Restaurants in New York City will soon gain access to valuable information about their delivery customers. On July 29, 2021, the New York City Council approved a bill requiring third-party food delivery services (“FDS”), such as Uber Eats, DoorDash, and Grubhub, to share customer data – including names, phone numbers, delivery and mailing addresses, and purchase histories – with restaurants upon request. This data-sharing requirement does not extend to telephone orders.
The bill requires an FDS to provide notice to its customer that their data may be shared with the restaurant with which the customer is placing its order, and mandates that the FDS provide a mechanism on its website that enables the customer to opt out of that data sharing. If the customer declines to opt out when placing their order, consent is assumed.
Each FDS will be required to share customer data with restaurants on a monthly basis, and may not limit restaurants’ use of the data for marketing or other purposes. However, restaurants are prohibited from selling, renting, or disclosing customer data to any other party in exchange for financial benefit without first obtaining written consent from the customer(s) in question. Also, the restaurant must allow the customer to (1) withdraw that consent and/or (2) request that the restaurant delete their data.
This bill is expected to take effect in the next few months. In the meantime, restaurants should prepare to avail themselves of this new dataset by developing internal policies to manage their collection, use, disclosure, and retention of this data, as well as to process customer requests to withdraw their consent or delete their data.