DoorDash sues New York City over law that requires it to share customer data with restaurants

Food delivery company DoorDash has filed yet another lawsuit against New York City, calling a new law requiring delivery companies to share customer data with restaurants “a shocking and invasive intrusion of consumers’ privacy.”

Under the law approved in July, third-party food delivery services in the city would have to share customers’ names, phone numbers, emails, and delivery addresses with a restaurant that fulfills a DoorDash order, unless the customer opts out. In its complaint, DoorDash argues that customers entrust DoorDash with sensitive data, “that they would not entrust to small businesses that do not have similar robust data safety and security protocol.”

The company added that in-person diners don’t typically expect to disclose sensitive personal information to restaurants. “Moreover, the Ordinance’s presumption that every customer consents to sharing their personal data—unless they specifically opt out on a per-order basis—flies in the face of prevailing privacy best practices,” the lawsuit states. And there are no guarantees that restaurants would be able to store customer data in a way that both complies with privacy laws and prevents unauthorized access, DoorDash argues.

New York City councilor Keith Powers, introduced the legislation earlier this year. “After such a devastating year for our city’s restaurant industry, this precedent-setting law gives much needed relief to eateries to have better access to customer data and provides strong privacy protections,” Powers wrote in an email to The Verge. “Restaurants are the lifeblood of New York’s economy and culture, and I’m proud that the City Council has stood by our local establishments and New York diners. I encourage DoorDash to drop this lawsuit immediately.”

The Electronic Frontier Foundation (EFF) wrote in a July letter to New York City Council that it “sympathize[d] with the goal to set a more level playing field for all businesses particularly after the year we have all faced,” but that it opposed the measure: “privacy should be the default of any transaction, and consumers should be asked to opt-in to sharing of their information every time it could be transferred to a new entity.”

In addition, the EFF said, the ordinance “sets up a ripe target for hackers and data thieves who want to exploit [the customers’] information.