California residents have the legal right to see what personal data Grubhub has collected, ask for it to be deleted or corrected, and opt out of data sharing for advertising purposes, all by submitting a request online or by email.
This analysis describes what Grubhub's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
These are legally enforceable rights under California law, not just company policy, meaning Grubhub is required by law to honor requests within specific timeframes, including responding to opt-out requests within 15 business days.
If you are a California resident, you have enforceable rights to access, delete, correct, and opt out of data sharing for advertising, and you can exercise these rights by contacting Grubhub at privacy@grubhub.com or through the online request mechanism.
How other platforms handle this
California law gives residents the right to know what personal information we collect, use, share or sell; to delete personal information under certain circumstances; to opt-out of the sale or sharing of their personal information; to correct inaccurate personal information; to limit the use and dis...
If you are a California resident, you have the right to opt out of the sale or sharing of your personal information. You also have the right to know what personal information we have collected about you, the right to delete your personal information, the right to correct inaccurate personal informat...
If you are a California resident, you may have certain rights under the California Consumer Privacy Act (CCPA). These rights may include: the right to know about personal information collected, disclosed, or sold; the right to delete personal information collected from you; the right to opt-out of t...
Monitoring
Grubhub has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"California residents have specific rights regarding their personal information under CCPA/CPRA. These rights include the right to know, the right to delete, the right to correct, the right to opt-out of sale or sharing of personal information, and the right to limit the use of sensitive personal information. To exercise your rights, you may submit a verifiable consumer request through our privacy rights request mechanism or by contacting us at privacy@grubhub.com.— Excerpt from Grubhub's Grubhub Privacy Policy
1) REGULATORY LANDSCAPE: CCPA as amended by CPRA, enforced by the California Attorney General and the California Privacy Protection Agency, mandates these rights and requires responses to verifiable consumer requests within 45 days (extendable by an additional 45 days). Opt-out requests for sale and sharing must be honored within 15 business days. The Global Privacy Control signal must also be honored as an opt-out mechanism under California law. 2) GOVERNANCE EXPOSURE: Medium. Operational compliance with the verifiable consumer request process, including identity verification without creating excessive friction, is an area of active regulatory attention. The adequacy of the opt-out mechanism for Global Privacy Control signals and the timeliness of request responses are specific areas of enforcement focus by the California Privacy Protection Agency. 3) JURISDICTION FLAGS: Heightened exposure for California residents under CPRA. Colorado, Connecticut, Virginia, and Texas residents have similar opt-out and access rights under their respective state privacy laws. Non-California US users have more limited rights under the current policy framework. 4) CONTRACT AND VENDOR IMPLICATIONS: Grubhub must ensure that data deletion requests are cascaded to service providers and contractors who have received the user's personal information, as required by CPRA. Contracts with service providers should include deletion and correction obligation flow-downs. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit the verifiable consumer request process for friction, accuracy of disclosure, and response time compliance. The Global Privacy Control browser signal should be tested for recognition and proper opt-out processing. Annual privacy rights disclosure updates should reflect current data practices and category changes.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
These are legally enforceable rights under California law, not just company policy, meaning Grubhub is required by law to honor requests within specific timeframes, including responding to opt-out requests within 15 business days.
If you are a California resident, you have enforceable rights to access, delete, correct, and opt out of data sharing for advertising, and you can exercise these rights by contacting Grubhub at privacy@grubhub.com or through the online request mechanism.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Grubhub.