Grubhub Privacy Policy

This Privacy Policy, effective January 5, 2026, governs the collection, use, disclosure, and processing of personal information by Grubhub Holdings Inc. and its subsidiaries in connection with its Platform and Services, including websites, mobile apps, APIs, and in-store kiosks. The policy states that Grubhub collects a broad range of personal information categories including identifiers, payment data, commercial/purchase history, internet usage and browsing behavior, geolocation data, inferences, audio/visual data, and sensitive personal information; the terms authorize sharing of identifiers and commercial information with ad networks and advertising partners for cross-context behavioral advertising, and with third-party trusted partners for marketing and internal business purposes. Notably, the policy asserts that sharing identifiers and commercial information with ad networks for cross-context behavioral advertising may constitute a 'sale' or 'sharing' under California law, which the policy acknowledges by providing opt-out mechanisms; the document explicitly carves out payment information and sensitive personal information from advertising-related sharing, and states that text messaging opt-in data is not shared with third parties. The policy engages CCPA/CPRA frameworks for California residents, COPPA considerations for users under 13 (who are prohibited from using the platform), and interacts with FTC Act consumer protection standards governing deceptive data practices; state-level biometric and geolocation privacy laws may also require evaluation depending on where Grubhub operates. Material compliance considerations include the accuracy and timeliness of the opt-out mechanisms for behavioral advertising, the adequacy of consent mechanisms for sensitive data categories including precise geolocation and health-related inferences, and the sufficiency of data retention disclosures relative to applicable state law requirements.