Guidelines for Data Requests by U.S. Law Enforcement

Law enforcement authorities sometimes request information from DoorDash about Customers, Dashers, and Merchants. At DoorDash, we believe it’s important to assist law enforcement authorities with legitimate investigations while also protecting individual privacy. In many cases, a Customer, Dasher, or Merchant who has made a report to law enforcement will be able to directly provide the best information.

The guidelines below offer law enforcement officials in the United States procedures and best practices for working with DoorDash on requests for information. By submitting a request in the name of law enforcement, you acknowledge that you are a law enforcement official making a request in your official capacity and agree that any information provided by DoorDash will be used solely for an active investigation and/or public safety purposes and not for any other purpose. Private parties, including civil litigants, and criminal defendants should consult our Guidelines for Third Party Data Requests.

DoorDash is committed to user privacy. DoorDash collects and retains user data as described in our Privacy Policies and Terms and Conditions and discloses user data to law enforcement in accordance with the Electronic Communications Privacy Act (“ECPA”) and other applicable law. We also disclose information subject to our Privacy Policies and Terms and Conditions.

These guidelines neither constitute legal advice nor create any enforceable rights. DoorDash reserves the right to update or change these guidelines and the Frequently Asked Questions below without notice.

Legal Process Overview

DoorDash will disclose account information to law enforcement and other governmental entities in the United States where required by legal process issued pursuant to ECPA and other applicable legal authorities. ECPA generally prohibits DoorDash from disclosing certain categories of user data without appropriate legal process, such as a subpoena, court order, or search warrant. Other laws may separately restrict DoorDash’s ability to disclose certain categories of sensitive information, such as tax records and certain sensitive information about orders. 

When DoorDash has a good-faith belief that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay of information related to the emergency, DoorDash may voluntarily disclose user data, including the contents of communications, to law enforcement. When submitting an emergency disclosure request, law enforcement must certify that the request is, in fact, related to an emergency involving danger of death or serious physical injury that requires disclosure without delay of information relating to that emergency, and that law enforcement is unable to timely obtain legal process. For more information about emergency disclosure requests, see Emergency Disclosure Requests below.

Serving Legal Process

How to Serve Legal Process

Law enforcement may submit legal process, preservation requests, and emergency disclosure requests to DoorDash by completing and submitting this Law Enforcement Request Form. We accept courtesy copies of legal process through this Form as a convenience but reserve all rights and objections, such as for lack of jurisdiction or improper service. Only law enforcement and government personnel authorized to obtain evidence in connection with official legal proceedings may submit requests using the Form. Law enforcement officers using the Form must provide an official law enforcement or government email account and a direct contact telephone number for the responsible agent or officer.

Identifying a DoorDash Account

When submitting legal process or other requests to DoorDash, law enforcement should identify the specific Customer, Dasher, or Merchant account(s) implicated by the request. When possible, law enforcement should provide at least one unique identifier associated with the account(s), such as an email address and/or phone number. Names or dates of birth alone may not be sufficiently unique identifiers. DoorDash may also be able to identify accounts that are relevant to a law enforcement investigation by searching for information related to a specific order. For such requests, information about that order, such as user identification information named above, and a date, time, order number, or pick up/delivery location, should be provided.

DoorDash’s User Notice Policy

DoorDash reserves the right to notify Customers, Dashers, and Merchants of requests for their data, except where notice is prohibited by the legal process itself, a lawful nondisclosure order (e.g., a court order under 18 U.S.C. § 2705(b)), or other applicable law, or where DoorDash, in its sole discretion, determines that withholding notice is appropriate. For example, DoorDash may decide in its sole discretion not to disclose the existence of a request in some emergency situations.

In the absence of a basis for nondisclosure, DoorDash may notify the account holder of the request. Law enforcement should therefore be sure to indicate any legal restrictions on disclosure in its submission of process through the Law Enforcement Request Form. Specifically, law enforcement should:

• indicate the absence of any objection to user notice;

• provide a lawful nondisclosure order; or

• identify another legal basis prohibiting user notice, such as language in the legal process itself or statutory language that bars user notice.

After expiration of a nondisclosure order or other basis for nondisclosure, DoorDash may provide notice to users regarding law enforcement requests for their data unless DoorDash decides, in its sole discretion, to withhold notice as discussed above.

If DoorDash receives legal process that is subject to a nondisclosure obligation of indefinite or unduly lengthy duration, it reserves the right to seek judicial review of the nondisclosure requirement. If the government notifies DoorDash that it is no longer subject to the nondisclosure obligation, DoorDash may notify the relevant user in accordance with the process described above.

Requesting Information from DoorDash

As described above, legal process may be submitted to DoorDash using the Law Enforcement Request Form. We accept courtesy copies of legal process through this Form as a convenience but reserve all rights and objections, such as for lack of jurisdiction or improper service.

To be valid, legal process submitted to DoorDash must generally:

• be addressed to DoorDash, Inc., 303 2nd Street, San Francisco, CA 94107;

• be issued by the appropriate authority;

• be signed by the appropriate authority, such as a judge. Legal process must be signed pursuant to local court rules, including by an electronic or telephonic signature;

• be dated;

• provide a date and time to return the responsive materials, if applicable; and

• specifically identify the targeted account and the type(s) of information requested. For additional guidance, see Identifying a DoorDash Account and Information Available from DoorDash below.

In addition, we may reject requests that lack a valid legal basis or that are overbroad, vague, or otherwise inappropriate.

Subpoenas

A subpoena may be used to compel the disclosure of basic subscriber information, as enumerated in 18 U.S.C. § 2703(c)(2), and other non-content information that is not covered by ECPA or otherwise protected by law. For additional guidance about the data that DoorDash may produce pursuant to a subpoena, see Information Available from DoorDash.

Subpoenas must comply with the criteria specified above for legal process validity, including the requirement that they be issued by an executive branch agency or court with the power to issue such subpoenas. They must also be signed by a person authorized to sign subpoenas.

Court Orders

Under ECPA, a court order issued pursuant to 18 U.S.C. § 2703(d) (a “(d) Order”) may be used to compel the disclosure of non-content records and other information related to a user account upon a showing of “specific and articulable facts” that “there are reasonable grounds to believe” that the “records or other information sought are relevant and material to an ongoing criminal investigation.” A (d) Order may also compel the disclosure of basic subscriber information. However, DoorDash may not disclose the contents of communications between Dashers and Customers or constitutionally protected location data in response to a (d) Order.

To be valid, a (d) Order must:

• be signed by a judge;

• be issued by a court of competent jurisdiction; and

• state that it was issued pursuant to § 2703(d) or include a finding based on “specific and articulable facts” showing that there are “reasonable grounds to believe that the records sought are “relevant and material to an ongoing criminal investigation.”

Search Warrants 

Law enforcement may use a search warrant to compel the disclosure of content and non-content information. In other words, a search warrant can be used to acquire information available with a subpoena or a (d) Order, as well as the contents of a user’s communications and location data, when available. Content is defined as “any information concerning the substance, purport, or meaning of [a] communication.” Content accordingly includes the body of text messages and other types of information that convey the substance of a communication. For additional information about the content and location information DoorDash may produce, see Communications Information and Location Information below.

To be valid, a search warrant must:

• identify the person or property to be searched (i.e., DoorDash, Inc.);

• identify the information to be seized (i.e., identify the user account at issue and specify the records or content requested);

• state that the warrant was issued upon a judicial finding of probable cause;

• be signed by a judge; and

• be served on DoorDash within 14 days of the date on which it was issued (for federal search warrants) or within the time frame specified by the law of the state from which the warrant issued.

Preservation Requests

Under ECPA, law enforcement may seek the preservation of account records pursuant to 18 U.S.C. § 2703(f), to the extent it applies. Upon receipt of such a request, DoorDash will take steps to preserve records and other information in its possession regarding the subject of the preservation request pending the issuance of legal process. A preservation is a one-time “snapshot” of the records or content in a DoorDash user’s account at the time we receive the preservation request; it is not an ongoing, real-time preservation of those records. DoorDash does not notify users about requests to preserve their account information.

DoorDash will preserve any records or content in a user’s account for 90 days. DoorDash will extend that preservation for a single additional 90-day period (for a total of 180 days), if requested to do so by law enforcement.

Preservation requests should be submitted using DoorDash’s Law Enforcement Request Form. Such requests must be dated and must specifically identify the targeted account or order (order number, approximate pick up and/or delivery, date, time, etc.) and the type of information within the account to be preserved. For additional guidance about identifying DoorDash accounts and the user data that DoorDash may preserve, see Identifying a DoorDash Account and Information Available from DoorDash below.

Emergency Disclosure Requests

Law enforcement authorities in the United States may use DoorDash’s Law Enforcement Request Form to transmit emergency disclosure requests to DoorDash pursuant to 18 U.S.C. §§ 2702(b)(8) and 2702(c)(4). DoorDash may voluntarily disclose user data to a governmental entity if DoorDash has a good-faith belief that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay of information related to the emergency. 

Law enforcement may obtain subscriber information or other records, including content information, with an emergency disclosure request. The information disclosed will be limited to that necessary to specifically address the ongoing emergency.

To submit an emergency disclosure request, law enforcement must:

• certify that they are authorized by law to obtain the requested records;

• certify and provide facts sufficient to show that the request is, in fact, related to an emergency involving danger of death or serious physical injury that requires disclosure without delay of information relating to that emergency; and

• certify that law enforcement is unable to obtain legal process in time to respond to the emergency.

DoorDash has processes in place to escalate and promptly respond to emergency requests. DoorDash may follow up with law enforcement upon receipt of an emergency disclosure request if information is missing from the request or if further clarification is needed. Accordingly, appropriate contact information (including an email address and a direct dial telephone number for the responsible agent or officer) must be provided so that DoorDash can follow up quickly.

Witness Testimony Requests 

DoorDash includes a certificate of authenticity with its productions, which generally eliminates the need for live testimony to authenticate records. Although law enforcement may submit a courtesy copy of a subpoena seeking witness testimony through the Law Enforcement Request Form, DoorDash requires that all such subpoenas be properly served in accordance with applicable law and domesticated in California when necessary to ensure personal jurisdiction over DoorDash. DoorDash may not be able to accommodate subpoenas for witness testimony served fewer than 14 days before the requested appearance.

Information Available from DoorDash

This section describes the general categories of user data that may be available from DoorDash. It is meant to provide a guide regarding some of the most commonly requested data types and is not exhaustive. 

DoorDash collects and maintains user data in accordance with its Privacy Policies and its Terms and Conditions. The data DoorDash collects and maintains may vary from account to account, such as when a DoorDash user deletes their account information. Accordingly, the types of data DoorDash provides in response to valid legal process may vary.

* Note that California and Utah law require state and local law enforcement in those jurisdictions to use a warrant to obtain some categories of information that federal law would otherwise permit DoorDash to disclose pursuant to a (d) Order or a subpoena.  

Basic Subscriber Information

“Basic subscriber information” is defined in 18 U.S.C. § 2703(c)(2). Basic subscriber information includes information provided by users during the creation of a DoorDash account and information submitted or collected at a later date.

Basic subscriber information maintained by DoorDash for Customers, Dashers, and Merchants may include:

• user profile information (e.g., name, email, phone number);

• usage information (e.g., date of account creation, account status); and

• means and source of payment (see “Billing Information” below for  more details).

Basic subscriber information may be obtained with a subpoena, (d) Order, search warrant, or pursuant to an emergency disclosure request.

Device Information

User device data may include:

• device type;

• device OS;

• tokenized device identifiers;

• browser information; and

• Internet service provider.

User device data may be obtained from DoorDash with a subpoena, (d) Order, search warrant, or pursuant to an emergency disclosure request.

Billing Information 

Billing information includes “means and source of payment,” as specified in ECPA, as well as other information about transactions on the DoorDash App.

Means and source of payment information that DoorDash may provide includes:

• partial credit card or bank account numbers;

• credit card expiration date;

• associated credit card zip code; and

• other payment instruments.

Means and source of payment information may be obtained with a subpoena, (d) Order, search warrant, or pursuant to an emergency disclosure request. 

Other billing information that DoorDash may provide includes:

• information about particular transactions, such as the date and time the transaction was made, the amount, and the means of payment.

This additional billing information also may be obtained with a subpoena, (d) Order, search warrant, or pursuant to an emergency disclosure request.

Order Information 

DoorDash Order information generally includes:

• a breakdown of the amounts charged and credited to the Customer for the order;

• the pick-up and delivery locations; 

• order and delivery dates and times; and

• information about the Merchant, the Customer, and the Dasher. 

Records of orders are DoorDash’s business records and are not covered by ECPA. Such records may be obtained with a subpoena, (d) Order, or search warrant, except by law enforcement in jurisdictions where a search warrant is required by law, such as California and Utah. Order information may also be obtained pursuant to an emergency disclosure request.

Additional Dasher Information 

DoorDash may retain the following information about Dashers in addition to Basic Subscriber Information (see above):

• profile photo;

• driver’s license information; 

• vehicle information; and 

• date of birth.

Such Dasher profile records constitute DoorDash’s business records and are not covered by ECPA. Such information may be obtained with a subpoena, (d) Order, search warrant, or pursuant to an emergency disclosure request.

Location Information

DoorDash may collect Global Positioning System (GPS) location information from the mobile devices of Dashers and Customers. Such location information may be captured when the DoorDash app is running on a Dasher or Customer’s mobile device. Customers have the option in their device settings to opt out of the collection of their GPS information, and if they choose to do so, the Customer’s GPS will not be captured.

Available GPS location information may be obtained only with a search warrant or, in certain situations, pursuant to an emergency disclosure request.

Communications Information

DoorDash may capture certain information about communications between its users on the DoorDash app, such as when a Dasher and a Customer use the app to communicate with each other. This may include non-content records associated with such communications, or in the case of text messages through the app, the contents of those communications.

Records of communications may include:

• to/from information; and

• date and time of the communication.

Records of communications may be obtained with a (d) Order, search warrant, or, in certain situations, an emergency disclosure request.

Contents of communications may include messages sent between users on the app. Contents of communications may only be obtained with a search warrant or, in certain situations, pursuant to an emergency disclosure request.

Customer Service Records 

Customer service records DoorDash may retain include:

• recordings of customer support calls; and

• other customer support communications.

Such customer service records are DoorDash’s business records and are not covered by ECPA. Accordingly, these records may be obtained with a subpoena.

Frequently Asked Questions (FAQs)

Q: How should law enforcement in the U.S. transmit legal process to DoorDash?

A: Legal process, preservation requests, and emergency requests may be submitted through DoorDash’s Law Enforcement Request Form. DoorDash reserves the right to require formal service and domestication of legal process in addition to submission using the Form. Using the Form helps DoorDash collect the information it needs to process requests more efficiently. See Requesting Data from DoorDash above.

Q:  I am not a law enforcement agent or officer but I need to submit legal process to DoorDash. What should I do?

A:  For information for making non-law enforcement requests for data, see Guidelines for Third Party Data Requests and Service of Legal Documents.

Q: Does DoorDash notify users of legal process?

A: We reserve the right to provide user notice except when doing so is prohibited by law. See DoorDash's User Notice Policy above.

Q: What should law enforcement do with the records it obtains from DoorDash once the investigation or case is over?

A: Information obtained from DoorDash should be destroyed upon completion of the  investigation or at the conclusion of the case.

Q: I submitted a request, but I haven’t heard back from DoorDash. What should I do?

A: DoorDash receives thousands of requests annually and prioritizes the requests it receives upon receipt based on the nature of the request and the urgency of the situation. DoorDash attempts to respond to requests as quickly as reasonably possible. In the event you need to contact DoorDash about a request that you have already submitted, please use the Law Enforcement Request Form. Please provide details sufficient to allow us to identify the original request that you are inquiring about, such as the name and affiliation of the agent or officer who made the initial request, the date and time of the original submission, and the nature of the request. 

Q: Does DoorDash require reimbursement of the costs associated with responding to legal process?

A: DoorDash generally does not seek reimbursement of costs associated with responding to legal process, but it reserves the right to do so.

Q: Can DoorDash provide the password to a user’s account?

A: No, DoorDash does not have access to user passwords.

Q: Does DoorDash terminate accounts upon request? Will DoorDash keep an account active if requested?

A: DoorDash determines in its own discretion whether to deactivate an account when it is made aware of an incident or other information that may warrant such action. Please see this page for more information about our account deactivation procedures.