Grubhub is a US food-delivery marketplace operated by Grubhub Holdings Inc.; its privacy policy (effective January 5, 2026) discloses collection of identifiers, precise and IP-based geolocation, payment data, order/commercial history, internet usage information, call recordings, age, and campus/education data, tracked via cookies, web beacons, embedded scripts, mobile SDKs, and third-party pixels (Google, Meta), with the App Store privacy label confirming location, contact info, identifiers, and usage data are used to track users across apps. The policy states Grubhub does not sell information 'in exchange for money' but shares identifiers, commercial information, and internet usage data with ad networks for cross-context behavioral advertising, and offers a universal 'Do Not Sell or Share' opt-out that does not require an account. Ownership has changed hands: Just Eat Takeaway.com's own releases record a definitive agreement on November 13, 2024 to sell Grubhub to the privately held Wonder Group, Inc. and completion of the sale on January 7, 2025; Wonder publishes no comparable investor or ownership disclosures of its own, so the current chain rests on the sellers' primary announcements. In December 2024, the FTC and Illinois Attorney General secured a $25 million settlement against Grubhub over deceptive earnings claims to drivers, blocked diner account/fund access, and unauthorized restaurant listings; as of August 2026 the FTC had distributed more than $23.8 million of that redress to affected drivers and diners. Separately, on February 3, 2025 Grubhub disclosed a third-party vendor security incident: unauthorized access via a support-vendor account exposed names, email addresses and phone numbers of campus diners and customer-care users, partial payment-card digits for a subset of campus diners, and hashed legacy-system passwords; Grubhub reported removing the provider's access and rotating at-risk passwords.
TRACK RECORD
2 ENFORCEMENT ACTIONS
[2026-08-12]
On August 12, 2026, the FTC announced it had distributed more than $23.8 million in redress payments to drivers and diners harmed by Grubhub's deceptive earnings claims and other unlawful conduct, confirming ongoing enforcement of the December 2024 settlement.
On December 17, 2024, the FTC and Illinois Attorney General announced Grubhub would pay $25 million to settle charges that it deceived diners about delivery costs and blocked their access to their accounts and funds, deceived drivers about expected earnings, and unfairly and deceptively listed hundreds of thousands of unaffiliated restaurants on its platform without permission.
The Grubhub iOS App Store privacy label lists a broad 'Data Linked to You' set collected and tied to user identity, including purchase history, precise and coarse location, physical address, email, name, phone number, financial/payment info, and both search history and browsing history.
Grubhub's privacy policy (effective January 5, 2026) discloses collection of identifiers (name, address, phone, email, IP address, device identifiers) directly from users and from third parties such as social-login providers, referring users, and employers/universities, plus geolocation: precise device location only if permission is granted, but approximate IP-based location collected at all times via the Google Maps API.
Wikidata's entry for Grubhub records that ownership transferred from the publicly listed Just Eat Takeaway.com to the privately held Wonder Group Inc.; Just Eat Takeaway.com's own releases date the definitive sale agreement to November 13, 2024 and completion of the transfer to January 7, 2025 (see this dossier's Just Eat Takeaway.com release claims).
Just Eat Takeaway.com's own press release of November 13, 2024 announces "it has entered into a definitive agreement to sell Grubhub Inc. (“Grubhub”) to Wonder Group, Inc. (“Wonder”) for an enterprise value of USD650 million," with completion expected during Q1 2025 subject to customary closing conditions including regulatory approvals.
Just Eat Takeaway.com's own press release of January 7, 2025 states it "has completed the sale of Grubhub Inc. (“Grubhub”) to Wonder Group, Inc.," dating completion of the ownership transfer to January 7, 2025 (the definitive sale agreement having been announced on November 13, 2024, per the same release).
Grubhub's privacy policy states the company does not sell personal information in exchange for money, but acknowledges that some of its disclosures to third-party online advertising and analytics partners for cross-context behavioral advertising may qualify as a 'sale' or 'share' under state privacy laws, and offers a 'Do Not Sell or Share My Personal Information' opt-out (separately for Grubhub and Seamless) that does not require creating an account.
As of 2026-08-17, Grubhub's own ads.txt file at www.grubhub.com authorizes 1 advertising system domain(s) to sell its ad inventory (1 DIRECT and 0 RESELLER entries).
On December 17, 2024, the FTC and Illinois Attorney General announced Grubhub would pay $25 million to settle charges that it deceived diners about delivery costs and blocked their access to their accounts and funds, deceived drivers about expected earnings, and unfairly and deceptively listed hundreds of thousands of unaffiliated restaurants on its platform without permission.
Grubhub's own newsroom statement dated February 3, 2025 (cited via an archived snapshot; the original about.grubhub.com URL now redirects to Wonder's corporate site) discloses a security incident in which an account belonging to a third-party service provider supporting Grubhub's Support Team was used for unauthorized access to contact information of campus diners and of diners, merchants and drivers who had interacted with customer care — names, email addresses and phone numbers, partial payment card information (card type and last four digits) for a subset of campus diners, and hashed passwords for certain legacy systems — while stating that Grubhub Marketplace passwords, merchant login information, full payment card numbers, bank account details, and Social Security or driver's license numbers were not accessed, and that Grubhub terminated the account's access, removed the provider from its systems, and rotated at-risk passwords.
On August 12, 2026, the FTC announced it had distributed more than $23.8 million in redress payments to drivers and diners harmed by Grubhub's deceptive earnings claims and other unlawful conduct, confirming ongoing enforcement of the December 2024 settlement.
The Grubhub App Store privacy label discloses a 'Data Used to Track You' category, stating that purchases, location, contact info, identifiers, usage data, and other data may be used to track the user across apps and websites owned by other companies.
Grubhub's privacy policy states it collects internet usage information through cookies, web beacons/pixels, embedded scripts, mobile SDKs, and location-identifying technologies, using third-party partners including Google and Meta (via the Meta Pixel) to assist, for personalization, ad measurement, and marketing.