[Enforcement library](/enforcement)

# DoorDash: check the data exchanges beyond your website

You can find data transfers that a browser test misses. DoorDash’s 2024 settlement concerns a customer-data exchange through a marketing cooperative.

California DOJ · CCPA and CalOPPA · Settlement announced 21 February 2024

- Case record
- What happened
- Technical behaviour
- Checks for your own systems
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Authority | California Department of Justice (DOJ) |
| Entity | DoorDash, Inc. |
| Jurisdiction and law | California, US · California Consumer Privacy Act (CCPA) and California Online Privacy Protection Act (CalOPPA) |
| Action | Settlement announced with a proposed stipulated judgment |
| Announced | 21 February 2024 |
| Amount | USD 375,000 civil penalty |
| Source review | 16 October 2026 |

The announcement states that the proposed judgment remained subject to court approval at that time. This review does not establish a later court-entry date. [DOJ announcement](https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-doordash-investigation-finds-company)

## What happened

The DOJ alleged that DoorDash exchanged customers’ personal information without notice or a way to opt out. It alleged breaches of the CCPA and CalOPPA. [Complaint](https://oag.ca.gov/system/files/attachments/press-docs/DoorDash%20Complaint.pdf)

The announced settlement sets a USD 375,000 civil penalty. Its terms cover vendor reviews, compliance controls, and reports to the Attorney General. [Proposed judgment, paragraphs 21–26](https://oag.ca.gov/system/files/attachments/press-docs/DoorDash%20Stip%20Judgment%20.pdf)

## Technical behaviour

The DOJ described a January 2020 transfer of names, addresses, and transaction histories to a marketing cooperative. DoorDash received access to other businesses’ customers in exchange. The DOJ alleged that this exchange counted as a sale under the CCPA. [DOJ announcement](https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-doordash-investigation-finds-company)

Inth’s technical interpretation: a data sale does not need to start with a website pixel or a cash payment. Batch exports and vendor exchanges need their own review.

## Checks for your own systems

### In the repository

- Find batch exports, customer-list uploads, and vendor integrations.
- Trace which fields each export sends.
- Find the choice that permits or blocks each transfer.
- Check whether later exports respect an opt-out.

### In the browser and network

- Record the destinations that a test browser can show.
- Compare them with the server-side export list.
- Test an opt-out with invented records in a test environment.
- Check the next export for the expected result.

### With the people responsible for data use

- List what the organisation receives in return for each exchange.
- Compare the data uses with the notices and signed contracts.
- Ask counsel to assess whether each exchange is a sale under the relevant law.

## Sources and limits

[DOJ announcement, 21 February 2024](https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-doordash-investigation-finds-company) · [Complaint](https://oag.ca.gov/system/files/attachments/press-docs/DoorDash%20Complaint.pdf) · [Proposed stipulated judgment](https://oag.ca.gov/system/files/attachments/press-docs/DoorDash%20Stip%20Judgment%20.pdf).

Source review: 16 October 2026. This page describes the settlement as announced. It does not establish later court entry, payment, or DoorDash’s current practices.

Inth wrote these technical checks. They cannot decide which laws apply or prove compliance with a law or contract. Browser captures cannot show all server operations.

Related: [Sephora and data transfers](/enforcement/sephora) · [Healthline and event data](/enforcement/healthline).

[Consent banner](/consent-banner) · [Website audit](/website-audit) · [Code audit](/code-audit)