DoorDash, Inc. (Nasdaq: DASH) operates a food and retail delivery marketplace whose US privacy policy (effective January 3, 2023) discloses collection of precise device location while its apps run in the foreground or background, technical identifiers, order history, and demographic data from third parties, along with tracking via cookies, web beacons, pixels, and session replay/screen capture technology. The company runs an advertising platform marketed to restaurants and CPG brands using shopping behavior across its ecosystem, and its policy describes sharing personal and transactional information with business partners for ad measurement, with an opt-out of sale/sharing offered to users. In February 2024, the California Attorney General announced the state's second CCPA enforcement settlement against DoorDash over the sale of customer data through a marketing cooperative; the company has also disclosed data incidents in 2019 (4.9 million people), 2022, and 2025. It is SEC-filed with a clearly documented multi-class ownership structure and operates a privacy center offering access, deletion, and opt-out tools to all consumers.
TRACK RECORD
1 BREACH · 1 ENFORCEMENT ACTION
BREACH LEDGER
[2022-08-02] · BREACH
Have I Been Pwned lists a breach record for DoorDash: "DoorDash".
Approximately 367,476 accounts affected, per HIBP.
On February 21, 2024, California Attorney General Rob Bonta announced a settlement with DoorDash — the office's second CCPA enforcement settlement — under which DoorDash agreed to pay a $375,000 civil penalty and comply with injunctive terms including reviewing vendor contracts and providing annual reports to the Attorney General on any sale or sharing of consumer personal information.
DoorDash's Canadian consumer privacy policy (effective October 15, 2021) discloses that the company may collect biometric information, for example from a user's government-issued photo identification, to process age-restricted orders and verify identity.
DoorDash's US privacy policy (effective January 3, 2023) states that, if the user grants location permission, DoorDash may collect and store the precise location of the user's device when its apps are running in the foreground or background, in addition to general location, route information, and delivery pick-up/drop-off information.
DoorDash, Inc. is a US public company whose Class A common stock trades on the Nasdaq Stock Market under the symbol DASH; its FY2025 Annual Report on Form 10-K (filed February 18, 2026) discloses a multi-class share structure and a voting agreement among co-founders that concentrates voting power with CEO Tony Xu.
DoorDash maintains a consumer privacy center stating that users have the right to opt out of the sale or sharing of personal information and targeted advertising via a 'Do Not Sell or Share My Personal Information' link and in-app ad-personalization toggle, and that account deletion is offered to all consumers regardless of jurisdiction.
DoorDash's US privacy policy (effective January 3, 2023) states that the company may share personal and transactional information about users with service providers, processors, and business partners for ad-insight and ad-effectiveness measurement, and describes using personal information for look-alike modeling to advertise on third-party platforms.
A California Department of Justice investigation found that in January 2020 DoorDash sold its California customers' personal information — including names, addresses, and transaction histories — to a marketing cooperative without providing notice or an opportunity to opt out, in violation of the CCPA and CalOPPA, according to the Attorney General's February 21, 2024 settlement announcement.
In an August 2022 disclosure, DoorDash stated that a third-party vendor was compromised by a sophisticated phishing attack and that the unauthorized party used stolen vendor-employee credentials to access DoorDash internal tools, exposing consumer names, email addresses, delivery addresses, and phone numbers, and for a smaller set of consumers basic order information and partial payment card data.
DoorDash confirmed in a September 2019 blog post that an unauthorized third party accessed user data on May 4, 2019 via a third-party service provider, affecting approximately 4.9 million consumers, Dashers, and merchants who joined on or before April 5, 2018, including names, email addresses, delivery addresses, order history, phone numbers, hashed passwords, and driver's license numbers of about 100,000 Dashers.
Have I Been Pwned's breach catalog lists the "DoorDash" incident (doordash.com), breach date 2022-08-02, affecting approximately 367,476 accounts. Data classes exposed per HIBP: Email addresses, Geographic locations, Names, Partial credit card data. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
On February 21, 2024, California Attorney General Rob Bonta announced a settlement with DoorDash — the office's second CCPA enforcement settlement — under which DoorDash agreed to pay a $375,000 civil penalty and comply with injunctive terms including reviewing vendor contracts and providing annual reports to the Attorney General on any sale or sharing of consumer personal information.
On November 17, 2025, DoorDash disclosed a data breach affecting an unspecified number of customers, delivery workers, and merchants, exposing names, email addresses, phone numbers, and physical addresses; the company stated no sensitive information was accessed and it had no indication of misuse at the time.
DoorDash operates an advertising platform, DoorDash Ads, marketed to restaurants and consumer packaged goods brands, which promotes targeting based on 'real shopping behavior' across DoorDash's retail ecosystem and cites a combined base of more than 56 million monthly active users (DoorDash, Wolt, and Deliveroo, as of September 2025).
DoorDash's US privacy policy (effective January 3, 2023) discloses use of cookies, web beacons, pixels, and session replay/screen capture technology, stating that session replay may collect real-time information on how users navigate the services, including mouse movements and scrolling (but not keystrokes).