Second Circuit: Compelled Disclosure of Third-Party Customer Data Is Outside Zauderer and Invalid Absent a Reasonable Central Hudson Fit

1. Introduction

In DoorDash, Inc. v. City of New York (2d Cir. Aug. 5, 2026), the Second Circuit affirmed a permanent injunction barring enforcement of New York City’s “N.Y.C. Administrative Code § 20-563.7” (the “Customer Data Law”) against three major third-party delivery platforms—DoorDash, Grubhub, and Portier (Uber Eats) (collectively, the “Platforms”)—as applied to their “Marketplace” products.

The Law required Platforms, upon a restaurant’s request, to provide five categories of customer information for each customer who ordered through the platform: full name, telephone number, email address, delivery address, and order contents. The Law presumed customer consent unless the customer opted out for that particular order and required customers to repeat the opt-out on an order-by-order basis.

The central issues on appeal were (i) whether the compelled disclosure should be reviewed under the deferential compelled-commercial-disclosure doctrine of Zauderer v. Office of Disciplinary Counsel of the Supreme Court of Ohio, or instead under at least intermediate scrutiny pursuant to Central Hudson Gas & Electric Corp. v. Public Service Commission of New York; and (ii) whether the Law survives the applicable scrutiny.

2. Summary of the Opinion

The Second Circuit held:

• Zauderer does not apply because the Law compels disclosure of information about third-party customers who use Marketplace, not information “about” the Platforms’ own goods or services.
• Assuming the Law regulates only commercial speech (the assumption most favorable to the City), it must satisfy at least Central Hudson intermediate scrutiny.
• The Law fails Central Hudson at the fourth step (“reasonable fit” / “not more extensive than necessary”) due to two design choices working together:
  1. presumed consent (opt-out rather than opt-in), and
  2. order-by-order opt-outs (no standing opt-out).

Judge Park concurred, agreeing the Law fails the “reasonable fit” requirement, and additionally suggesting the City’s interest was impermissible “economic favoritism” rather than a substantial interest cognizable under Central Hudson.

3. Analysis

A. Precedents Cited

1) The Zauderer line: when deferential review is (and is not) available

The City’s primary appellate theory was that the Law is a routine commercial disclosure subject to Zauderer’s deferential standard. The panel rejected that argument by anchoring Zauderer to a threshold requirement that the compelled disclosure be “about the goods or services the speaker may offer.”

• Zauderer v. Office of Disciplinary Counsel of the Supreme Court of Ohio: The court treated Zauderer as a narrow carveout for compelled, “purely factual and uncontroversial information” about the terms under which the speaker’s own services are available—justified by the consumer-information function of commercial speech.
• New York State Restaurant Ass'n v. New York City Board of Health and National Electrical Manufacturers Ass'n v. Sorrell: The panel invoked these as canonical, proper uses of Zauderer—calorie counts “about” food sold, and mercury disposal labels “about” lamps sold—reinforcing that the disclosure must be tied to the speaker’s own product/service offering.
• CompassCare v. Hochul: Cited to show the Second Circuit’s continued willingness to treat “terms” broadly (there, “terms of employment under New York law”) while still requiring the disclosure to be about the speaker’s own service relationship.
• Volokh v. James: Quoted for the “threshold requirement” formulation (“about the goods or services the speaker may offer”), which the panel used to separate permissible service-related disclosures from compelled speech about third parties.
• Safelite Group, Inc. v. Jepsen: Functioned as the key limiting precedent. There, Connecticut could not invoke Zauderer to compel a claims administrator to advertise a competitor. The panel treated the “about a third party” distinction as “dispositive,” and applied that logic here: customer identities and contact details are facts about third parties, not about Marketplace.
• Uber Techs., Inc. v. City of Seattle: Used illustratively (from the Ninth Circuit) for the type of ordinance that plausibly fits Zauderer: requiring a platform to disclose the grounds for account deactivation—information “concerning only the service provided.” The contrast clarified why compelled disclosure of customer PII is not “about” the service.

The panel also relied on a purpose-based understanding of Zauderer: compelled commercial disclosures are justified when they reduce information costs and improve consumer decision-making about a transaction. The court reinforced that point with Va. State Bd. of Pharmacy v. Va. Citizens Consumer Council, Inc. and the Second Circuit’s own articulation in National Electrical Manufacturers Ass'n v. Sorrell. The Law, by contrast, was aimed at enabling restaurants’ post-transaction marketing to customers—commercially valuable, but not consumer-informing about the platform’s terms.

2) The scrutiny framework for content-based compelled speech

• Riley v. Nat'l Fed'n of the Blind of N.C., Inc.: Supplied the compelled-speech premise that mandating speech “necessarily alters the content,” establishing content-based regulation.
• Nat'l Inst. of Fam. & Life Advocs. v. Becerra: Cited for the commercial/noncommercial fork: noncommercial compelled speech is generally subject to strict scrutiny.
• Sorrell v. IMS Health Inc. and Evergreen Ass'n, Inc. v. City of New York: Supported the panel’s choice to resolve the case under intermediate scrutiny without deciding whether strict scrutiny could apply, because the Law fails even the more forgiving standard.

3) Central Hudson and the “reasonable fit” / tailoring requirement

The panel’s holding turned on the fourth prong of Central Hudson, drawing on a cluster of Supreme Court and Second Circuit precedents that insist intermediate scrutiny is not toothless and that governments bear an evidentiary burden to justify scope.

• Central Hudson Gas & Electric Corp. v. Public Service Commission of New York: Provided the four-part test; the panel’s analysis focused on step four.
• Lorillard Tobacco Co. v. Reilly: Supplied the “reasonable fit” formulation for step four.
• City of Cincinnati v. Discovery Network, Inc.: Used to emphasize that intermediate scrutiny does not collapse into rational basis and to spotlight the relevance of “numerous and obvious less-burdensome alternatives.”
• Bd. of Trs. of State Univ. of N.Y. v. Fox and In re R.M.J.: Used to impose a government burden to “affirmatively establish” proportionality between scope and interest served.
• Vugo, Inc. v. City of New York and Clear Channel Outdoor, Inc. v. City of New York: Cited for the principle that government gets “considerable leeway” in selecting means, while still needing a reasonable fit.
• Art & Antique Dealers League of Am., Inc. v. Seggos and Long Island Bd. of Realtors, Inc. v. Village of Massapequa Park: Provided the Second Circuit’s modern framing of step four as proportionality of scope; also supplied the idea that severe burdens may fail where less intrusive options are nearly as effective.
• N.Y. State Ass'n of Realtors, Inc. v. Shaffer and Anderson v. Treadwell: Served as the panel’s opt-out/opt-in analogs: broad solicitation restrictions fail without evidence that narrower, resident-activated alternatives are inadequate; resident-activated measures can succeed when precisely co-extensive with those seeking protection.

4) The concurrence’s additional “substantial interest” critique

• Am. Meat Inst. v. U.S. Dep't of Agric.: Judge Park invoked then-Judge Kavanaugh’s concurrence for the view that “history and tradition” guide what interests justify compelled commercial disclosures (e.g., deception prevention; health/safety warnings).
• Safelite Group, Inc. v. Jepsen: Judge Park used Safelite’s skepticism of “protectionist” purposes to argue the City’s aim—supporting restaurants by transferring valuable customer data— is not a substantial interest under Central Hudson.

B. Legal Reasoning

1) Why Zauderer did not apply

The panel framed the governing question as whether the compelled disclosure is “about” the Platforms’ own “goods or services.” It rejected the City’s effort to re-describe Marketplace as the sale of “access to the customers and their orders.” Even accepting that description, the court held the Law compels disclosure of customers’ personal information itself—facts about third parties—rather than disclosure about the “terms” of access (e.g., fees, rankings, account rules, or other service features).

The court also rejected the City’s functional argument that the disclosure helps restaurants market more efficiently. The panel treated that as orthogonal to Zauderer’s consumer-information rationale: the Law did not reduce information costs for consumers deciding whether to use Marketplace; it created a post-transaction marketing list that customers neither affirmatively joined nor could easily exit.

2) Why the Law failed Central Hudson (step four)

The panel assumed (without deciding) that the City’s stated interests could be substantial and that the Law could directly advance them, then held the Law fails because the City did not “affirmatively establish” a proportional relationship between the Law’s sweep and the interests asserted.

Two design features were decisive:

1. Presumed consent (opt-out): The court emphasized the availability of an “obvious, substantially less burdensome alternative”—an opt-in regime. It treated the City’s argument (“less data would be shared”) as insufficient because less compelled speech is the point of less restrictive alternatives. The City offered no evidence that opt-in would be inadequate to meet its goals.
2. Order-by-order opt-outs (no standing opt-out): Even customers who opted out once were presumed to consent on the next order. The panel treated a standing opt-out as another less burdensome alternative that could still allow restaurants to market to receptive customers, while better aligning compelled disclosures with customer preferences. Again, the City offered no evidence explaining why repeated opt-outs were necessary to achieve its interests.

The combined effect—mass default disclosure plus frictionful, repetitive opting out—created a system in which customers were automatically placed on a marketing list and could not be confident they had permanently left it. The City’s lack of evidentiary support on why these burdens were necessary made the “fit” unreasonable.

C. Impact

• Narrowing (and clarifying) Zauderer in data contexts: The decision reinforces that Zauderer is not a general license for governments to mandate disclosure of any “factual” information in commerce. Compelled disclosures about third parties—especially personally identifiable customer information—will face heightened scrutiny in the Second Circuit.
• Evidence matters under intermediate scrutiny: The opinion underscores that governments must build a record showing why less-burdensome alternatives (opt-in; standing opt-out; narrower data fields; limited frequency; purpose limitation) are inadequate, not merely assert that broader disclosure yields more benefits.
• Design choices (defaults and friction) become constitutional facts: By focusing on default consent and repeated opt-outs, the court signals that “choice architecture” in speech-compelling regimes can determine constitutional survival. Future laws may be drafted with opt-in or standing opt-out mechanisms to improve tailoring.
• Potential pressure on “industry support” rationales: Judge Park’s concurrence suggests a more aggressive constraint: compelled disclosures aimed at shifting economic value to favored market participants may fail at Central Hudson step two (lack of a substantial interest), even before tailoring is reached.
• Broader privacy and platform governance implications: Although decided as a compelled-speech case (not a privacy case), the holding may constrain municipal efforts to redistribute user data from platforms to local businesses, particularly where the data is not needed to complete the transaction and is used for subsequent marketing.

4. Complex Concepts Simplified

• Compelled speech: The First Amendment can be violated not only when the government bans speech, but also when it forces a private party to say (or disclose) something it would not otherwise say.
• Zauderer review (deferential compelled commercial disclosure): A relaxed standard sometimes used when the government requires a business to disclose “purely factual and uncontroversial” information about its own product or service to help consumers make informed decisions (e.g., calorie counts, warnings, basic terms).
• Central Hudson intermediate scrutiny (commercial speech): A four-step test. Even if the government has a strong reason and the law helps, the law must still be appropriately tailored—there must be a “reasonable fit,” and obvious less-restrictive alternatives matter.
• “Reasonable fit” / “not more extensive than necessary”: The government doesn’t need the absolute least restrictive approach, but it must justify why it chose a broad approach if narrower approaches could work nearly as well.
• Opt-in vs. opt-out (and standing opt-out): “Opt-in” means data is shared only after affirmative consent. “Opt-out” means data is shared by default unless refused. A “standing opt-out” means refusing once persists; order-by-order opt-out forces repeated refusals, increasing the likelihood that data will be shared despite user preferences.

5. Conclusion

DoorDash, Inc. v. City of New York establishes a significant Second Circuit constraint on compelled data-sharing mandates: a law compelling disclosure of customers’ personally identifying information is not a Zauderer-type disclosure “about” the platform’s own services, and thus must satisfy at least Central Hudson scrutiny. On the record presented, New York City’s Customer Data Law failed because its default disclosure and repeated opt-out structure swept too broadly relative to the City’s asserted interests and lacked evidentiary justification in light of obvious, less burdensome alternatives.

Going forward, governments seeking to mandate commercial disclosures involving user data should expect heightened scrutiny unless the disclosure is tightly connected to the speaker’s own service terms and is designed with demonstrably proportionate, consent-sensitive mechanisms.