# Who Owns Customer Data on DoorDash, Uber Eats and Grubhub? > On DoorDash, Uber Eats and Grubhub marketplace orders, the platform controls customer data. Restaurants usually hold fuller records only on channels they run. Published: 2026-11-04 Source: https://blog.cirqqles.com/who-owns-customer-data-on-doordash-uber-eats-and-grubhub-s0myum --- On a marketplace order, the delivery platform controls the customer data, not the restaurant: [a federal appeals court, the Second Circuit, wrote on August 5, 2026](https://ww3.ca2.uscourts.gov/decisions/OPN/25-81_complete_opn.pdf) that contracts between the apps and restaurants "typically leave control of customer data with the Platforms" and that DoorDash's standard agreement says the data "belongs to DoorDash," while [Grubhub's merchant terms](https://get.grubhub.com/legal/restaurant-terms/) call it the "sole and exclusive property" of Grubhub. The restaurant generally receives only a first name, last initial and order contents, and it usually holds fuller records only when the order comes through a channel it runs itself, such as ordering on its own website. Ownership is only part of the question. Three practical questions matter as much: who holds the record, what your contract lets you do with what you see, and whether the guest agreed to hear from you. This article covers published terms as read on November 3, 2026. It is not legal advice, and your signed agreement may differ. ## What does a restaurant actually receive from a marketplace order? [The Second Circuit's opinion](https://ww3.ca2.uscourts.gov/decisions/OPN/25-81_complete_opn.pdf) in _DoorDash, Inc. v. City of New York_ lays out the flow. The customer usually gives the platform a full name, phone number, email address and delivery address. The restaurant generally gets the first name, last initial and order contents. When a DoorDash Marketplace order is complete, DoorDash retains a digital record of those details and the order. The platforms use that data in several ways, including marketing services for restaurants. The court's example, from the platforms' brief, is that DoorDash can "identify customers who regularly order pizza" and show them ads, deals and promotions for new pizza restaurants. The New York State Restaurant Association, a supporter of New York City's data law, said the platforms kept restaurants "at arm's length from their customers, even repeat customers, even their regulars." Those are an advocate's words, but the mechanism is simple: a regular who orders every Friday through an app may be someone you have no way to contact. ## What do the contracts say, platform by platform? **DoorDash.** The "belongs to DoorDash" wording comes from the agreement in the court record. DoorDash's [published US Terms of Service](https://help.doordash.com/en-us/legal/article/mx-terms-of-service), last updated April 27, 2026, define DoorDash Data as any information DoorDash provides or makes accessible to the merchant, including personal information about DoorDash customers. Section 11.1 says the merchant may not use or keep that data "except as required to perform under this Agreement" and the product addendum, may not "sell" or "share" it, and may not combine it with any other data. **Uber Eats.** Section 13.c of the [US merchant terms](https://www.uber.com/us/en/legal/uber-eats-merchant-terms-and-conditions/), last modified June 2, 2026, says the merchant will not merge data obtained under the agreement with other data, or use it for "re-identification, targeted marketing, or any other similar purpose." The section restricts use rather than naming an owner, and it leaves out information the merchant obtained directly from the person under its own privacy policy. [The court also noted](https://ww3.ca2.uscourts.gov/decisions/OPN/25-81_complete_opn.pdf) that, under certain data-sharing agreements, Uber Eats discloses customer data to restaurants "if, and only if, customers affirmatively opt in." The opinion does not say which restaurants qualify. **Grubhub.** Its [Merchant Terms](https://get.grubhub.com/legal/restaurant-terms/), effective December 17, 2024, state ownership outright. They define Customer Data to include customer names, delivery addresses, email addresses and phone numbers, and say all of it "is the sole and exclusive property of GH," meaning Grubhub, or a Grubhub partner where applicable. The merchant may use it only to fill orders or meet its obligations under the agreement, and may not use it "for the purpose of re-identification, targeted marketing, or other similar purposes." If a merchant does not comply, Grubhub may remove locations without prior notice or end the agreement on three days' notice. The court record adds that Grubhub allows more extensive use only in "very few" circumstances involving "extremely valuable partnerships." **Self-delivery does not change the answer.** Running your own drivers on an app order puts more details in front of your staff, but it does not make them yours to keep. Uber Eats' terms limit that delivery information, which can include a name and contact details, to "fulfilling delivery services for that Customer's particular order," and bar keeping it longer than that takes. DoorDash's Section 11.1 lets a merchant retain its data only as long as necessary to perform the agreement, unless the law requires otherwise. Grubhub's definition reaches information "generated or collected by GH or Merchant" through its systems. ## Can a law force the apps to hand the data over? New York City tried. Its Customer Data Law, N.Y.C. Administrative Code § 20-563.7, enacted in 2021, required platforms to give a restaurant, on request and at least monthly, each customer's full name, phone number, email address, delivery address and order contents. Customers were presumed to consent unless they opted out, order by order. On August 5, 2026, [the Second Circuit affirmed the lower court](https://ww3.ca2.uscourts.gov/decisions/OPN/25-81_complete_opn.pdf) and held that the law violates the First Amendment as applied to the platforms' Marketplace products. The panel said the design produced "a marketing list that no customer asked to join," and it named an opt-in as an alternative the city could have required. The panel did not decide whether a law with a one-time, lasting opt-out would pass. A search on November 3, 2026 turned up no later ruling, though it could not rule out a pending request for further review. For an owner, the practical reading is to avoid building a plan around a law delivering this data, and to ask a lawyer about the rules in your own state or city. ## Where does customer data stay with the restaurant? The data tends to follow whoever takes the order. [The opinion](https://ww3.ca2.uscourts.gov/decisions/OPN/25-81_complete_opn.pdf) notes that the platforms also offer products that "do place customer data in the hands of restaurants." With DoorDash Drive, the restaurant takes the order and a DoorDash courier delivers it. With Storefront, DoorDash helps the restaurant build ordering on its own website, and "the information a customer enters in placing a Storefront order stays with the restaurant." Channel Who takes the order What the restaurant gets DoorDash, Uber Eats or Grubhub marketplace The platform Generally first name, last initial and order contents Self-delivery on an Uber Eats order The platform Delivery details, for that order only Uber Eats under certain data-sharing agreements The platform Data of customers who affirmatively opt in DoorDash Storefront The restaurant's website, using DoorDash's product The information the customer enters when placing the order Grubhub Direct The restaurant's branded ordering site Customer data profiles, including contact info and order history Counter, dining room or your own sign-up form The restaurant What the guest chooses to give you These products come with their own conditions, so read each product's contract, including what it says about the data after you leave. [Grubhub's Direct page](https://get.grubhub.com/products/grubhub-direct/), offered to eligible Grubhub Marketplace restaurants, tells them: "Download customer data for free and market your business to customers via email, social media or however you decide." Under the heading "Own your data," it lists access to customer data profiles, including contact info and order history. That is a product page rather than a contract, and the merchant terms quoted above do not mention Direct, so ask to see the contract wording that applies to a Direct site. Other vendors sell direct ordering and loyalty too. One you can look at is cirQQles, which publishes this blog, through its Q-Bite product for restaurants: direct ordering through a digital storefront and a website plug-in, plus a branded, opt-in customer community that guests join with an email, a phone number or a Facebook or Google account and can leave whenever they want. Put the questions below to any vendor, that one included. Q-Bite for restaurants: [cirqqles.com/q-bite](https://cirqqles.com/q-bite) ## How do you build a guest list of your own without breaching your contract? You do not have to choose between the apps and your own channels. The job is to keep the two sets of data apart. - **Read your signed agreement.** Search it for "data" and "personal information." - **Keep marketplace data out of your email and text tools.** Do not copy names or numbers from a tablet or a driver's screen into a spreadsheet or loyalty system. DoorDash bars combining its data with any other data, Uber Eats bars merging it, and Grubhub bars using it for targeted marketing, alone or combined with other data. Tell your staff, and any agency that runs your marketing. - **Collect sign-ups yourself.** Ask at the counter and the table, on your own website, or with a bag card whose QR code leads to your own form. Uber Eats' restriction expressly does not reach data "obtained directly from the data subjects in question," under your own privacy policy, so have one. Grubhub's published definition of Customer Data is broader and states no such exception, so raise that with your lawyer if you sell there. Check your agreement for limits on marketing materials first: Uber Eats' Section 12.f.v says a merchant may not advertise an Uber Eats offer outside the apps unless the offer schedule allows it, and even then the materials need prior approval. - **Get consent for each channel.** Text only guests who opted in, and record when and how they did. Ask a lawyer what your messages need to say. - **Ask your platform contacts.** Ask Uber Eats about data-sharing agreements and Grubhub about its exceptions. - **Question any direct-ordering vendor before signing.** Who holds the guest record? Can I export names, contact details and order history at any time, and in what format? May you use my guests' data to market other restaurants? What happens to the data when I leave, and how long do I have to ask for it? ## Frequently Asked Questions **Can I export my customer list from DoorDash, Uber Eats or Grubhub?** On marketplace orders, generally no: the Second Circuit describes the platforms as retaining customers' data as a rule, and all three platforms' published terms limit what you can do with the little you see. Exports come with own-channel products. Grubhub says Direct restaurants can download customer data, and the court says information entered in a DoorDash Storefront order stays with the restaurant. **Can I use a phone number or address from a self-delivery order for marketing?** Not under Uber Eats' published terms, which limit that information to fulfilling that customer's particular order and bar keeping it longer than that takes. DoorDash's terms allow use of its data only as required to perform the agreement, and Grubhub's bar using customer data for targeted marketing. **Does any law make the apps give restaurants customer data?** New York City tried with Administrative Code § 20-563.7, but on August 5, 2026 the Second Circuit held that it violates the First Amendment as applied to the platforms' Marketplace products. Ask a lawyer about the rules where you operate. **If a guest who orders on an app also joins my list, can I market to them?** If the guest gave you the details directly and agreed to hear from you, you are working from your own record, not the platform's. Uber Eats' terms expressly leave data obtained directly from the person, under your own privacy policy, outside the restriction, and DoorDash's definition covers information DoorDash provides or makes accessible, but Grubhub's definition is broader and states no such exception, so ask a lawyer if you sell there. Do not match that list against marketplace data, and text only guests who opted in.