New York City cannot force delivery apps to give restaurants a customer's full name, phone number, email address, delivery address and order contents, the Second Circuit ruled on Wednesday.
We obtained a copy of the ruling for you here.
The three-judge panel held Administrative Code section 20-563.7, the Customer Data Law, unconstitutional as applied to the platforms' marketplace products, the part of the apps where a customer orders from a restaurant through the platform. It affirmed a district court judgment that the law compels speech in violation of the First Amendment and bars the city from enforcing it against the three companies.
Under the law the customer was presumed to have agreed. A customer who wanted to keep their home address away from a restaurant had to refuse on that order, then refuse again on the next one, and again after that.
"The result is a marketing list that no customer asked to join and that none can be confident they have permanently left," Circuit Judge Richard Wesley wrote for the panel.
"The city identifies no reason, and offers no evidence, as to why customers must repeat the same refusal with every single order," Wesley wrote. The city could have asked customers to opt in instead, which is what Uber Eats sometimes does.
A restaurant taking an order through DoorDash normally sees a first name, a last initial and the food ordered. The law would have delivered the rest of the file on request, monthly, broken out customer by customer.
A government told private companies to disclose a customer's home address to a business that customer never chose, and it set the default to yes. That is worse than most of what happens when a company harvests data on its own, because the file went to a third party the customer had never dealt with, and there was nothing to unsubscribe from. The refusal started over with every order.
DoorDash, Grubhub, and Uber Eats are far from being privacy campaigners. It's likely they fought this law because they want the customer relationship - and the data under it - kept to themselves. DoorDash told the court it can identify customers who regularly order pizza and then serve them advertisements and promotions for new pizza restaurants.
But the customers came out ahead anyway.
The people whose names and addresses were being moved were not parties to the case, and the winning argument was a corporate compelled-speech claim brought by the three companies that already hold the data. Customer privacy came in around the edges of it. Judge Analisa Torres found in 2024 that the law could violate customers' privacy. The Washington Legal Foundation, filing as a friend of the court, argued that "First Amendment and personal privacy interests counseled in favor of jettisoning the City's ordinance."
The city argued that the disclosure was ordinary commercial information about the service the platforms sell. That would have earned it deferential review under Zauderer, which lets a government compel plain factual disclosures about a business's own product unless the requirement is "unjustified or unduly burdensome." The panel applied the tougher Central Hudson standard instead, which makes the city show that its interest is substantial and that it had no substantially less burdensome way to serve it. "Those are facts about third parties who use [the] marketplace, not about [the] marketplace itself," Wesley wrote.
Circuit Judge Michael Park joined the ruling and wrote separately.
"The law compels speech for nothing more than economic favoritism," Park wrote. "The city's stated goal is to 'support the restaurant industry' by requiring delivery platforms to disclose valuable data to restaurants." He wrote that the law would harm consumers "by disclosing their personally identifiable information without consent." And he wrote, "A vague desire to support an industry comprised of tens of thousands of stores is not the type of interest that can justify abridging the freedom of speech of disfavored competitors."
That is a concurrence, not the holding of the court. The panel opinion turned on tailoring, and on the order-by-order opt out the city never justified. The panel left open whether the city's interests were substantial and whether the law advanced them. It also left open a law under which a customer could refuse once and have the refusal stand, without deciding whether such a law would survive.
Councilmember Keith Powers introduced the bill in May 2021, and the Council passed it that summer as one of several measures meant to help restaurants recover from the pandemic. It was a competition measure, written to pry the customer list out of the platforms and give it to the restaurants.
Powers said at the time that the law "gives much needed relief to eateries to have better access to customer data and provides strong privacy protections." The protection was a refusal the customer had to make on every order, for as long as they used the app. One order placed without a refusal released the name, phone number, email address and delivery address to the restaurant.
The apps sued that September, calling the ordinance a "shocking and invasive intrusion of consumers' privacy." The city agreed in October 2021 to hold off enforcement while the case ran, so the disclosures never started.
Restaurant groups still want them. The New York City Hospitality Alliance has said that the platforms' hold on customer data forces restaurants to stay on the apps or lose contact with their own regulars. The New York State Restaurant Association told the Council the apps kept restaurants "at arm's length from their customers, even repeat customers, even their regulars." The platforms already sell products that hand the restaurant the relationship, DoorDash Drive and Storefront among them, where what a customer enters stays with the restaurant, and the ruling records that thousands of New York City restaurants use them.
Wednesday's decision affirms Torres's September 2024 ruling, which granted summary judgment to the platforms and permanently barred the city from enforcing the law against them.