Cross-Context Behavioral Advertising Data Sharing

What it is

Grubhub shares your personal identifiers and purchase history with advertising networks and partner companies so they can show you targeted ads and use your data for their own analytics. This applies to your name, email, order history, and browsing behavior on the platform.

Why it matters (compliance & governance perspective)

This sharing arrangement means your Grubhub activity can influence ads you see on completely unrelated websites and apps, and third-party partners may retain and use your data under their own separate privacy policies, which Grubhub does not control.

Consumer impact (what this means for users)

Your order history, identifiers, and browsing behavior on Grubhub may be shared with ad networks and partner companies for targeted advertising, potentially resulting in ads that follow you across the internet based on your food ordering habits.

What you can do

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: This provision implicates CCPA/CPRA, which defines sharing personal information with third parties for cross-context behavioral advertising as a 'share' subject to opt-out rights, regardless of monetary exchange. The California Privacy Protection Agency and California Attorney General enforce these requirements. The FTC Act governs the accuracy of representations about third-party data uses. Where trusted partner uses extend to their own business purposes, Grubhub's role may shift from controller to joint controller or independent controller depending on the arrangement, a distinction that engages GDPR if any EU users access the platform. 2) GOVERNANCE EXPOSURE: High. The sharing of identifiers and commercial information with ad networks for behavioral advertising purposes, combined with delegation of data governance to partners' own privacy policies, creates meaningful compliance exposure. If opt-out mechanisms are not honored or are difficult to locate, this may constitute a violation of CCPA/CPRA's opt-out requirements. The statement that partner uses are governed by partners' own policies limits Grubhub's stated accountability for downstream data use. 3) JURISDICTION FLAGS: California residents have the strongest legal protections, including the right to opt out of data sharing for cross-context behavioral advertising under CPRA. Colorado, Connecticut, Virginia, and Texas have enacted similar privacy laws with opt-out rights for targeted advertising. EU and UK users may have GDPR/UK GDPR rights that require a lawful basis for this sharing beyond the policy's current framing. 4) CONTRACT AND VENDOR IMPLICATIONS: Data processing agreements with ad network and trusted partner recipients should specify the permitted purposes, data minimization obligations, and prohibition on onward sharing. The policy's delegation of governance to partners' own policies may not satisfy CCPA/CPRA's contractual requirements for third-party recipients. Procurement teams should audit whether current vendor contracts include required CCPA service provider or third-party contract clauses. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that the opt-out mechanism for data sharing for behavioral advertising is prominently displayed, technically functional, and honored within 15 business days as required by CCPA. Annual review of the categories of data shared and the identity of advertising partners should be conducted. Data mapping should link each data category shared to specific ad network recipients and document the legal basis for each sharing arrangement.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Sensitive Personal Information Collection and Use medium
• Precise Geolocation Data Collection medium
• Data Retention Policy medium
• Campus User Data Sharing with Food Service Providers medium
• Children's Data and Age Restriction low
• California Privacy Rights and Opt-Out Mechanisms medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.