Restaurant Data Demand Gets Torched By Courts

Photo: Ascannio / Shutterstock

The real significance of this ruling is not that New York City lost a case about food delivery; it is that the Second Circuit treated customer-data disclosure itself as a First Amendment problem when the state tried to make private platforms hand over personal information on demand. That moves the fight out of the ordinary lane of consumer regulation and into the far more restrictive world of compelled speech, where tailoring matters and governments must justify why they need the information in precisely that form.

Key Points

The Second Circuit invalidated New York City’s customer-data law on First Amendment grounds and affirmed the district court’s injunction.
The court treated the mandate as compelled disclosure about customers, not merely about the platforms’ own services.
The law’s order-by-order opt-out design was central to the constitutional defect the panel found.
The ordinance was written to give restaurants direct access to names, phone numbers, email addresses, delivery addresses, and order contents.

What the Law Required, and Why It Drew a Constitutional Knife

The ordinance at issue, Administrative Code section 20-563.7, required delivery platforms such as DoorDash, Grubhub, and Uber Eats to provide restaurants with customer names, telephone numbers, email addresses, delivery addresses, and order contents when the restaurant requested them. In policy terms, the City’s theory was easy to understand: restaurants should not be forced to depend permanently on intermediary apps, and they should be able to build direct customer relationships from transactions that originated on the platform. But constitutional law does not ask only whether a law has a plausible commercial purpose. It asks what kind of compulsion the law creates, what speech burden it imposes, and whether the government has chosen a means that actually fits the end.

That is where the City ran into the First Amendment. The Second Circuit held that the law compels disclosure of information about third parties who use Marketplace, not merely information about Marketplace itself, and on that basis Zauderer’s deferential review did not apply. In other words, the panel did not treat the ordinance as a routine disclosure rule attached to a company’s own business. It treated it as a forced transfer of customer information, with privacy and speech consequences that are materially different from ordinary labeling or advertising regulations.

The Court’s Core Theory: Compelled Disclosure, Not Neutral Transparency

The distinction matters because compelled-disclosure doctrine is not infinitely elastic. Zauderer, the commercial-speech case usually invoked to sustain disclosure mandates, is most comfortable when the government is requiring a company to reveal truthful information about its own product or service. Here, the court said the law went further: it forced the platforms to reveal private customer information to third parties, and that meant the more forgiving standard did not control. That is a significant doctrinal move. It signals that when a city tries to use transparency as a lever to redistribute bargaining power, the constitutional question turns on whose information is being disclosed and whose speech is being burdened.

The panel also focused on the structure of consent. Under the law, customers were presumed to have agreed unless they opted out, and that refusal had to be repeated order by order. Judge Richard Wesley’s opinion, as summarized by Reuters and other reporting, emphasized that the City offered no reason why a customer had to repeat the same refusal with every single order and pointed to less burdensome alternatives, including an opt-in design. That was not a decorative aside. It was the heart of the tailoring analysis: if the City’s actual objective was legitimate, the question became whether the City had chosen the least constitutionally damaging way to pursue it.

Why the Opt-Out Design Failed

At a practical level, the law’s opt-out structure flipped the privacy default. One order without a renewed refusal could release a customer’s name, phone number, email address, and delivery address to the restaurant. The court treated that as more than an administrative inconvenience. It described a regime in which the customer is presumed to have consented unless she keeps saying no, repeatedly, in a context where most people do not stop to renegotiate privacy settings on every transaction. That is precisely the kind of burden courts become skeptical of when the government’s stated interest can be served by a cleaner, less intrusive mechanism.

The City’s problem was not that it lacked a policy goal. Helping restaurants recover, compete, and reduce dependence on dominant platforms is a real municipal objective, and district-court summaries indicate that Judge Analisa Torres recognized that legitimacy even while rejecting the law. The problem was evidentiary and structural: the appellate record described here does not show that the City produced a persuasive factual case for why order-by-order repetition was necessary, why opt-in would not work, or why narrower disclosure would not satisfy the same commercial aims. In constitutional litigation, a good purpose is not enough when the means are clumsy and the burden lands on speech and privacy alike.

How the Case Fits a Larger Pattern in Platform Regulation

This decision belongs to a broader line of fights over platform regulation, privacy, and compelled speech. Cities and regulators increasingly use disclosure mandates to correct perceived power imbalances between digital intermediaries and the businesses or consumers who depend on them. Companies respond that the state is not merely regulating commerce; it is conscripting private actors to disseminate information they would otherwise keep within the transaction. The Second Circuit’s opinion places itself squarely in that contested space by treating customer information as constitutionally sensitive when the government requires its transmission to a third party.

That doctrinal posture has consequences beyond food delivery. If a city wants to require data sharing, it will now have to think carefully about whether the disclosure concerns the platform’s own conduct or a user’s private information; whether the default is consent or non-consent; and whether the government can demonstrate a genuine need for the particular disclosure architecture it has chosen. That is why this case matters even to readers who will never order lunch through an app. The opinion supplies a template for challenging privacy mandates that are framed as consumer protection but function, in practice, as compelled dissemination.

Learn out. Second Circuit blocks NYC food delivery app data-sharing law https://t.co/xGaYtz5agR #tech #digital #privacy #crypto #ai

— Kohei Kurihara – Privacy for all together 🌍 (@kuriharan) August 6, 2026

What the Ruling Does, and Does Not, Decide

This was an as-applied First Amendment ruling, not a universal declaration that governments can never require data sharing from digital platforms. The court invalidated this law as applied to the platforms’ Marketplace products and concluded that the Customer Data Law fails intermediate scrutiny because the City did not establish a reasonable fit between its asserted interests and the means the law employed. That leaves room for future regulation, but only if lawmakers can build a tighter record, choose a less burdensome structure, and show why the disclosure they want is actually necessary rather than merely convenient.

That distinction is crucial, because public commentary often turns a tailored constitutional ruling into a grand verdict on the policy itself. The better reading is narrower and more durable. The court did not say restaurants have no legitimate interest in customer relationships, nor did it say privacy concerns are imaginary. It said New York City chose a disclosure regime that crossed a constitutional line, in part because it made customer consent conditional, repetitive, and presumptive rather than real. In modern platform law, that is exactly the kind of failure that turns an ambitious regulatory idea into an unconstitutional mandate.