Grubhub Inc. v. City of New York

Background

New York City enacted Local Law No. 2021/090, called the Customer Data Law, to support restaurants that use third-party food delivery services. The law applies to DoorDash, Portier, LLC, identified in the opinion as Uber Eats, and Grubhub. It requires a delivery service, when a restaurant requests the information, to provide the customer’s name, telephone number, email address, delivery address, and order contents in a machine-readable format at least monthly.

The law also allows customers to opt out, but it presumes that customers consent to disclosure unless they specifically request that their information not be shared. It prevents delivery services from limiting restaurants’ ability to download, retain, or use the information for marketing and other purposes. Restaurants that receive the information generally must obtain express consent before selling, renting, or disclosing it for financial benefit, must allow customers to withdraw consent, and must delete the information upon request.

The delivery services generally gave restaurants only the customer’s first name, the first initial of the surname, and the order contents, with additional information sometimes provided for self-delivery or under particular agreements. The companies argued that the Customer Data Law violated the First Amendment, the Fifth Amendment’s Takings Clause, and the Contract Clause. They also argued that it exceeded the City’s authority under the New York Constitution. The parties filed competing motions for summary judgment, which ask the court to decide a claim when the material facts are not genuinely disputed.

First Amendment analysis

The court held that the law regulates speech because creating and sharing information is protected by the First Amendment. The law required the delivery services to send customer information to restaurants that they otherwise could have chosen not to receive. The court rejected the City’s argument that the companies were merely passive intermediaries. It found that the companies exercised discretion over whether and how to disclose customer data under their privacy policies, making them more like brokers than mere transmitters.

The court characterized the required disclosures as commercial speech—speech connected to economic interests and commercial transactions. It rejected the City’s argument for the more lenient rational-basis review used for certain factual disclosures under Zauderer because the law required disclosure to restaurants that compete with the delivery services and did not merely disclose the terms of the companies’ own services. The court did not decide whether strict scrutiny or intermediate scrutiny applied, concluding that the law failed even intermediate scrutiny.

Under the intermediate-scrutiny test for commercial speech, the City had to show a substantial government interest, that the law directly advanced that interest, and that the law was not broader than necessary. The court accepted that supporting restaurants and addressing unfair competition could be substantial interests. But it found that the City had not shown that the law would materially address the practices the City criticized, such as promoting competing restaurants or listing false information about restaurants. The law did not restrict the delivery services’ continued use of customer data for marketing or promotion.

The court also found the City’s evidence too speculative to establish that the delivery services’ limits on restaurants’ access to customer data harmed the restaurant industry in the way the City asserted. It noted that the companies already offered restaurants advertising, marketing, analytics, and other tools. Finally, the court identified less restrictive alternatives, including opt-in programs, financial incentives, subsidies for restaurant ordering platforms, and more targeted regulations. Because the Customer Data Law failed intermediate scrutiny, the court held that it violated the First Amendment.

Remaining claims and disposition

The court stated that its First Amendment ruling prevented the City from enforcing the Customer Data Law against the plaintiffs and provided the relief they sought. It therefore declined to decide the remaining federal and state claims. The court granted the plaintiffs’ motion for summary judgment on the First Amendment claim and denied the City’s cross-motion for summary judgment on that claim. On the remaining claims, the court denied both the plaintiffs’ motion and the City’s cross-motion as moot. Judge Analisa Torres directed the parties to submit a proposed judgment by October 7, 2024.