, 15 June 2021

Should you care that these much-loved food delivery apps gather the data that they do?

Even if you weren’t super into takeout before the pandemic, chances are you’ve upped your delivery in the past year. I get it! Cooking gets tedious and boring and we’ve all needed to — literally — spice up our lives while homebound. I know that in my household, takeout has become a much more regular occurrence than I’d probably occur.

But whatever. We all deserve to give ourselves and others some grace right now. But should we be giving food delivery apps grace, too? For this week’s What Does the Internet Know About Me?, I’m going to take a look at DoorDash and GrubHub/Seamless, two of the bigger food delivery app services here in the US. (GrubHub owns Seamless, so I’m batching them together.) I already know that they know I love Chinese food. Let’s see what else they’ve got.

What does DoorDash track? What does GrubHub track?

Both delivery services collect a couple of obvious things that are necessary for them to, you know, bring food to my house. They know my name, my email address, phone number, address, and information about my payment method (i.e. credit card info or PayPal). 

DoorDash specifically says in their Privacy Policy that they know the items I’ve purchased and when, any special instructions, and the payment method used, but GrubHub doesn’t mention that in theirs. It seems odd — they kind of have to know that information to get me my food, right? — but I’m not sure there’s a strong conclusion to draw from that omission. They do mention, however, that they also know of any communications with them directly or with their “Delivery Partners.”

On the technical side, DoorDash is definitely watching me. They “use cookies, web beacons, pixels, session replay/screen capture, and similar technologies to collect information and personalize [my] experience with [their] Services.” They also use “session replay technology” to “collect real-time” information about how I interact with the app, including how I scroll it. They’re careful to note that they don’t record keystroke data. 

If I access their service through a website instead of my phone (which isn’t a thing I do) or the app on my phone, they also “collect information to better understand customer traffic patterns and Site usage.” That includes the website I visited before visiting their site or app, which parts of the site or app I visited and how much time I spent there. 

If I log in with a third party account, like Facebook, DoorDash will exchange information with that service too. They would also access my phone’s phone book for referrals, if I let them. (Which I don’t.) Finally, they track me across different devices “to better tailor content and features” and provide a “seamless experience.”

And speaking of seamless! (See what I did there?) In addition to the obvious stuff listed above, GrubHub/Seamless tracks transaction info, any communications done in-app or via phone or mail, location information, information about my device(s) and software, and analytics info, including through third party services like Google Analytics. 

But perhaps the creepiest thing that Seamless/GrubHub does is track the exact location of your phone. From their Privacy Policy:

“If you have previously opted into Grubhub’s collection and use of location-based information through our mobile application, we may collect and store the precise location of your device when the app is running in the foreground or background of your device.”

Yikes. That means that if you don’t opt out of location tracking on your phone, they potentially know where you are at all times. 

What do DoorDash and GrubHub do with my data?

Both DoorDash and GrubHub need some — to be fair, kind of a lot — of the data they collect in order to tell me what restaurants are nearby and then to deliver my food when I order it. They also have a legitimate interest in learning my likes and recommending similar restaurants in the future. Realistically, the nature of the business of a food delivery app means that they’re going to have to collect a lot of data about me.

However, I do think they step a bit over the line with the technical information they collect. I can see the business argument for it — I’m sure there’s a justification for why they need to know where I am at all times — but I just don’t think it’s valid. I don’t think they need to track as much of the technical information about me as they do, and I don’t like the ways they use it outside of getting food from local businesses to my house. Namely: third-party advertising. And they’re pretty broad about that. From GrubHub’s Privacy Policy:

“We work with third-party Ad Networks and Advertising Partners to deliver advertising and personalized content to you on our Platform and Services, on other sites and services you may use, and across other devices you may use. These parties may collect information directly from your browser or device when you visit the Platform through cookies or other tracking technologies. This collected information is used to provide and inform targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics and market research.” 

And while GrubHub doesn’t give instructions on how to opt out of data collection for third party advertising, DoorDash, on the other hand, does so directly in their Privacy Policy. That’s a point in their favor from me. 

Should I care that food delivery apps gather so much data?

I’m bummed out by this investigation because, like all millennials, I like the convenience of ordering on an app — and not having to talk to a person on the phone. (Although honestly, as I’ve gotten older, the talking on the phone thing is less of an issue.) But the many, many ways GrubHub and DoorDash track me definitely has me concerned. Is it worth that much data being sucked up about me just for a slightly easier ordering experience?

Add on the fact that it became very clear during the pandemic just how big of a cut these food delivery apps take — and how shady some of their business practices are — and I think I might go back to ordering on the phone. 

That, or I’ll make my partner order using apps on his phone. Then it’s his info being collected, not mine. (Kidding. Or am I?)