The Second Circuit Court of Appeals ruled on August 5, 2026, that New York City’s Customer Data Law is unconstitutional. The law required food delivery platforms like DoorDash and Grubhub to share customer information with restaurants. This decision affects how these platforms operate and the data they can share, highlighting the ongoing debate over customer privacy and business practices.
The case, DoorDash, Inc. v. City of New York (Docket No. 25-81), arose when the City enacted a law in 2021 that mandated delivery platforms to provide restaurants with detailed customer data upon request. This included full names, phone numbers, email addresses, delivery addresses, and order contents. The law aimed to help restaurants gain direct access to their customers, which supporters argued was necessary for their survival, especially during the pandemic.
The plaintiffs in the case, DoorDash, Grubhub, and Portier (operating as Uber Eats), contended that the law violated their First Amendment rights by compelling them to disclose private customer information. They sought a judicial injunction to prevent the City from enforcing the law. The district court ruled in favor of the platforms, stating that the law indeed violated the First Amendment's protections against compelled speech.
The City appealed the district court's decision, arguing that the law should be reviewed under a less stringent standard for commercial speech. However, the Second Circuit upheld the lower court's ruling, agreeing that the law imposed an unconstitutional burden on the platforms. The judges noted that the law required the platforms to disclose information about third parties, not about their own services, which does not meet the criteria for the less demanding review standard.
In the ruling, the court stated, "The Customer Data Law compels the disclosure of each customer’s name, number, email address, delivery address, and order contents. Those are facts about third parties who use Marketplace, not about Marketplace itself." This distinction was critical in determining that the law could not be evaluated under the more lenient Zauderer standard, which applies to compelled commercial disclosures.
The court further explained that the law failed to meet the requirements of intermediate scrutiny, which is necessary for content-based regulations. The City had to demonstrate a reasonable fit between its stated interests and the means employed by the law. However, the court found that the City did not adequately justify the broad scope of the law, particularly the presumption of consent for customer data sharing.
The court noted that the law presumed every customer consented to having their data shared unless they opted out. This design was seen as overly broad and not sufficiently justified. The ruling emphasized that the City could have implemented less burdensome alternatives, such as an opt-in model where customers would have to agree to share their information.
As a result of this ruling, the court permanently enjoined the City from enforcing the Customer Data Law against the platforms. The decision underscores the importance of protecting consumer privacy and the limits of government intervention in business practices.
This ruling has significant implications for the food delivery industry and local restaurants. It means that platforms like DoorDash and Grubhub will not be required to share customer data with restaurants, allowing them to maintain control over their customer relationships. Restaurants will need to explore other avenues for building direct connections with their customers.
The court's decision also sets a precedent regarding the balance between consumer privacy rights and the interests of businesses in accessing customer data. It reinforces the notion that any laws compelling speech must be carefully tailored and justified, particularly when they involve sensitive personal information.
Looking ahead, the City may consider revising the law to address the court's concerns, but it remains to be seen whether they will pursue an appeal. There are no related cases currently pending that would directly impact this ruling.