Campus User Data Sharing with Food Service Providers

What it is

If you use Grubhub through a university or campus program, Grubhub may share your name, email, and other identifiers directly with campus food service providers so they can market to you independently.

Why it matters (compliance & governance perspective)

Campus users, who may include college students, are subject to a distinct data sharing arrangement with campus-specific food service operators that goes beyond what standard users experience, and these providers will contact them directly using Grubhub-provided data.

Consumer impact (what this means for users)

If you are a campus Grubhub user, your personal identifiers may be shared with third-party food service companies on your campus, who can then contact you directly with marketing, governed by their own privacy practices rather than Grubhub's.

What you can do

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: If campus users include students under 18, COPPA and FERPA may require evaluation depending on the institution type and the nature of the platform access. The FTC Act governs the accuracy of representations about the campus-specific sharing arrangement. CCPA/CPRA opt-out rights apply to California-based campus users for this sharing if it constitutes a sale or share for advertising purposes. 2) GOVERNANCE EXPOSURE: Medium. The campus-specific carve-out creates a distinct data sharing stream not present in the standard user arrangement, requiring separate opt-out mechanisms and clear disclosure to campus users at the point of enrollment. If campus users are minors or if the arrangement involves educational records, additional regulatory frameworks may be implicated. 3) JURISDICTION FLAGS: California campus users retain CCPA/CPRA rights regarding this sharing. If any campus partner programs involve K-12 or university students whose records are subject to FERPA, Grubhub's sharing of identifiers with food service providers may require evaluation under FERPA's disclosure restrictions. Illinois and other states with stricter data sharing rules may also apply. 4) CONTRACT AND VENDOR IMPLICATIONS: Agreements with campus food service providers receiving student/campus user identifiers should specify permitted use cases, prohibit further sharing, and include data deletion obligations. Grubhub's enterprise agreements with universities should disclose the downstream sharing arrangement with food service operators to ensure institutional partners are aware of the data flow. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should confirm that campus users receive clear, conspicuous notice of this distinct sharing arrangement at the time of account creation or first use through campus channels, and that an accessible opt-out is available. If minors participate in campus programs, age verification and COPPA compliance mechanisms should be reviewed.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Cross-Context Behavioral Advertising Data Sharing medium
• Sensitive Personal Information Collection and Use medium
• Precise Geolocation Data Collection medium
• Data Retention Policy medium
• Children's Data and Age Restriction low
• California Privacy Rights and Opt-Out Mechanisms medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.