Does DoorDash Share Customer Data With Restaurants? (2026)

No. A DoorDash Marketplace order shows you the customer's first name, last initial and order contents. Full name, email, phone number and address stay with DoorDash, and Uber Eats and Grubhub do the same.

This page covers what customer data each delivery app gives your restaurant and what you may do with it: what appears per order, which of the apps' own products share names and emails, where the New York City law ended up, whether a flyer in the bag is allowed, and how to build a list you own legally. Every platform fact comes from the company's own terms, help center or developer docs, checked September 2026. For why ownership matters, read the customer data ownership guide.

What each delivery app shares with restaurants

"Aggregate only" means dashboards: new versus returning counts, zip-code heatmaps, ratings. Useful for menu decisions, useless for sending anyone a message.

What do you actually see on a DoorDash order?

On a standard DoorDash Marketplace order you see the customer's first name, last initial, the items, and a phone number that is either DoorDash Support or a temporary masked line. You do not see the customer's email, real phone number or, unless you deliver it yourself, the address.

DoorDash's developer docs show the exact payload a POS integration receives. The sample order lists the consumer as "Kelley W." and says the phone field defaults to "a general DoorDash Support phone number." With the masked number feature on, you get a number tied to that order, valid from acceptance "to 30 minutes after the delivery is either completed or canceled," and only when you call from the store phone DoorDash has on file. The one exception, from DoorDash's orders guide: "If you are a Self Delivery merchant, you will see the customer's contact information on the tablet and can communicate with them directly."

The Merchant Portal does not fill the gap: its analytics FAQ describes Marketplace customers as reviews, zip-code heatmaps and a "new, occasional, or frequent" breakdown. And section 11.1 of the Merchant Terms of Service (effective January 20, 2023) bars using DoorDash Data, "including without limitation Personal Information, except as required to perform under this Agreement." A Self-Delivery phone number is for that delivery, not a list.

What do Uber Eats and Grubhub show you per order?

Uber Eats gives you the customer's first name, last-name initial, an anonymized phone number with an access code, and the delivery address only when your own staff deliver. Grubhub's order ticket shows the address, phone number and delivery instructions, but its terms let you use them only to fill that order.

Uber Eats. The order API defines the eater fields as first name, "the last name initial of the Eater" and "the anonymized phone number of the Eater" plus a phone code, with no email field and no address for Uber-coordinated delivery. The US merchant terms (last modified June 2, 2026) limit Portier Personal Information to "performing its obligations under this Agreement" and bar using Uber data for "targeted marketing" (section 13), then carve out Personal Information "that the Merchant obtained directly from the data subjects." What you collect at your own counter is yours.

Grubhub. Grubhub's help center says an order received by email or fax shows "customer details including their address, phone number, and any special instructions they have for delivery." The Restaurant Terms (updated February 4, 2020) then take the value back: "all Customer Data is the sole and exclusive property of GH," usable only "for the sole purpose of fulfilling applicable customer orders." Paragraph (d) is the strictest clause on any of the three platforms: the restaurant "will not, and will not permit any third party to, market to or solicit any customer or company obtained through the Systems or via the Services for any purpose," with a carve-out only for customers "obtained independently." Grubhub's 2023 segment reporting, as Restaurant Business put it, "stops short of giving restaurants access to data on individual customers."

Which delivery app products do give you customer data?

Three do: DoorDash Online Ordering (formerly Storefront), Uber Eats Webshop plus Uber's in-app data-sharing opt-in, and Grubhub Direct. Each gives you names and emails because the customer ordered from your own site or agreed to share, not because you are listed on the marketplace.

DoorDash Online Ordering. The analytics FAQ lists name, email, delivery address, zip, phone, lifetime orders and spend, and first and last order dates, but "only for orders placed through the Online Ordering link, and not the Order with the Google integration." The product page says no monthly or commission fees, only payment processing, and the Commerce Platform FAQ confirms it comes standard with Marketplace plans. The Storefront addendum (section 4.5.1) makes TCPA compliance your job and says you "shall not use DoorDash's name or logo in such outreach"; section 8 says Google-order data may not be used "for remarketing or to build user profiles."

Uber Eats. Webshop costs "2.5% + $0.29" per order in the US, and its customer report covers "customers that opt-in during checkout." Inside the marketplace app, Uber's store communication page says a customer who shares data lets a store "see your name, email, and order history with them," and stores can reach out "only after you've opted-in." The Second Circuit noted this runs "under certain data-sharing agreements," so ask your account manager whether your store qualifies.

Grubhub Direct. The product page promises "customer data profiles, including contact info, order history and more" and says "you can even download all customer data to use in your own marketing." You are paid daily, by direct deposit.

Do any laws force delivery apps to share customer data with restaurants?

No. New York City passed one in 2021, but the city agreed not to enforce it while DoorDash, Grubhub and Uber Eats sued, a federal judge struck it down in September 2024, and the Second Circuit affirmed on August 5, 2026. Florida's law gives you a contact method, not the data.

N.Y.C. Administrative Code section 20-563.7 required platforms to give a restaurant, on request, every customer's full name, phone number, email, delivery address and order contents, "in a machine-readable format, disaggregated by customer, on an at least monthly basis." Every customer was "presumed to have consented" unless they opted out, order by order. Judge Analisa Torres of the Southern District of New York struck it down in September 2024 (Restaurant Dive).

On August 5, 2026 a unanimous Second Circuit panel (Judges Wesley, Carney and Park) affirmed in DoorDash, Inc. v. City of New York, No. 25-81. The opinion opens with the undisputed fact that a restaurant "generally receives only the customer's first name, last initial, and the order contents," then holds that the law compels information "about third parties who use Marketplace, not about Marketplace itself," and fails intermediate scrutiny because the city never showed why presumed consent was needed when an opt-in would do. Judge Wesley's line: "The result is a marketing list that no customer asked to join and that none can be confident they have permanently left." Courthouse News has the same-day coverage; as of September 2026 we found no report of the city seeking rehearing or Supreme Court review.

An opt-in law might survive, but none exists in any US city or state we could find. The closest is Florida Statutes 509.103(5): since July 1, 2025 a platform must give the restaurant "a method of contacting the consumer" during the order and "for up to 2 hours after the order is picked up." A support channel, not a phone number in your hands.

Can you put a flyer in the bag asking customers to order direct?

None of the three US merchant agreements we read mentions flyers by name. DoorDash and Uber Eats restrict how you use their customer data, not what goes in the bag. Grubhub's terms bar soliciting any customer obtained through Grubhub, which is the clause a bag insert runs into.

DoorDash. The Marketplace Product Addendum (effective April 21, 2022) only asks you to "provide the same utensils, napkins, bags, and other materials that Merchant typically would provide in a standard take-out or delivery order." We found no rule about inserts. A card about your restaurant and your website that never mentions DoorDash sits outside the data clause and the no-logo clause.

Uber Eats. The US terms have no clause about materials in bags. Uber's Australian terms do, at clause 4.9(a): "you must not include any additional materials in bags or packages for your customers other than Items and other materials approved by Portier Pacific." Not in the US agreement today, but proof Uber is willing to write one.

Grubhub. Paragraph (d), quoted above, names "solicit a customer or order directly from Restaurant" as its example of what you may not do. A flyer asking a Grubhub customer for the next order direct is hard to square with that, even though it uses no Grubhub data. Whether Grubhub enforces it against bag inserts we could not confirm; merchant care is at restaurants@grubhub.com.

Practical reading, not legal advice: one branded card in every bag on every channel, about your food, your website and your loyalty program, that never names or mocks the app. If Grubhub volume matters to you, ask them in writing first. The playbook for moving customers over is in how to get more direct orders.

How do you build your own customer list legally?

You build it from orders and visits you control: direct online orders, phone orders, counter and receipt signups, guest wifi and loyalty enrollment. Collect email and phone with a separate, unchecked marketing consent box, keep a record of each consent, and honor every unsubscribe and STOP.

Two laws set the floor. Texts: the FCC's TCPA rules (47 CFR 64.1200(a)(2)) require "prior express written consent" before you send marketing texts to a mobile number with an automatic dialing system, which is what every SMS platform is. A checkbox with an electronic signature counts, but it must clearly authorize your restaurant to text that number and state that the customer "is not required to sign the agreement ... as a condition of purchasing any property, goods, or services." The FCC's December 2024 FAQ confirms the rule covers texts, its February 2024 order requires you to honor a STOP within 10 business days, and 47 U.S.C. 227(b)(3) lets a customer sue for $500 per violation, up to three times that if willful. Email: the FTC's CAN-SPAM guide requires every marketing email to identify itself as an ad, carry your physical postal address, offer an opt-out and honor it within 10 business days; each violating email can cost up to $53,088.

One 2026 wrinkle: the Fifth Circuit held in February 2026 that the TCPA statute itself requires only "prior express consent," which can be oral (summary), but that binds Texas, Louisiana and Mississippi only, and written consent with a timestamp remains the cheapest insurance everywhere. Cadence and wording are covered in SMS marketing for restaurants.

A 5-step plan to start capturing customer data this week

Step 1: Turn on capture at your own checkout. Collect email and mobile number for the receipt, then add a separate, unchecked marketing box beneath it. Pre-checked boxes and consent buried in the terms are what get restaurants sued. Sample checkout line: "Yes, text me offers and updates from [Restaurant Name] at this number. Up to 4 texts a month. Msg and data rates may apply. Reply STOP to cancel. Consent is not a condition of purchase."

Step 2: Put one sign at the counter and one card in every bag. Both point to the same signup keyword and say what the customer gets and how often. Sample counter sign: "Get $5 off your next order. Text JOIN to [number] for [Restaurant Name] deals, about 3 texts a month. Reply STOP anytime." Keep the app names off it.

Step 3: Capture phone orders. Every call gives you a number and a name. Add one line to the script, "Want a text when your order is ready, and our weekly special?", and log the yes with the date. If a phone system or AI answering service takes the call, have it send one confirmation text the customer replies YES to.

Step 4: Store the proof. The consent text shown, the timestamp, the source and the number or email. That row is your entire defense if anyone asks how you got permission.

Step 5: Send something within a week. One welcome message with the promised offer is enough. What to send after that is a retention question, and how to structure rewards is a loyalty question.

Where DirectOrders fits

DirectOrders is a commission-free ordering system for independent restaurants: a branded website, Voice AI phone ordering and 15+ ordering channels, with the restaurant owning its customer data and SMS and email marketing built in. Delivery runs through your own drivers, Uber Direct or DoorDash Drive, so the customer relationship stays with you. Pro is $249 a month, Pro + Voice is $349 with 500 AI phone minutes, and there is a 14-day free trial.

Sources

All checked September 2026.

• DoorDash: analytics FAQ, Online Ordering, Commerce Platform FAQ, manage live orders, privacy policy
• DoorDash legal: Merchant Terms of Service, sections 1 to 11, Storefront Product Addendum, Marketplace Product Addendum
• DoorDash developer docs: masked customer phone number, sample order
• Uber Eats: US Merchant Terms and Conditions, Australian merchant terms, order API reference, help pages on store communication settings, reporting and Webshop
• Grubhub: Restaurant Terms, self service, manage orders help, Grubhub Direct; Restaurant Business, May 18, 2023
• NYC law: DoorDash, Inc. v. City of New York, No. 25-81 (2d Cir. Aug. 5, 2026), Courthouse News, Reuters via The Daily Record, Restaurant Dive on the 2024 ruling; Florida Statutes 509.103
• TCPA and CAN-SPAM: 47 CFR 64.1200, 47 U.S.C. 227, FCC consent FAQ, December 2024, FCC 24-24 order, FTC CAN-SPAM guide, Troutman Pepper Locke on the Fifth Circuit ruling

Bottom line

DoorDash, Uber Eats and Grubhub do not share marketplace customers' emails or real phone numbers with restaurants, and their terms limit the fragments you do get to filling the order. Names and emails only come through their direct-ordering products, where the customer orders from you or opts in. No law changes that: the New York City mandate was never enforced and was struck down in August 2026. Build your list from your own checkout, phone line and counter, with a separate consent box and a record of every yes, and you will own something no platform can take back.