden on speech than necessary.

The judges agreed that restaurants play a vital role in New York City. However, they decided that the law went too far in trying to help those businesses.

The court pointed to less burdensome alternatives. The city could have used an opt-in system, created incentives for voluntary data sharing, or supported independent online ordering systems for restaurants.

The ruling leaves restaurants dependent on the apps.

New York City had already agreed not to enforce the law while the case moved through court. The ruling means the blocked data-sharing requirement cannot take effect unless a higher court reverses the decision or the city creates a narrower policy.

The result protects customers from automatic disclosure of their personal details. It also allows delivery companies to maintain control over the valuable information collected through their apps.

For restaurants, that control remains difficult to maintain when working with delivery platforms. The apps provide access to large numbers of customers, but they also stand between diners and the businesses preparing their meals.

The decision shows how quickly a policy intended to support small businesses can collide with modern privacy and free-speech protections. New York may still help restaurants build direct customer relationships, but it cannot begin by assuming that every diner has agreed to surrender personal information.