Skip to main contentDoorDash: check the data exchanges beyond your website
You can find data transfers that a browser test misses. DoorDash’s 2024 settlement concerns a customer-data exchange through a marketing cooperative.
Case record
| Fact | Record |
|---|---|
| Authority | California Department of Justice (DOJ) |
| Entity | DoorDash, Inc. |
| Jurisdiction and law | California, US · California Consumer Privacy Act (CCPA) and California Online Privacy Protection Act (CalOPPA) |
| Action | Settlement announced with a proposed stipulated judgment |
| Announced | 21 February 2024 |
| Amount | USD 375,000 civil penalty |
| Source review | 16 October 2026 |
The announcement states that the proposed judgment remained subject to court approval at that time. This review does not establish a later court-entry date. DOJ announcement
What happened
The DOJ alleged that DoorDash exchanged customers’ personal information without notice or a way to opt out. It alleged breaches of the CCPA and CalOPPA. Complaint
The announced settlement sets a USD 375,000 civil penalty. Its terms cover vendor reviews, compliance controls, and reports to the Attorney General. Proposed judgment, paragraphs 21–26
Technical behaviour
The DOJ described a January 2020 transfer of names, addresses, and transaction histories to a marketing cooperative. DoorDash received access to other businesses’ customers in exchange. The DOJ alleged that this exchange counted as a sale under the CCPA. DOJ announcement
Inth’s technical interpretation: a data sale does not need to start with a website pixel or a cash payment. Batch exports and vendor exchanges need their own review.
Checks for your own systems
In the repository
- Find batch exports, customer-list uploads, and vendor integrations.
- Trace which fields each export sends.
- Find the choice that permits or blocks each transfer.
- Check whether later exports respect an opt-out.
In the browser and network
- Record the destinations that a test browser can show.
- Compare them with the server-side export list.
- Test an opt-out with invented records in a test environment.
- Check the next export for the expected result.
With the people responsible for data use
- List what the organisation receives in return for each exchange.
- Compare the data uses with the notices and signed contracts.
- Ask counsel to assess whether each exchange is a sale under the relevant law.
Sources and limits
Source review: 16 October 2026. This page describes the settlement as announced. It does not establish later court entry, payment, or DoorDash’s current practices.
Inth wrote these technical checks. They cannot decide which laws apply or prove compliance with a law or contract. Browser captures cannot show all server operations.
Related: Sephora and data transfers · Healthline and event data.