data report card

Data Report Card · DoorDash

DoorDash Data Report Card

Food delivery
§ Enforcement action
Data
Practices
1Access1Portability2Friction2Deletion1Sells1Trains AI
=
C
§
6/12
Agent
Readiness
1Access 1Portability 0API access
=
D
2/6

Agent Readiness is a derived signal — a synthesis of two existing cells (Access, Portability) plus one sourced factor (API access), not an independently measured grade. API access scale: Best (2) consumer-grantable API · Moderate (1) partial / encumbered · Restrictive (0) manual export only. What is Agent Readiness?

§ This grade reflects a 2-point deduction (severity 1) for a verified regulatory action: 8/12 on data practices − 2 = 6/12C. The enforcement record is below.

Help me make a request →
Reviewed Jun 2026 · policies are checked weekly for changes  ·  stated — every cell is read from DoorDash's published policy; none has been tested (run by us) yet.
1Accessstated
Self-serve "Request Archive" under Manage Account after 2-step verification, but DoorDash does not publish what categories the archive covers.
DoorDash Help — Download or delete my data · accessed Jun 2026 ↗
1Portabilitystated
An archive is provided, but DoorDash does not state the file format (no documented JSON/CSV commitment), so machine-readability is unverified.
DoorDash Help — Download or delete my data · accessed Jun 2026 ↗
2Frictionstated
Self-serve request flow inside the app/site after identity verification; archive delivered by email when ready.
DoorDash Help — Download or delete my data · accessed Jun 2026 ↗
2Deletionstated
Self-serve "Delete Account" under Manage Account with 2-step verification; cannot delete with pending deliveries, and some data retained where legally permitted/required.
DoorDash Help — Download or delete my data · accessed Jun 2026 ↗
1Sells / sharesstated
DoorDash's policy offers a "Do Not Sell or Share" link for ad-related sharing, but does not state that it honors Global Privacy Control signals. The February 2024 California Attorney General settlement over co-op data sales sits in the enforcement record below and deducts from the grade there.
DoorDash — Privacy Policy (US) · accessed Jun 2026 ↗
1Trains AIstated
DoorDash discloses developing "audience insights and look-alike models" from personal information but its policy contains no specific AI/ML training disclosure; opt-out exists only via the Do Not Sell or Share / personalization controls (scored conservatively).
DoorDash — Privacy Policy (US) · accessed Jun 2026 ↗
§Enforcement action — deducts 2 points (severity 1); data practices without the penalty scored C (8/12)verified
California's Attorney General reached a $375,000 CCPA/CalOPPA settlement with DoorDash in February 2024, finding the company sold customer data through a marketing co-operative without notice or an opt-out.
California Attorney General · 21 Feb 2024 ↗
0API access — feeds Agent Readiness, not the /12stated
DoorDash's developer APIs serve merchants and delivery logistics, not consumer self-data; a customer requests a copy of their data through the Manage Account page by choosing "Request Archive" after two-step verification.
DoorDash — download my personal information · accessed Jun 2026 ↗
DoorDash has clean self-serve access and deletion but weak portability transparency. Cells rest on DoorDash's own published statements; the 2024 California Attorney General settlement over co-op data sales is carried in the enforcement record, which deducts from the grade. Source-verified Jun 2026; all cells stated (read from published policy/support docs), none yet tested via live export.

Events

Breaches, policy changes, and export-format changes we’ve recorded at DoorDash — other parties’ actions, alongside the enforcement record above. An event never changes a grade by itself. All events →

No events on record for DoorDash.

Grade history

Every change to this company’s grade since it was first published, and why. All grade changes →

12 Aug 2026Sells / shares your data01score

The February 2024 settlement bore this cell's score directly. Under the two-lane rule the cell now scores DoorDash's own stated “Do Not Sell or Share” link, and the settlement moves to the enforcement record, where it now applies the standard −2 deduction it previously did not. Data practices 7/12 → 8/12 with a −2 enforcement deduction; the grade is unchanged at C.

DoorDash — Privacy Policy (US) ↗
Previously: California Attorney General — DoorDash settlement

How to request your data from DoorDash

  1. Go to https://help.doordash.com/en-us/consumers/article/i-want-to-delete-my-personal-information-data-from-doordash — DoorDash's data-request entry point.
  2. Account Settings → Manage Account → Request Archive.
  3. Expected wait: not stated; emailed when archive is ready — DoorDash's stated turnaround (we haven't independently timed a request yet).
  4. No self-serve option, or want a formal request? Contact DoorDash — Privacy Team: mailto:privacy@doordash.com.

These steps reflect DoorDash's documented process as of Jun 2026. The wait time is the company's stated figure, not yet independently measured by us.