Privacy Policy Consent by Use

What it is

By using DoorDash, you consent to the collection, use, and disclosure of your personal information as described in DoorDash's Privacy Policy, which is a separate document incorporated into these terms by reference.

Why it matters (compliance & governance perspective)

The terms authorize consent to data collection and disclosure through the act of using the Service, and users are also bound by additional policies published on the website or app even if those policies are not directly referenced in the agreement at the time of use.

Consumer impact (what this means for users)

This provision establishes that using the DoorDash platform constitutes consent to personal information handling practices described in a separate Privacy Policy document, and binds users to any additional policies published online without requiring direct notice or affirmative acceptance for each policy.

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision engages with the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), which impose specific requirements on consent mechanisms and disclosures for California residents. In the EU and UK, GDPR requires that consent be freely given, specific, informed, and unambiguous; consent obtained through a blanket 'by using this service you agree' mechanism may not meet GDPR standards for processing activities that require explicit consent. The FTC Act is relevant to any deceptive or materially misleading disclosures about data practices. Canadian PIPEDA and Quebec Law 25 impose consent requirements that may not be satisfied by implicit use-based consent. (2) GOVERNANCE EXPOSURE: Medium. The incorporation by reference of a separate Privacy Policy and 'any additional DoorDash terms or policies' creates a dynamic compliance scope; the specific obligations and permissions governing data collection are not fully enumerable from this document alone, and policy changes to the incorporated documents may alter user obligations without requiring a new affirmative consent event under the terms as written. (3) JURISDICTION FLAGS: California residents have specific rights under CCPA/CPRA including the right to opt out of sale or sharing of personal information, the right to deletion, and the right to correction; these rights are exercised through mechanisms described in the Privacy Policy rather than these terms. EU and UK residents may have rights under GDPR that supersede the consent mechanism described here. Quebec residents have rights under Law 25 that may require more specific consent practices. (4) CONTRACT AND VENDOR IMPLICATIONS: Organizations using DoorDash's platform on behalf of employees or customers should confirm that their data processing agreements with DoorDash address the transfer and processing of any personal data of their constituents. The broad incorporation of 'additional policies' without enumeration may create ambiguity in B2B data processing agreements. (5) COMPLIANCE CONSIDERATIONS: Data privacy teams should review the current DoorDash Privacy Policy in conjunction with these terms to map all categories of personal information collected, the stated purposes, and third-party sharing arrangements. Teams should assess whether the implied consent mechanism in Section 4 is sufficient for all processing activities under applicable law, particularly for California and Canadian residents. Any changes to the incorporated Privacy Policy should trigger a review of consent adequacy.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Mandatory Arbitration and Class Action Waiver high
• DashPass Subscription Terms medium
• Disclaimer of Warranties medium
• Limitation of Liability medium
• User Content License medium
• Age Restriction low