Internet Usage and Behavioral Tracking

What it is

Grubhub tracks how you browse the app and website, what you search for, which ads you see and click, and works with outside analytics and advertising companies that use cookies and similar tools to track you as well.

Why it matters (compliance & governance perspective)

Third-party tracking technologies operated by analytics and advertising partners collect behavioral data independently and may combine it with information they hold about you from other sources, extending the data profile beyond what Grubhub alone controls.

Consumer impact (what this means for users)

Your browsing behavior, search activity, and ad interactions on Grubhub are tracked both by Grubhub and by third-party advertising and analytics companies using cookies and similar technologies, which may result in a behavioral profile used for targeted advertising across the internet.

What you can do

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: The use of third-party tracking technologies for behavioral advertising engages CCPA/CPRA opt-out obligations for sale and sharing of personal information via tracking pixels and cookies. The FTC Act governs the accuracy of disclosures about third-party data collection. The EU ePrivacy Directive (Cookie Law) and GDPR apply if any EU users access the platform, requiring consent for non-essential cookies. The FTC has issued guidance on disclosures for interest-based advertising. 2) GOVERNANCE EXPOSURE: Medium. Third-party tracking integrations create data flows that may not be fully within Grubhub's direct control, creating compliance exposure if third-party partners use data beyond disclosed purposes. The policy's acknowledgment of third-party cookie use but delegation of governance to those partners' policies limits Grubhub's stated accountability. 3) JURISDICTION FLAGS: California residents have the right to opt out of tracking-based data sale and sharing under CPRA, including via the Global Privacy Control signal. EU/UK users accessing the platform may have GDPR/UK GDPR rights requiring affirmative consent for non-essential cookies. Colorado, Connecticut, and Virginia residents have opt-out rights for targeted advertising enabled by tracking technologies. 4) VENDOR IMPLICATIONS: Grubhub's contracts with analytics and advertising partners using tracking technologies should specify that data collected via these tools is used only for disclosed purposes and not for independent profiling or onward sharing. Cookie consent management platforms should be audited to confirm accurate categorization of tracking technologies as functional, analytics, or advertising. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit the platform's cookie consent mechanism to confirm that non-essential tracking technologies are not activated prior to user consent or opt-out, consistent with state requirements. The Global Privacy Control signal should be tested for proper recognition. A current cookie inventory mapping each third-party tracker to its data use purpose and recipient should be maintained.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Cross-Context Behavioral Advertising Data Sharing medium
• Sensitive Personal Information Collection and Use medium
• Precise Geolocation Data Collection medium
• Data Retention Policy medium
• Campus User Data Sharing with Food Service Providers medium
• Children's Data and Age Restriction low

Related Analysis

• Netflix Updated Terms Authorize Voice Data Collection: April 2026

  Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.

• What Google Actually Knows About You

  Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.