Key Facts
Can DoorDash guarantee that your Personal Information is absolutely secure?
DoorDash states that it is not able to guarantee that your Personal Information is absolutely secure, because no Internet or email transmission is ever fully secure or error free.
Why is no Internet or email transmission ever fully secure or error free?
DoorDash states that it is not able to guarantee that your Personal Information is absolutely secure, because no Internet or email transmission is ever fully secure or error free.
What does DoorDash state a user's purchase history of health-related products may indicate?
DoorDash states that a user's purchase history of health-related products through its Services may indicate information regarding that user's health status, including contraceptives, at-home diagnostic tests, and diabetic testing supplies.
May Personal Information processed under DoorDash's Policy be stored, accessed, and processed outside the jurisdiction where the user lives?
DoorDash states that Personal Information processed under its Policy may be stored, accessed, and processed on systems and servers—and by persons and parties—located outside the jurisdiction where the user lives, including in the United States and other global locations.
May DoorDash use third-party marketing and advertising partners to deliver advertising to users?
DoorDash may use third-party marketing and advertising partners to deliver advertising to users on behalf of DoorDash and/or its Merchants, including advertising personalized based on users' interactions with DoorDash's Services and their activity on third-party services.
Can third-party marketing and advertising partners deliver personalized advertising based on users' interactions with DoorDash's Services?
DoorDash may use third-party marketing and advertising partners to deliver advertising to users on behalf of DoorDash and/or its Merchants, including advertising personalized based on users' interactions with DoorDash's Services and their activity on third-party services.
Who is solely liable and responsible for all communications initiated or sent by the Merchant to the user?
DoorDash states that the Merchant is solely liable and responsible for all communications initiated or sent by the Merchant to the user.
What may DoorDash receive and store if the user has consented by enabling location access?
DoorDash may receive and store a user's precise location information—including when its apps are running in the foreground or background of the user's device—if the user has consented by enabling location access.
Does DoorDash receive precise location information when its apps are running in the background if the user has consented?
DoorDash may receive and store a user's precise location information—including when its apps are running in the foreground or background of the user's device—if the user has consented by enabling location access.
What does DoorDash not use sensitive Personal Information for?
DoorDash does not use sensitive Personal Information for purposes other than as reasonably expected by an average consumer to provide its Services, for legal, security, and safety purposes, and without the purpose of inferring characteristics.
Summary
DoorDash's Privacy Policy explains what personal data it collects—including your location (even when the app runs in the background), purchase history that may reveal health-related information, and your contacts' ordering behavior—and how it uses that data to deliver and advertise its services. Your information may be stored and processed outside your home country by DoorDash and its service providers, and DoorDash cannot guarantee absolute security of your data. If you want to stop DoorDash from selling or sharing your Personal Information for targeted advertising, you can use the designated opt-out link on doordash.com.
Analysis
This Privacy Policy establishes DoorDash's collection, use, sharing, and retention of Personal Information across its Services. DoorDash collects data including precise location (including background tracking when consented), purchase history that may constitute sensitive health information, and contact sync data used to generate merchant recommendations. Personal Information is used for service delivery, legal and safety purposes, and advertising on both DoorDash's own Services and third-party websites and platforms, while sensitive Personal Information is limited to uses reasonably expected by an average consumer without characteristic inference. The Policy discloses cross-border data processing by DoorDash and its service providers across a non-exhaustive set of jurisdictions, disclaims absolute security guarantees, shifts all liability for Merchant-originated communications solely to Merchants, and provides users a designated opt-out mechanism on doordash.com for the sale or sharing of Personal Information for targeted advertising.
What this means for you
As a DoorDash user, your Personal Information—including precise location data collected even while the app runs in the background, purchase records that may reveal health-related details, and inferences drawn from your contacts' ordering behavior—is used by DoorDash to personalize advertising displayed on its own Services and on third-party websites and platforms. Your data may be stored and processed in countries outside where you live, where different legal protections may apply, and DoorDash explicitly does not guarantee absolute security of that information. If you want to stop DoorDash from selling or sharing your Personal Information for targeted advertising, you can exercise that right by using the designated opt-out link on doordash.com.
2 important changes detected
3 versions captured · Last updated: July 2026
What changed
DoorDash updated its California privacy reporting metrics on July 2, 2026, shifting the annual reporting period from January-December 2024 to January-December 2025. The updated metrics show increases in access requests (11,421 to 11,576), deletion requests (108,827 to 158,098), and opt-out requests (15,597 to 32,664) received during the new reporting year. The median response time for completed requests remained 21 days, though the company now reports 'less than 1 day' for certain unfulfilled requests on other grounds.
Why this matters
The updated policy reflects California consumer data access, deletion, and opt-out request metrics for 2025. The reported numbers show increased requests across all categories compared to 2024: access requests increased to 11,576, deletion requests to 158,098, and opt-out requests to 32,664. The median response time for completed access and opt-out requests remained 21 days. This disclosure does not establish new rights or obligations for consumers; it provides factual reporting on requests already processed under California privacy law.
View full change record →
What changed
DoorDash's privacy policy was reformatted on May 11, 2026, with changes to the document's structural organization. Section headings were moved from standalone numbers (III, IV, V, VI) to inline positions with their corresponding titles. The Device Information disclosure remained substantively the same but was repositioned in the document. These are primarily formatting and organizational changes with no material alteration to what data DoorDash collects, uses, or discloses.
Why this matters
The updated policy retains all substantive privacy disclosures. The reformatting of section headings from standalone numbers to inline titles does not alter what personal information DoorDash collects, how it uses that information, or what choices remain available to users. Your ability to turn off precise location sharing, for example, continues to be available under the revised structure.
View full change record →