25-81 DoorDash, Inc. v. City of New York
United States Court of Appeals for the Second Circuit ________________________________
DOORDASH, INC., Plaintiff-Appellee,
GRUBHUB INC., PORTIER, LLC, Consolidated Plaintiffs-Appellees,
v.
CITY OF NEW YORK, Defendant-Appellant. ________________________________
No. 25-81 AUGUST TERM 2025 ARGUED: April 15, 2026 DECIDED: August 5, 2026
On Appeal from the United States District Court for the Southern District of New York ________________________________
BEFORE: WESLEY, CARNEY, and PARK, Circuit Judges.
When a customer orders food on a third-party delivery platform, they usually provide the platform with their full name, phone number, email address, and delivery address. The platform uses this information to deliver the customer’s food and later send them targeted advertisements. The restaurant that prepares the food, however, generally receives only the customer’s first name, last initial, and the order contents.
1 of 25 Against that backdrop, the City of New York (“the City”) in 2021 enacted N.Y.C. Administrative Code § 20-563.7 (“the Customer Data Law” or “the Law”), which requires delivery platforms to share with a restaurant, at its request, the rest of that customer information for every customer who has ordered from the restaurant. Three of New York City’s largest delivery platforms—DoorDash, Grubhub, and Portier (which does business as Uber Eats) (together, “the Platforms”)—sued the City to enjoin the Law.
The district court (Torres, J.) held that the Law violates the First Amendment’s protections against compelled speech, granted summary judgment to the Platforms, and permanently enjoined the City from enforcing the Law against the Platforms. On appeal, the City argues that the district court erred in two ways. First, it contends that the Law merely requires the Platforms to disclose information about the service they sell—providing access to customers—and therefore should have been reviewed under the deferential standard of Zauderer v. Office of Disciplinary Counsel of the Supreme Court of Ohio, 471 U.S. 626 (1985), rather than the more demanding intermediate scrutiny of Central Hudson Gas & Electric Corp. v. Public Service Commission of New York, 447 U.S. 557 (1980). Second, it argues that even if intermediate scrutiny applies, the Law survives it. We disagree with the City on both counts and AFFIRM the district court’s judgment.
JUDGE PARK concurs in a separate opinion. ________________________________
JONATHAN SCHOEPP-WONG, Assistant Corporation Counsel (Richard Dearing, Claude S. Platton, Assistant Corporation Counsel, on the brief), for Muriel Goode-Trufant, Corporation Counsel of the City of New York, New York, NY, for Defendant- Appellant.
MICHAEL HOLECEK, Gibson, Dunn & Crutcher LLP, Los Angeles, CA (Jonathan N. Soleimani, Gibson, Dunn & Crutcher LLP, Los Angeles, CA; Aaron Smith, Gibson, Dunn & Crutcher LLP, Washington, DC; Joel Kurtzberg, Jason David Rozbruch, Cahill Gordon & Reindel LLP, New York, NY; John Charles
2 of 25 Quinn, Hecker Fink LLP, New York, NY, on the brief), for Plaintiffs-Appellees.
Cory L. Andrews, Zac Morgan, Washington Legal Foundation, Washington, DC, for Amicus Curiae Washington Legal Foundation.
Daniel M. Sullivan, Andrew C. Indorf, James Campbell, Holwell Shuster & Goldberg LLP, New York, NY, for Amicus Curiae Tech:NYC. ________________________________
WESLEY, Circuit Judge:
When a customer orders food on a third-party delivery platform, they
usually provide the platform with their full name, phone number, email address,
and delivery address. The platform uses this information to deliver the customer’s
food and later send them targeted advertisements. The restaurant that prepares
the food, however, generally receives only the customer’s first name, last initial,
and the order contents.
Against that backdrop, the City of New York (“the City”) in 2021 enacted
N.Y.C. Administrative Code § 20-563.7 (“the Customer Data Law” or “the Law”),
which requires delivery platforms to share with a restaurant, at its request, the rest
of that customer information for every customer who has ordered from the
restaurant. Three of New York City’s largest delivery platforms—DoorDash,
3 of 25 Grubhub, and Portier (which does business as Uber Eats) (together, “the
Platforms”)—sued the City to enjoin the Law.
The district court (Torres, J.) held that the Law violates the First
Amendment’s protections against compelled speech, granted summary judgment
to the Platforms, and permanently enjoined the City from enforcing the Law
against the Platforms. On appeal, the City argues that the district court erred in
two ways. First, it contends that the Law merely requires the Platforms to disclose
information about the service they sell—providing access to customers—and
therefore should have been reviewed under the deferential standard of Zauderer v.
Office of Disciplinary Counsel of the Supreme Court of Ohio, 471 U.S. 626 (1985), rather
than the more demanding intermediate scrutiny of Central Hudson Gas & Electric
Corp. v. Public Service Commission of New York, 447 U.S. 557 (1980). Second, it argues
that even if intermediate scrutiny applies, the Law survives it. We disagree with
the City on both counts and AFFIRM the district court’s judgment.
BACKGROUND 1
New York is, among other things, a restaurant city. This case concerns a
newer fixture of its restaurant scene—third-party food delivery platforms—and a
1 The material facts are drawn from the summary judgment record and are undisputed.
4 of 25 City ordinance that requires those platforms to share certain customer information
with restaurants.
I. Third-Party Delivery Platforms
Marketplaces have long connected sellers with buyers. Similarly, the
plaintiffs here—DoorDash, Grubhub, and Uber Eats—each run an online
storefront they call “Marketplace,” where customers can find and order food from
local restaurants. Unlike a bazaar or a mall, however, third-party delivery
platforms record, and later use, the data generated by each transaction.
To order food using DoorDash Marketplace, for example, the customer
opens the DoorDash app or website, browses participating restaurants, selects the
food they want, enters the information needed for delivery, and pays. DoorDash
then transmits their order to the restaurant. While the restaurant prepares the
food, DoorDash matches the order with a nearby courier, a “Dasher,” who picks
up the food and delivers it to the customer’s door. 2 For its services, DoorDash
charges the restaurant a commission on each order. When the order is complete,
2 Not all Marketplace services involve food delivery managed by the Platforms. For example, DoorDash’s Marketplace “Self-Delivery” offering allows restaurants themselves to arrange for delivery of orders placed with them through the DoorDash app or website. J. App’x 4465. And DoorDash’s Marketplace “Pickup” offering, as its name suggests, allows customers themselves to pick up takeout orders placed through DoorDash. Id. at 4466.
5 of 25 DoorDash retains a digital record of the customer’s full name, phone number,
email address, delivery address, and order.
The Platforms use that data in different ways, including by offering
restaurants marketing services. For example, DoorDash can “identify customers
who regularly order pizza . . . and then present those customers advertisements,
deals, and promotions for new pizza restaurants.” Appellees’ Br. 11; see also J.
App’x 4684–85 (explaining how Grubhub uses customer data to tailor restaurant
recommendations, manage rewards programs, process payments, detect fraud,
and assess security risks).
Contracts between the Platforms and participating restaurants typically
leave control of customer data with the Platforms. DoorDash’s standard
agreement, for example, permits restaurants to use the limited information they
receive—again, the customer’s first name, last initial, and the order contents—only
to fill orders and provides that customer data “belongs to DoorDash.” J. App’x
4512–13. Grubhub allows restaurants to use customer data more extensively only
in “very few” circumstances involving “extremely valuable partnerships.” Id. at
4701.
6 of 25 The Platforms also offer other products that do place customer data in the
hands of restaurants. With “DoorDash Drive,” for example, the restaurant takes
the order itself but then uses a DoorDash courier to deliver it to the customer. Id.
at 4910. And with “Storefront,” DoorDash helps the restaurant create an online-
ordering tool on its own website. Id. DoorDash contends it created Storefront “to
offer [restaurants] an opportunity to have a direct relationship with customers.”
Id. at 4497. Unlike on Marketplace, the information a customer enters in placing a
Storefront order stays with the restaurant. Thousands of New York City
restaurants use these alternative products. But it is principally Marketplace—
under which, as a rule, the Platforms retain customers’ data—that is the focus of
the Customer Data Law.
II. The Customer Data Law
The New York City Council began studying the relationship between
restaurants and third-party delivery platforms as early as 2019, when its
Committee on Small Business held a hearing on “digital food delivery apps” and
their impact “on local restaurants and the food industry.” Id. at 4745. Then came
the COVID-19 pandemic. In March 2020, Governor Andrew Cuomo’s “New York
State on PAUSE” executive order shuttered on-site dining statewide, leaving
7 of 25 restaurants to operate by takeout and delivery only. At the same time, the Mayor’s
office advised restaurants to join delivery platforms. Many did, and as on-site
dining collapsed, the platforms became what the City Council’s Committee on
Consumer Affairs and Business Licensing later called “a crucial lifeline.” Id. at
4451.
In May 2021, Councilmember Keith Powers introduced the bill that became
the Customer Data Law. The bill would require platforms to share certain
customer information with restaurants. Powers cast the measure as an effort to
“strike the right balance and equity between those that hold the information and
those that supply the goods and services.” Id. at 661.
Supporters framed the bill as a way to loosen the Platforms’ control over
restaurants’ customer relationships. Councilmember Diana Ayala explained that
customer data is “one of the most important tools restaurants can use to develop
marketing strategies and customer relations.” Id. at 4429. The New York State
Restaurant Association noted that the Platforms kept restaurants “at arm’s length
from their customers, even repeat customers, even their regulars,” preventing
restaurants from communicating directly about orders and promotions. Id. at 595.
It viewed the bill as a means to “stop the gate keeping by third party platforms”
8 of 25 and “level[] the playing field.” Id. at 596. The New York City Hospitality Alliance
similarly warned that restaurants could not leave a Platform without “los[ing]
access to their own customers,” even as the Platform used their data to market
competing restaurants. Id. at 599. The bill was passed by a significant majority of
the City Council and is codified at N.Y.C. Administrative Code § 20-563.7.
The Law provides that, at a restaurant’s request, platforms must provide
five categories of data about every customer who places an online order from that
restaurant through the platform: (1) full name, (2) telephone number, (3) email
address, (4) delivery address, and (5) order contents. N.Y.C. Admin. Code §§ 20-
563, 20-563.7(a). The platform must transmit that data “in a machine-readable
format, disaggregated by customer, on an at least monthly basis.” § 20-563.7(c).
Each customer is “presumed to have consented” to disclosure unless they opt out
for that particular order. § 20-563.7(b).
III. Procedural History
Soon after the Law was enacted, the city’s three largest delivery platforms—
DoorDash, Grubhub, and Uber Eats—sued the City to enjoin its enforcement.
They argued, among other things, that the Law compelled them to speak in
violation of the First Amendment. The City agreed to stay enforcement against
9 of 25 the Platforms while the litigation was pending. On cross-motions for summary
judgment, the district court ruled in favor of the Platforms. DoorDash, Inc. v. City
of New York, 789 F. Supp. 3d 337, 359 (S.D.N.Y. 2025). The court held that the Law
regulates the Platforms’ speech by compelling them to share customer
information; that Zauderer’s deferential review did not apply; and that the Law
could not survive Central Hudson’s intermediate scrutiny. 3 Id. at 351–52, 355, 359.
The court permanently enjoined enforcement of the Law as applied to the
Platforms’ Marketplace products.
The City appeals. It does not challenge the district court’s holding that the
Law regulates speech. It argues instead that the disclosure is subject to Zauderer’s
deferential review—not Central Hudson’s intermediate scrutiny—and that, even
under Central Hudson, the Law survives. The Platforms disagree. They argue that
the Law is a content-based regulation of noncommercial speech subject to strict
scrutiny, and that, in any event, the Law fails under any standard.
3 Because the district court held that the Law could not “withstand even intermediate scrutiny,” it did not decide whether strict scrutiny applied. DoorDash, 789 F. Supp. 3d at 355.
10 of 25 DISCUSSION 4
I. Zauderer Does Not Apply
The City argues that Zauderer supplies the proper framework for reviewing
the Law. We disagree.
Zauderer involved a 1980s newspaper advertisement, in which Philip
Zauderer, an Ohio attorney, advertised his services to women injured by the
Dalkon Shield. Zauderer, 471 U.S. at 629–30. “If there is no recovery,” he promised,
“no legal fees are owed by our clients.” Id. at 631. Left unsaid was that those
clients could still owe litigation costs, such as filing fees, even if they lost. Ohio’s
rules of professional responsibility required attorneys who advertised contingent-
fee services to disclose that their clients could remain liable for such costs. Id. at
635–36. Zauderer’s failure to do so drew a public reprimand from the Supreme
Court of Ohio. Id. at 636.
Zauderer challenged the rule, arguing that a compelled disclosure calls for
the same First Amendment scrutiny as a restriction on speech. Id. at 650. The
4 We review a district court’s grant of summary judgment de novo. Conn. Fair Hous. Ctr. v. CoreLogic Rental Prop. Sols., LLC, 167 F.4th 605, 615 (2d Cir. 2026). Summary judgment is proper only where “there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). Because the material facts are undisputed, this appeal presents only questions of law.
11 of 25 Court agreed that “[i]n some instances compulsion to speak may be as violative of
the First Amendment as prohibitions on speech.” Id. But the interests at stake in
Zauderer’s case were “not of the same order.” Id. at 651. Ohio had not attempted
to “prescribe what shall be orthodox in politics, nationalism, religion, or other
matters of opinion.” Id. (quoting W. Va. State Bd. of Educ. v. Barnette, 319 U.S. 624,
642 (1943)). It had attempted “only to prescribe what shall be orthodox in
commercial advertising,” requiring an advertiser to state accurate facts about the
terms of his own services. Id. Because the First Amendment protects commercial
speech “principally” for “the value to consumers of the information such speech
provides,” Zauderer’s interest in withholding those facts was “minimal.” Id. A
State, the Court concluded, may compel a commercial speaker to disclose (1)
“purely factual and uncontroversial information” (2) “about the terms under
which his services will be available,” so long as the disclosure is (3) “reasonably
related to the State’s interest” and (4) not “unjustified or unduly burdensome.” Id.
Since then, we have employed Zauderer to sustain compelled disclosures in
a number of commercial settings. In New York State Restaurant Ass’n v. New York
City Board of Health, for example, we upheld a New York City ordinance requiring
certain restaurants to post calorie-content information on their menus because the
12 of 25 City had “demonstrated a reasonable relationship between the purpose of [the]
disclosure requirement[] and the means employed to achieve that purpose.” 556
F.3d 114, 134 (2d Cir. 2009). Likewise, in National Electrical Manufacturers Ass’n v.
Sorrell, we held that Zauderer governed a Vermont requirement that manufacturers
label mercury-containing lamps with disposal information, because the compelled
statement was purely factual and reasonably related to the State’s interest in
alerting consumers to the mercury in the products they may buy. 272 F.3d 104,
114–15 (2d Cir. 2001). More recently, in CompassCare v. Hochul, we sustained a
requirement that employers note in their handbooks the existence of New York’s
workplace antidiscrimination protections, treating that notice as a disclosure of
information “about the terms under which . . . services will be available,”
specifically the terms of employment under New York law. 125 F.4th 49, 64–65 (2d
Cir. 2025) (omission in original) (quoting Zauderer, 471 U.S. at 651).
Varied as these disclosures were, each reinforced Zauderer’s threshold
requirement that, to be lawfully compelled by the State, speech be “about the
goods or services the speaker may offer.” Volokh v. James, 148 F.4th 71, 86 (2d Cir.
2025). Calorie counts were about the food restaurants sell, mercury warnings
13 of 25 about the lamps manufacturers make, and antidiscrimination notices about the
legal terms of employment.
We have rejected calls to apply Zauderer’s deferential standard where the
disclosure at issue was not about the speaker’s own goods or services. In Safelite
Group, Inc. v. Jepsen, for example, we confronted a Connecticut law that required
insurance claims administrators to name a competitor whenever they
recommended their affiliated auto-glass shops. 764 F.3d 258, 260 (2d Cir. 2014).
We concluded that Zauderer was not a good fit. Every prior application of the
exception, we observed, had involved a disclosure “about a company’s own
products or services.” Id. at 264. Connecticut’s disclosure requirement, however,
was about a third party, there a competitor. That distinction was “important,
indeed, dispositive.” Id.
The disclosure here—customers’ personal information—is not information
“about” Marketplace. Information about Marketplace might, for instance,
describe the commissions restaurants pay, how the Platforms rank and display
restaurants, or the grounds on which they may deactivate a restaurant’s account.
See, e.g., Uber Techs., Inc. v. City of Seattle, 168 F.4th 1202, 1216–17 (9th Cir. 2026)
(holding, in the alternative, that an ordinance requiring third-party platforms to
14 of 25 inform their couriers of the grounds for account deactivation satisfied Zauderer
because the notice “concerns only the service provided”). The Customer Data
Law, by contrast, compels the disclosure of each customer’s name, number, email
address, delivery address, and order contents. § 20-563.7. Those are facts about
third parties who use Marketplace, not about Marketplace itself.
The City resists this straightforward conclusion, insisting that the Platforms’
service is the provision of “access to the customers and their orders,” Appellant’s
Br. 36 (emphasis added); thus, the City is of the view that the Law compels
disclosure “about the very thing that plaintiffs are offering,” id. at 45. But even if
the City’s characterization of Marketplace were right, the compelled disclosure
would still have to be about the provision of “access to” those customers.
Appellant’s Br. 36; see also Appellees’ Br. 37 (disputing the City’s characterization
of Marketplace). Access to something means the “ability to obtain or make use of”
that thing. Access, Webster’s Third New International Dictionary (2002). To
provide access to customers, then, means giving restaurants the ability to reach
them through Marketplace. A disclosure about that service might describe the
customer base as a whole, such as its size or expected order volume. It would not
simply reveal every customer’s full name and contact information.
15 of 25 Nor does the Customer Data Law serve the purpose animating Zauderer’s
deferential review. 5 “Protection of the robust and free flow of accurate
information is the principal First Amendment justification for protecting
commercial speech, and requiring disclosure of truthful information promotes
that goal.” Nat’l Elec. Mfrs., 272 F.3d at 114. That information helps the recipient
make “intelligent and well informed” economic decisions about the product,
service, or transaction before them. Va. State Bd. of Pharmacy v. Va. Citizens
Consumer Council, Inc., 425 U.S. 748, 765 (1976). Commercial-disclosure
requirements, in other words, “primarily seek to reduce information costs and
thereby to establish a more educated and efficient marketplace.” Robert Post,
Transparent and Efficient Markets: Compelled Commercial Speech and Coerced
Commercial Association in United Foods, Zauderer, and Abood, 40 Val. U. L. Rev.
555, 584 (2006). A calorie count, for instance, may inform a diner’s choice between
a hamburger and a salad—or whether to patronize the restaurant at all.
5 We have sometimes described Zauderer’s standard as “rational basis” review. See, e.g., CompassCare, 125 F.4th at 64–65. At the same time, we have observed that Zauderer, though highly deferential, may ask more of the government than rational basis review does. See Volokh, 148 F.4th at 85 n.6 (observing that “some aspects of the Zauderer analysis are arguably more stringent than traditional rational basis review”). We express no view here on whether Zauderer demands only rational basis review or something more, and we therefore refer to the standard as simply “deferential review.”
16 of 25 The customer data whose disclosure is compelled here serves a different
purpose entirely. It identifies people who have already ordered and gives the
restaurant the contact information needed to reach them, enabling the restaurant,
as the City puts it, “to generate more effective marketing.” Appellant’s Br. 36. That
may make the data commercially valuable, but it does not make the restaurant
better informed about Marketplace or the terms of Marketplace services.
* * *
For these reasons, Zauderer does not apply. 6
II. The Law Fails Intermediate Scrutiny
What, then, is the applicable level of scrutiny in this case? To start, the
Customer Data Law compels the Platforms to convey particular content that they
would not otherwise disclose. A regulation of that kind is “content[ ]based,”
regardless of the character of the speech it compels. Riley v. Nat’l Fed’n of the Blind
of N.C., Inc., 487 U.S. 781, 795 (1988) (“Mandating speech that a speaker would not
otherwise make necessarily alters the content of the speech.”). For content-based
6 Because we hold that customers’ personal information is not about the Platforms’ own goods or services, we need not and thus do not decide whether the Customer Data Law also satisfies Zauderer’s other requirements—whether the disclosure is “purely factual and uncontroversial,” “reasonably related to the State’s interest,” and not “unjustified or unduly burdensome.” Zauderer, 471 U.S. at 651.
17 of 25 regulations, the level of scrutiny turns on the kind of speech at issue: Commercial
speech receives intermediate scrutiny, Vugo, Inc. v. City of New York, 931 F.3d 42, 49
(2d Cir. 2019); noncommercial speech receives strict scrutiny, Nat’l Inst. of Fam. &
Life Advocs. v. Becerra, 585 U.S. 755, 766 (2018).
Even on the assumption most favorable to the City, that the Law regulates
only commercial speech, it fails Central Hudson’s more permissive review. See
Sorrell v. IMS Health Inc., 564 U.S. 552, 571 (2011) (explaining that “the outcome is
the same whether a special commercial speech inquiry or a stricter form of judicial
scrutiny is applied”); Evergreen Ass’n, Inc. v. City of New York, 740 F.3d 233, 245 (2d
Cir. 2014) (declining to decide whether intermediate or strict scrutiny applied
because the result was the same under both).
To satisfy intermediate scrutiny under Central Hudson, the Customer Data
Law must (1) “concern lawful activity and not be misleading,” (2) serve a
“substantial” governmental interest, (3) “directly advance[]” that interest, and (4)
be “not more extensive than is necessary to serve that interest.” Cent. Hudson, 447
U.S. at 566. No one disputes that the customer data concerns lawful activity and
is not misleading.
18 of 25 As for the second and third requirements, the City offers two interests. First,
the City seeks to support its restaurant industry, which it describes as central to
the City’s economic and cultural life. Second, it intends to protect restaurants from
what it views as an unfair competitive restraint—the Platforms’ use of
accumulated customer data to keep restaurants dependent on their platforms.
And according to the City, the Customer Data Law advances both interests in the
same way, by giving restaurants customer data with which to market directly to
their patrons. We need not address whether the asserted interests are in fact
substantial or whether the Law would directly advance them, because even
assuming those requirements were met, the Law fails at the final step.
The fourth step of Central Hudson “requires a reasonable fit between the
means and ends of the regulatory scheme.” Lorillard Tobacco Co. v. Reilly, 533 U.S.
525, 561 (2001). The fit need not be “perfect,” and the government need not adopt
the least restrictive means available. Vugo, 931 F.3d at 52 (quoting City of Cincinnati
v. Discovery Network, Inc., 507 U.S. 410, 416 n.12 (1993)). Indeed, the City has
“considerable leeway in determining the appropriate means to further a legitimate
government interest.” Id. at 58 (quoting Clear Channel Outdoor, Inc. v. City of New
York, 594 F.3d 94, 105 (2d Cir. 2010)). But that leeway does not reduce intermediate
19 of 25 scrutiny to rational basis review. Discovery Network, 507 U.S. at 417 n.13. The City
must still “affirmatively establish” that the Law’s scope is “in proportion to the
interest served.” Bd. of Trs. of State Univ. of N.Y. v. Fox, 492 U.S. 469, 480 (1989)
(quoting In re R.M.J., 455 U.S. 191, 203 (1982)). That inquiry considers whether the
City has “carefully calculated” the costs and benefits associated with the burden
on speech, as well as the existence of “numerous and obvious less-burdensome
alternatives.” Discovery Network, 507 U.S. at 417 & n.13.
The City has not carried its burden. Two features of the Law’s design, taken
together, extend its reach beyond what the City has established its interests
require. First, the Law “presume[s]” that every customer consents to having their
personal information shared. § 20-563.7(b). Second, the Law requires customers
who want to opt out of data sharing to do so on an order-by-order basis. Id. The
result is a marketing list that no customer asked to join and that none can be
confident they have permanently left. The City has offered no evidence that this
design serves its interests better than obvious, substantially less burdensome
alternatives would.
20 of 25 A. Presumed Consent
Under the Law, whenever a restaurant asks, the Platforms must deliver the
personal information of every customer who has ordered from that restaurant.
Each customer is “presumed to have consented” to the disclosure unless they opt
out, whether or not they ever want to hear from that restaurant again. § 20-
563.7(b).
The City could have required an opt-in instead, sharing only the contact
information of those who asked to be reached. One of the Platforms already uses
an opt-in model. Under certain data-sharing agreements, Uber Eats discloses
customer data to restaurants if, and only if, customers affirmatively opt in. An opt-
in requirement was also before the City Council. Platform representatives had
proposed an amendment while the bill was pending, under which a platform
“shall enable customers to consent via an opt-in to the sharing of their customer
data.” J. App’x 4438–39.
The City’s principal response is that any alternative to the Customer Data
Law, including an opt-in, “would likely result in less customer data being shared.”
Appellant’s R. Br. 27. But “customer data” is the very speech being compelled.
Therefore, any less burdensome alternative would by definition result in less data
21 of 25 being shared. See Tech:NYC Amicus Br. 18. Nor has the City established that its
asserted interests are advanced simply by maximizing the amount of customer
data shared. The City itself says that a small share of a restaurant’s customers—
its “loyal patrons”—generates an outsized share of its orders, and that data about
those customers is particularly valuable for “targeted marketing.” Appellant’s Br.
12. On the City’s own telling, then, the usefulness of customer data depends in
part on whose data is shared, not simply how much is shared.
Even if the City had shown that a presumption of consent is more effective
than an opt-in, “[t]he question is not whether the [regulation] is the most effective
disposition or is more effective than proposed alternatives.” Art & Antique Dealers
League of Am., Inc. v. Seggos, 121 F.4th 423, 442 (2d Cir. 2024). Rather, it is whether
the “scope [of the regulation] is in proportion to the interest served.” Id. (quoting
Long Island Bd. of Realtors, Inc. v. Village of Massapequa Park, 277 F.3d 622, 627 (2d
Cir. 2002)). For that reason, if the government imposes “an extraordinarily severe
restriction on speech” when “a much less intrusive alternative would have been
nearly as effective in achieving [its] asserted interest,” the requisite “fit between
the restriction and the interest” may be lacking. Id. The City must show that its
22 of 25 asserted interests would not be “adequately served by other measures that would
be less burdensome.” Id.
The City has not made that showing. An opt-in would withhold from
restaurants only the data of customers who had not affirmatively agreed to share
it. Perhaps outreach to those customers would generate repeat orders often
enough to advance the City’s asserted interests. Perhaps it would instead be
ignored, deleted, or blocked as spam. The City offered no evidence either way.
Compare N.Y. State Ass’n of Realtors, Inc. v. Shaffer, 27 F.3d 834, 843–44 (2d Cir. 1994)
(holding that a neighborhood-wide ban on real estate solicitation failed Central
Hudson’s final step because the State had offered “no evidence of any kind” that a
“narrower, resident[-]activated measure” was inadequate), with Anderson v.
Treadwell, 294 F.3d 453, 462 (2d Cir. 2002) (later holding the same resident-activated
registry satisfied Central Hudson’s final step because its reach was “precisely co-
extensive” with the homeowners who had asked not to be solicited). To be sure,
the City argues that restaurants’ need for customer data is “self-evident” and a
matter of “common sense.” Appellant’s R. Br. 24. But such conjecture does not
“affirmatively establish” why consent must be presumed. Fox, 492 U.S. at 480.
23 of 25 B. Repeated Opt-Outs
Even when a customer does opt out, that refusal does not last. A customer
who declines to consent on Monday’s order is “presumed to have consented” on
Tuesday’s. § 20-563.7(b). The Law nowhere lets a customer opt out once and for
all. See J. App’x 420 (the City admitting that customers “must opt out of sharing
each time they place an online order . . . otherwise, the Customer Data will be
shared”); id. at 945 (report opposing the bill while it was pending, warning that it
“does not permit consumers to opt-out of data sharing generally and
permanently”).
The City could have kept a presumption of consent and let a customer’s
refusal stand until withdrawn. A standing opt-out would thus deny restaurants
only the data of customers who refused once and kept ordering. Without deciding
whether such a statute would survive intermediate scrutiny, we observe that a
standing opt-out regime could still advance the City’s asserted interests while
compelling less speech. The City responds that customers who keep ordering
from a restaurant are among those “most receptive to communications.”
Appellant’s Br. 53. But a new order shows continued interest in the restaurant’s
food, not necessarily a change of mind about sharing personal information or
24 of 25 being solicited. Beyond saying that any alternative would result in less data
shared (i.e., less speech compelled), the City identifies no reason, and offers no
evidence, as to why customers must repeat the same refusal with every single
order. See Fox, 492 U.S. at 480.
* * *
For these reasons, the Customer Data Law fails intermediate scrutiny.
CONCLUSION
We hold that the Customer Data Law violates the First Amendment as
applied to the Platforms’ Marketplace products. Zauderer’s deferential review
does not apply to the Law because the Law compels the disclosure of information
about third parties who use Marketplace, not information about Marketplace
itself. The Law must therefore satisfy at least intermediate scrutiny under Central
Hudson. It fails that standard because the City has not carried its burden to
establish a reasonable fit between its asserted interests and the means the Law
employs to advance those interests.
The judgment of the district court is AFFIRMED.
25 of 25 25-81 DoorDash, Inc. v. City of New York
PARK, Circuit Judge, concurring:
Today’s opinion correctly concludes that New York City’s Customer Data
Law is unconstitutional because the City fails to establish a “reasonable fit between
the means and ends of the regulatory scheme.” Lorillard Tobacco Co. v. Reilly, 533
U.S. 525, 561 (2001). The opinion focuses on two relatively technical aspects of the
Law—presumed consent and order-by-order opt-outs—that fail under the fourth
prong of Central Hudson Gas & Electric Corp. v. Public Service Commission of New
York, 447 U.S. 557 (1980). I agree with the opinion in full but write separately to
note a deeper problem.
The Law compels speech for nothing more than economic favoritism. The
City’s stated goal is to “support the restaurant industry” by requiring delivery
platforms to disclose valuable customer data to restaurants. Appellant’s Br. 1. The
Law’s sponsor explained that the objective was to “strike the right balance and
equity between” platforms and restaurants and to “give” restaurants “a better
opportunity to compete.” Joint App’x 661 (Transcript of June 8, 2021 Hearing of
New York City Council Committee on Consumer Affairs and Business Licensing).
1 of 3 A vague desire to support an industry comprised of tens of thousands of
stores is not the type of interest that can justify abridging the freedom of speech of
disfavored competitors. Under Central Hudson, we “ask whether the asserted
governmental interest is substantial.” 447 U.S. at 566. To determine which
interests qualify as substantial in the compelled commercial disclosure context,
“history and tradition are reliable guides.” Am. Meat Inst. v. U.S. Dep’t of Agric.,
760 F.3d 18, 31 (D.C. Cir. 2014) (en banc) (Kavanaugh, J., concurring in the
judgment). For example, the “Government has long required commercial
disclosures to prevent consumer deception or to ensure consumer health or
safety,” and “[t]hose interests explain and justify” compelled disclosures like
“nutrition labels and health warnings.” Id. But here, the City does not even offer
consumer protection as a pretext (nor could it because the Law would actually
harm consumers by disclosing their personally identifiable information without
consent, see ante at 21–25).
In Safelite Group, Inc. v. Jepsen, 764 F.3d 258 (2d Cir. 2014), we enjoined the
enforcement of a statute that was “highly likely to further covertly protectionist,
rather than consumer information, goals” “by protecting” certain businesses
against others. Id. at 259, 264. The Law here similarly—but overtly—seeks to
2 of 3 advance protectionist goals by requiring delivery platforms to turn over valuable
data for the sole aim of supporting restaurants. I do not think that is a substantial
governmental interest under Central Hudson.
3 of 3