Judge finds NYC's data-sharing demand on food delivery apps unconstitutional

MANHATTAN (CN) — A federal judge on Tuesday ruled that a Covid-era New York City law, which required food delivery services to share enhanced customer data with city restaurants, is unconstitutional.

U.S. District Judge Analisa Torres, a Barack Obama appointee in the Southern District of New York, found that the law illicitly regulated commercial speech and could violate customers’ privacy.

“In sum, when the customer data law requires that delivery services send customer data to restaurants, it compels speech that falls within the First Amendment’s protection,” Torres wrote in her 31-page decision.

New York City enacted the law in 2021 as one of many measures to help city restaurants recover from the Covid-19 pandemic by better connecting them to customers. The provision required apps like DoorDash, GrubHub and Uber Eats to share diners’ full names, email addresses, phone numbers, delivery addresses and other extra data with restaurants after an order is placed.

Typically, only the diners’ first name, first initial of their surname and the order’s contents are shared.

That’s why, in 2021, the trio of food delivery services complained that the New York City law violated their First Amendment rights to commercial speech because it demanded that they share information that they wouldn’t have given up otherwise.

DoorDash, Grubhub and Uber Eats argued in court filings that the law could also raise privacy concerns since the ordinance “imposes virtually no restrictions” on what eateries can do with the data, nor does it require the restaurants to secure that information once they receive it. They noted that customers have a better reason to entrust their data to “established, respected technology companies” like themselves, as opposed to the mom-and-pop eateries that “do not have similar robust data safety and security protocols.”

The city agreed not to enforce the law while the delivery companies challenged it in court, even as its sponsors continued to tout its necessity.

“After such a devastating year for our city’s restaurant industry, this precedent-setting law gives much needed relief to eateries to have better access to customer data and provides strong privacy protections,” the law’s primary sponsor, Democratic Councilman Keith Powers, said in a statement in 2021.

But Torres ruled Tuesday that New York City lacked substantial interest in requiring the delivery apps to give that information up.

“The city may prefer that restaurants have access to customer data, but a mere preference for one industry over another is not a substantial state interest,” Torres wrote. “Even if the court were to find that the City has a substantial interest in ensuring that restaurants obtain data about customers who order food, it has not demonstrated that the customer data law is appropriately tailored to this goal.”

Torres added that the law doesn’t strike the right balance between restricting speech and the “degree of the harm” it aims to redress. She suggested less restrictive alternatives that could accomplish the city’s goal, such as requiring the delivery companies to offer an opt-in program for customers to send their data to restaurants or providing financial incentives to encourage the apps to voluntarily send that information.

“The city has not demonstrated that an incentive-based program or more fine-tuned regulation would be ineffective, and compelling delivery services to disclose customer data is incommensurate with the identified harm,” Torres wrote.

Nicholas Paolucci, a spokesperson for the city’s law department, told Courthouse News that the department is “carefully reviewing the court’s ruling."

A spokesperson for DoorDash celebrated the judge’s ruling as one that “rightly recognized how this law would have violated bedrock First Amendment rights of how we protect New Yorkers’ data.”

“We’re pleased that we can now put this matter behind us,” the spokesperson said in a statement. “We believe that a crucial part of serving our community is ensuring trust between merchants, customers and Dashers.”

A Grubhub spokesperson agreed: “We’re pleased with today’s ruling, which reinforces the privacy protections that New Yorkers deserve. Keeping customers’ personal information secure is a top priority, and this decision ensures that individuals maintain control over their data. We look forward to continuing to provide our customers with the secure, reliable experience they count on.”

Follow @Uebey Follow @uebey.bsky.social