New York City recently amended its law governing third party delivery services, with the changes going into effect December 27, 2021. The revised law specifically permits restaurants to ask for customers’ personal information from the delivery service. The delivery service, in turn, must tell consumers about the potential sharing “in a conspicuous manner” on its website and give people the ability to opt-out of such sharing.  That notice needs to indicate that the person’s information will be shared with the restaurant, and needs to identify the restaurant.

If requested by the restaurant, the delivery service will need to provide the information on customer-specific, monthly basis and in a “machine-readable format.” Delivery services will need to scrub out anyone who has opted out.  Restaurants who receive information from the delivery services under this new law cannot sell or otherwise share the information unless they have gotten express consent from the customer. Restaurants also have to let customers opt-out of having their information used by the restaurants. The requirements do not apply to phone orders, and the law makes clear that both parties still need to comply with applicable laws.

The law has been criticized; indeed one delivery service has sued arguing that the provisions violate consumers’ privacy. The city, on the other hand, views this as a way to financially support restaurants in light of struggles resulting from the COVID pandemic. It has introduced this measure along with others in its changing approach to regulating food delivery.

Putting it Into Practice: Provided that there are no delays in implementation, restaurants operating in New York City will be able to ask delivery services for customer information starting December 27, to the extent that such requests are not already provided for in the contracts between the parties. Delivery services will need to prepare by making the requisite disclosures when collecting customer information.