Guidelines for Data Requests by Law Enforcement Authorities Outside the United States

Law enforcement authorities sometimes request information from DoorDash about Customers, Dashers, and Merchants. At DoorDash, we believe it’s important to assist law enforcement authorities with legitimate investigations while also protecting individual privacy. In many cases, a Customer, Dasher, or Merchant who has made a report to law enforcement will be able to directly provide the best information.

The guidelines below offer law enforcement authorities in jurisdictions in which DoorDash operates outside the United States (i.e., Australia, Canada, and New Zealand) procedures and best practices for working with DoorDash on requests for information. By submitting a request in the name of law enforcement pursuant to these guidelines you certify that you are a law enforcement official making a request in your official capacity and agree that any information provided by DoorDash will be used solely for an active investigation and/or public safety purposes and not for any other purpose. 

Requests for information by law enforcement in countries where DoorDash does NOT operate should follow the relevant mutual legal assistance treaty, letter rogatory, or similar process for obtaining data from DoorDash in the United States.

DoorDash is committed to user privacy. DoorDash collects and retains user data as described in our Privacy Policies and Terms and Conditions and discloses user data to law enforcement in accordance with the Electronic Communications Privacy Act and other applicable law. We also disclose information subject to our Privacy Policies and Terms and Conditions.

These guidelines neither provide legal advice nor create any enforceable rights. DoorDash reserves the right to update or change these guidelines and the Frequently Asked Questions Below without notice to law enforcement.

Overview

Upon receiving legal process, a preservation request, or an emergency disclosure request, DoorDash may disclose the requested data if doing so would be consistent with:

• U.S. law, including the Electronic Communications Privacy Act;

• local law of the requesting authority, and any other applicable laws; and

• DoorDash’s user policies, including applicable Privacy Policies and applicable Terms and Conditions.

Legal process may be submitted to DoorDash using the Law Enforcement Request Form. We accept courtesy copies of legal process through this Form as a convenience but reserve all rights and objections, such as for lack of jurisdiction or improper service.

Requirements for Legal Process, Preservation Requests, and Emergency Disclosure Requests

How to Serve Legal Process and Other Requests

Law enforcement may submit legal process, preservation requests, and emergency disclosure requests to DoorDash by completing and submitting this Law Enforcement Request Form. We accept courtesy copies of legal process through this Form as a convenience but reserve all rights and objections, such as for lack of jurisdiction or improper service. Only law enforcement and government personnel authorized to obtain evidence in connection with official legal proceedings may submit requests using the Form. Law enforcement officers using the Form must provide an official law enforcement or government email account and a direct contact telephone number for the responsible agent or officer.

Legal process, preservation requests, and emergency disclosure requests must be addressed to the appropriate DoorDash entity:

• Requests from Australian authorities should be addressed to DoorDash Technologies Australia Pty. Ltd., Level 15, 222 Exhibition Street, Melbourne, Victoria, 3000 Australia.

• Requests from Canadian authorities should be addressed to DoorDash Technologies Canada Inc., 1066 West Hastings Street, #2300, Vancouver (BC), V6E 3X2.

• Requests from authorities in New Zealand should be addressed to DoorDash Technologies New Zealand care of Quigg Partners,  Level 7, 36 Brandon Street, Wellington, 6011, New Zealand.

Identifying a DoorDash Account

When submitting legal process or other requests to DoorDash, law enforcement should identify the specific Customer, Dasher, or Merchant account(s) implicated by the request. When possible, law enforcement should provide at least one unique identifier associated with the account(s), such as an email address and/or phone number. Names or dates of birth alone may not be sufficiently unique identifiers. DoorDash may also be able to identify accounts that are relevant to a law enforcement investigation by searching for information related to a specific order. For such requests, information about that order, such as user identification information named above, and a date, time, order number, or pick up/delivery location, should be provided.

Legal Process

All law enforcement requests for data must be supported by legal process (except for emergency disclosure requests, discussed below) and must be appropriately scoped. DoorDash reserves the right to reject legal process for any reason, including requests that do not have a valid legal basis, are overbroad, vague, or otherwise inappropriate, or if DoorDash cannot verify the legitimacy of the request. 

DoorDash may also require a valid U.S. court order (via mutual legal assistance treaty, mutual legal assistance agreement, or letter rogatory) to disclose certain types of records to authorities outside the United States. For example, DoorDash generally requires a valid U.S. court order (via mutual legal assistance treaty, mutual legal assistance agreement, or letter rogatory) to disclose the content of communications to authorities outside the United States.

To be valid, legal process submitted to DoorDash must generally:

• be addressed to the appropriate DoorDash entity (listed above);

• be issued in compliance with the local law of the requesting authority;

• be issued by an appropriate authority, such as a judge;

• be signed by an appropriate authority, such as a judge;

• be dated;

• provide a date to return the responsive materials, if applicable; and

• specifically identify the targeted account(s), reasonably identified; the type(s) of information within the account to be disclosed; and any applicable date range.

Preservation Requests

Law enforcement may request the preservation of account records. Upon receipt of such a request, DoorDash may take steps to preserve any records or other information in its possession regarding the subject of the preservation request, pending the issuance of legal process. A preservation is a one-time “snapshot” of the records or content in a DoorDash user’s account at the time we receive the preservation request; it is not an ongoing, real-time preservation of those records. DoorDash reserves the right to reject preservation requests for any reason.

To the extent consistent with U.S. and local law, DoorDash will preserve any records or content in a user’s account for 90 days. DoorDash will extend that preservation for a single additional 90-day period (for a total of 180 days), if requested to do so by law enforcement.

Emergency Disclosure Requests

To the extent consistent with U.S. and local law, DoorDash may voluntarily disclose user data to a law enforcement entity if DoorDash has a good-faith belief that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay of information related to the emergency. Requested data must be limited to data necessary to specifically address the ongoing emergency.

Emergency disclosure requests may be submitted via DoorDash’s Law Enforcement Request Form. DoorDash has processes in place to escalate and promptly respond to emergency requests.

To submit an emergency disclosure request, law enforcement must:

• certify that they are authorized by law to obtain the requested records;

• certify and provide information sufficient to show that the request is, in fact, related to an emergency involving danger of death or serious physical injury that requires disclosure without delay of information relating to that emergency; 

• certify that law enforcement is unable to obtain legal process in time to respond to the emergency, and

• if required by law, follow-up with legal process.

DoorDash has processes in place to escalate and promptly respond to emergency requests. DoorDash may follow up with law enforcement upon receipt of an emergency disclosure request if information is missing from the request or if further clarification is needed. Accordingly, appropriate contact information (including an email address and a direct dial telephone number for the responsible agent or officer) must be provided so that DoorDash can follow up quickly.

DoorDash’s User Notice Policy

DoorDash reserves the right to notify Customers, Dashers, and Merchants of requests for their data, except where notice is prohibited by applicable law, or where DoorDash, in its sole discretion, determines that withholding notice is appropriate. For example, DoorDash may decide in its sole discretion not to disclose the existence of a request in some emergency situations.

In the absence of a basis for nondisclosure, DoorDash may notify the account holder of the request. Law enforcement should therefore be sure to indicate any legal restrictions on disclosure in its submission of process through the Law Enforcement Request Form. Specifically, law enforcement should:

• indicate the absence of any objection to user notice;

• provide a lawful nondisclosure order; or

• identify another legal basis prohibiting user notice, such as language in the legal process itself or statutory language that bars user notice.

After expiration of a nondisclosure order or other basis for nondisclosure, DoorDash may provide notice to users regarding law enforcement requests for their data unless DoorDash decides, in its sole discretion, to withhold notice as discussed above.

Information Available from DoorDash

This section describes the general categories of user data that may be available from DoorDash. It is meant to provide a guide regarding some of the most commonly requested data types and is not exhaustive. 

DoorDash collects and maintains user data in accordance with our Privacy Policies and Terms and Conditions. The data DoorDash collects and maintains may vary from account to account, such as when an DoorDash user deletes their account information. Accordingly, the types of data DoorDash provides in response to valid legal process may vary.

Basic Subscriber Information

Basic subscriber information maintained by DoorDash for Customers, Dashers, and Merchants may include:

• user profile information (e.g., name, email, phone number);

• usage information (e.g., date of account creation, and account status); and

• means and source of payment (see “Billing Information” below for more details).

Device Information

User device data may include:

• device type;

• device OS;

• tokenized device identifiers;

• browser information; and

• Internet service provider.

Billing Information

Means and source of payment information that DoorDash may provide includes:

• partial credit card or bank account number;

• credit card expiration date;

• associated credit card postal code; and

• other payment instruments.

Other billing information that DoorDash may provide includes:

• information about particular transactions, such as the date and time the transaction was made, the amount, and the means of payment.

Order Information 

DoorDash Order information generally includes:

• a breakdown of the amounts charged and credited to the Customer for the order;

• the pick-up and delivery locations; and

• information about the Merchant, the Customer, and the Dasher. 

Additional Dasher Information

DoorDash may retain the following information about Dashers:

• profile photo;

• driver’s license information; 

• vehicle information; and

• date of birth.

Location Information

DoorDash may collect Global Positioning System (GPS) location information from the mobile devices of Dashers and Customers. Such location information may be captured when the DoorDash app is running on the user’s mobile device. Customers have the option in their device settings to opt out of the collection of their GPS information, and if they choose to do so, the Customer’s GPS data will not be captured.

Communications Information

DoorDash may capture certain information about communications between its users on the DoorDash app, such as when a Dasher and a Customer use the app to communicate with each other. This may include non-content records associated with such communications, or in the case of text messages through the app, the contents of those communications.

Records of communications may include:

• to/from information; and

• date and time of the communication.

Contents of communications may include messages sent between users on the app.  As discussed above, DoorDash generally requires a valid U.S. court order (via mutual legal assistance treaty, mutual legal assistance agreement, or letter interrogatory) to disclose the content of communications to authorities outside the United States.

Customer Service Records

Customer service records DoorDash may retain include:

• recordings of customer support calls; and

• other customer support communications.

Frequently Asked Questions (FAQs)

Q: How should law enforcement transmit legal process to DoorDash?

A: Legal process, preservation requests, and emergency requests may be submitted through DoorDash’s Law Enforcement Request Form and should be addressed to the appropriate DoorDash entity. Using the Form helps DoorDash collect the information it needs to process requests more efficiently. See Requesting Data from DoorDash above.

Q: Does DoorDash notify users of legal process?

A: We reserve the right to provide user notice except when doing so is prohibited by law. See DoorDash's User Notice Policy above.

Q: What should law enforcement do with the records it obtains from DoorDash once the investigation or case is over?

A: Information obtained from DoorDash should be destroyed upon completion of the  investigation or at the conclusion of the case.

Q: I submitted a request, but I haven’t heard back from DoorDash. What should I do?

A: DoorDash receives thousands of requests annually and prioritizes the requests it receives upon receipt based on the nature of the request and the urgency of the situation. DoorDash attempts to respond to requests as quickly as reasonably possible. In the event you need to contact DoorDash about a request that you have already submitted, please use the Law Enforcement Request Form. Please provide details sufficient to allow us to identify the original request that you are inquiring about, such as the name and affiliation of the agent or officer who made the initial request, the date and time of the original submission, and the nature of the request. 

Q: Does DoorDash require reimbursement of the costs associated with responding to legal process?

A: DoorDash generally does not seek reimbursement of costs associated with responding to legal process, but it reserves the right to do so.

Q: Can DoorDash provide the password to a user’s account?

A: No, DoorDash does not have access to user passwords.

Q: Does DoorDash terminate accounts upon request? Will DoorDash keep an account active if requested?

A: DoorDash determines in its own discretion whether to deactivate an account when it is made aware of an incident or other information that may warrant such action. Please see this page for more information about our account deactivation procedures.