DoorDash, Inc. v. City of New York

25-81 DoorDash, Inc. v. City of New York United States Court of Appeals for the Second Circuit ________________________________ DOORDASH, INC., Plaintiff-Appellee, GRUBHUB INC., PORTIER, LLC, Consolidated Plaintiffs-Appellees, v. CITY OF NEW YORK, Defendant-Appellant. ________________________________ No. 25-81 AUGUST TERM 2025 ARGUED: April 15, 2026 DECIDED: August 5, 2026 On Appeal from the United States District Court for the Southern District of New York ________________________________ BEFORE: WESLEY, CARNEY, and PARK, Circuit Judges. When a customer orders food on a third-party delivery platform, they usually provide the platform with their full name, phone number, email address, and delivery address. The platform uses this information to deliver the customer’s food and later send them targeted advertisements. The restaurant that prepares the food, however, generally receives only the customer’s first name, last initial, and the order contents. 1 of 25  Against that backdrop, the City of New York (“the City”) in 2021 enacted N.Y.C. Administrative Code § 20-563.7 (“the Customer Data Law” or “the Law”), which requires delivery platforms to share with a restaurant, at its request, the rest of that customer information for every customer who has ordered from the restaurant. Three of New York City’s largest delivery platforms—DoorDash, Grubhub, and Portier (which does business as Uber Eats) (together, “the Platforms”)—sued the City to enjoin the Law. The district court (Torres, J.) held that the Law violates the First Amendment’s protections against compelled speech, granted summary judgment to the Platforms, and permanently enjoined the City from enforcing the Law against the Platforms. On appeal, the City argues that the district court erred in two ways. First, it contends that the Law merely requires the Platforms to disclose information about the service they sell—providing access to customers—and therefore should have been reviewed under the deferential standard of Zauderer v. Office of Disciplinary Counsel of the Supreme Court of Ohio, 471 U.S. 626 (1985), rather than the more demanding intermediate scrutiny of Central Hudson Gas & Electric Corp. v. Public Service Commission of New York, 447 U.S. 557 (1980). Second, it argues that even if intermediate scrutiny applies, the Law survives it. We disagree with the City on both counts and AFFIRM the district court’s judgment. JUDGE PARK concurs in a separate opinion. ________________________________ JONATHAN SCHOEPP-WONG, Assistant Corporation Counsel (Richard Dearing, Claude S. Platton, Assistant Corporation Counsel, on the brief), for Muriel Goode-Trufant, Corporation Counsel of the City of New York, New York, NY, for Defendant- Appellant. MICHAEL HOLECEK, Gibson, Dunn & Crutcher LLP, Los Angeles, CA (Jonathan N. Soleimani, Gibson, Dunn & Crutcher LLP, Los Angeles, CA; Aaron Smith, Gibson, Dunn & Crutcher LLP, Washington, DC; Joel Kurtzberg, Jason David Rozbruch, Cahill Gordon & Reindel LLP, New York, NY; John Charles 2 of 25  Quinn, Hecker Fink LLP, New York, NY, on the brief), for Plaintiffs-Appellees. Cory L. Andrews, Zac Morgan, Washington Legal Foundation, Washington, DC, for Amicus Curiae Washington Legal Foundation. Daniel M. Sullivan, Andrew C. Indorf, James Campbell, Holwell Shuster & Goldberg LLP, New York, NY, for Amicus Curiae Tech:NYC. ________________________________ WESLEY, Circuit Judge: When a customer orders food on a third-party delivery platform, they usually provide the platform with their full name, phone number, email address, and delivery address. The platform uses this information to deliver the customer’s food and later send them targeted advertisements. The restaurant that prepares the food, however, generally receives only the customer’s first name, last initial, and the order contents. Against that backdrop, the City of New York (“the City”) in 2021 enacted N.Y.C. Administrative Code § 20-563.7 (“the Customer Data Law” or “the Law”), which requires delivery platforms to share with a restaurant, at its request, the rest of that customer information for every customer who has ordered from the restaurant. Three of New York City’s largest delivery platforms—DoorDash, 3 of 25 Grubhub, and Portier (which does business as Uber Eats) (together, “the Platforms”)—sued the City to enjoin the Law. The district court (Torres, J.) held that the Law violates the First Amendment’s protections against compelled speech, granted summary judgment to the Platforms, and permanently enjoined the City from enforcing the Law against the Platforms. On appeal, the City argues that the district court erred in two ways. First, it contends that the Law merely requires the Platforms to disclose information about the service they sell—providing access to customers—and therefore should have been reviewed under the deferential standard of Zauderer v. Office of Disciplinary Counsel of the Supreme Court of Ohio, 471 U.S. 626 (1985), rather than the more demanding intermediate scrutiny of Central Hudson Gas & Electric Corp. v. Public Service Commission of New York, 447 U.S. 557 (1980). Second, it argues that even if intermediate scrutiny applies, the Law survives it. We disagree with the City on both counts and AFFIRM the district court’s judgment. BACKGROUND 1 New York is, among other things, a restaurant city. This case concerns a newer fixture of its restaurant scene—third-party food delivery platforms—and a 1 The material facts are drawn from the summary judgment record and are undisputed. 4 of 25 City ordinance that requires those platforms to share certain customer information with restaurants. I. Third-Party Delivery Platforms Marketplaces have long connected sellers with buyers. Similarly, the plaintiffs here—DoorDash, Grubhub, and Uber Eats—each run an online storefront they call “Marketplace,” where customers can find and order food from local restaurants. Unlike a bazaar or a mall, however, third-party delivery platforms record, and later use, the data generated by each transaction. To order food using DoorDash Marketplace, for example, the customer opens the DoorDash app or website, browses participating restaurants, selects the food they want, enters the information needed for delivery, and pays. DoorDash then transmits their order to the restaurant. While the restaurant prepares the food, DoorDash matches the order with a nearby courier, a “Dasher,” who picks up the food and delivers it to the customer’s door. 2 For its services, DoorDash charges the restaurant a commission on each order. When the order is complete, 2 Not all Marketplace services involve food delivery managed by the Platforms. For example, DoorDash’s Marketplace “Self-Delivery” offering allows restaurants themselves to arrange for delivery of orders placed with them through the DoorDash app or website. J. App’x 4465. And DoorDash’s Marketplace “Pickup” offering, as its name suggests, allows customers themselves to pick up takeout orders placed through DoorDash. Id. at 4466. 5 of 25 DoorDash retains a digital record of the customer’s full name, phone number, email address, delivery address, and order. The Platforms use that data in different ways, including by offering restaurants marketing services. For example, DoorDash can “identify customers who regularly order pizza . . . and then present those customers advertisements, deals, and promotions for new pizza restaurants.” Appellees’ Br. 11; see also J. App’x 4684–85 (explaining how Grubhub uses customer data to tailor restaurant recommendations, manage rewards programs, process payments, detect fraud, and assess security risks). Contracts between the Platforms and participating restaurants typically leave control of customer data with the Platforms. DoorDash’s standard agreement, for example, permits restaurants to use the limited information they receive—again, the customer’s first name, last initial, and the order contents—only to fill orders and provides that customer data “belongs to DoorDash.” J. App’x 4512–13. Grubhub allows restaurants to use customer data more extensively only in “very few” circumstances involving “extremely valuable partnerships.” Id. at 4701. 6 of 25  The Platforms also offer other products that do place customer data in the hands of restaurants. With “DoorDash Drive,” for example, the restaurant takes the order itself but then uses a DoorDash courier to deliver it to the customer. Id. at 4910. And with “Storefront,” DoorDash helps the restaurant create an online- ordering tool on its own website. Id. DoorDash contends it created Storefront “to offer [restaurants] an opportunity to have a direct relationship with customers.” Id. at 4497. Unlike on Marketplace, the information a customer enters in placing a Storefront order stays with the restaurant. Thousands of New York City restaurants use these alternative products. But it is principally Marketplace— under which, as a rule, the Platforms retain customers’ data—that is the focus of the Customer Data Law. II. The Customer Data Law The New York City Council began studying the relationship between restaurants and third-party delivery platforms as early as 2019, when its Committee on Small Business held a hearing on “digital food delivery apps” and their impact “on local restaurants and the food industry.” Id. at 4745. Then came the COVID-19 pandemic. In March 2020, Governor Andrew Cuomo’s “New York State on PAUSE” executive order shuttered on-site dining statewide, leaving 7 of 25 restaurants to operate by takeout and delivery only. At the same time, the Mayor’s office advised restaurants to join delivery platforms. Many did, and as on-site dining collapsed, the platforms became what the City Council’s Committee on Consumer Affairs and Business Licensing later called “a crucial lifeline.” Id. at 4451. In May 2021, Councilmember Keith Powers introduced the bill that became the Customer Data Law. The bill would require platforms to share certain customer information with restaurants. Powers cast the measure as an effort to “strike the right balance and equity between those that hold the information and those that supply the goods and services.” Id. at 661. Supporters framed the bill as a way to loosen the Platforms’ control over restaurants’ customer relationships. Councilmember Diana Ayala explained that customer data is “one of the most important tools restaurants can use to develop marketing strategies and customer relations.” Id. at 4429. The New York State Restaurant Association noted that the Platforms kept restaurants “at arm’s length from their customers, even repeat customers, even their regulars,” preventing restaurants from communicating directly about orders and promotions. Id. at 595. It viewed the bill as a means to “stop the gate keeping by third party platforms” 8 of 25 and “level[] the playing field.” Id. at 596. The New York City Hospitality Alliance similarly warned that restaurants could not leave a Platform without “los[ing] access to their own customers,” even as the Platform used their data to market competing restaurants. Id. at 599. The bill was passed by a significant majority of the City Council and is codified at N.Y.C. Administrative Code § 20-563.7. The Law provides that, at a restaurant’s request, platforms must provide five categories of data about every customer who places an online order from that restaurant through the platform: (1) full name, (2) telephone number, (3) email address, (4) delivery address, and (5) order contents. N.Y.C. Admin. Code §§ 20- 563, 20-563.7(a). The platform must transmit that data “in a machine-readable format, disaggregated by customer, on an at least monthly basis.” § 20-563.7(c). Each customer is “presumed to have consented” to disclosure unless they opt out for that particular order. § 20-563.7(b). III. Procedural History Soon after the Law was enacted, the city’s three largest delivery platforms— DoorDash, Grubhub, and Uber Eats—sued the City to enjoin its enforcement. They argued, among other things, that the Law compelled them to speak in violation of the First Amendment. The City agreed to stay enforcement against 9 of 25 the Platforms while the litigation was pending. On cross-motions for summary judgment, the district court ruled in favor of the Platforms. DoorDash, Inc. v. City of New York, 789 F. Supp. 3d 337, 359 (S.D.N.Y. 2025). The court held that the Law regulates the Platforms’ speech by compelling them to share customer information; that Zauderer’s deferential review did not apply; and that the Law could not survive Central Hudson’s intermediate scrutiny. 3 Id. at 351–52, 355, 359. The court permanently enjoined enforcement of the Law as applied to the Platforms’ Marketplace products. The City appeals. It does not challenge the district court’s holding that the Law regulates speech. It argues instead that the disclosure is subject to Zauderer’s deferential review—not Central Hudson’s intermediate scrutiny—and that, even under Central Hudson, the Law survives. The Platforms disagree. They argue that the Law is a content-based regulation of noncommercial speech subject to strict scrutiny, and that, in any event, the Law fails under any standard. 3 Because the district court held that the Law could not “withstand even intermediate scrutiny,” it did not decide whether strict scrutiny applied. DoorDash, 789 F. Supp. 3d at 355. 10 of 25  DISCUSSION 4 I. Zauderer Does Not Apply The City argues that Zauderer supplies the proper framework for reviewing the Law. We disagree. Zauderer involved a 1980s newspaper advertisement, in which Philip Zauderer, an Ohio attorney, advertised his services to women injured by the Dalkon Shield. Zauderer, 471 U.S. at 629–30. “If there is no recovery,” he promised, “no legal fees are owed by our clients.” Id. at 631. Left unsaid was that those clients could still owe litigation costs, such as filing fees, even if they lost. Ohio’s rules of professional responsibility required attorneys who advertised contingent- fee services to disclose that their clients could remain liable for such costs. Id. at 635–36. Zauderer’s failure to do so drew a public reprimand from the Supreme Court of Ohio. Id. at 636. Zauderer challenged the rule, arguing that a compelled disclosure calls for the same First Amendment scrutiny as a restriction on speech. Id. at 650. The 4 We review a district court’s grant of summary judgment de novo. Conn. Fair Hous. Ctr. v. CoreLogic Rental Prop. Sols., LLC, 167 F.4th 605, 615 (2d Cir. 2026). Summary judgment is proper only where “there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). Because the material facts are undisputed, this appeal presents only questions of law. 11 of 25 Court agreed that “[i]n some instances compulsion to speak may be as violative of the First Amendment as prohibitions on speech.” Id. But the interests at stake in Zauderer’s case were “not of the same order.” Id. at 651. Ohio had not attempted to “prescribe what shall be orthodox in politics, nationalism, religion, or other matters of opinion.” Id. (quoting W. Va. State Bd. of Educ. v. Barnette, 319 U.S. 624, 642 (1943)). It had attempted “only to prescribe what shall be orthodox in commercial advertising,” requiring an advertiser to state accurate facts about the terms of his own services. Id. Because the First Amendment protects commercial speech “principally” for “the value to consumers of the information such speech provides,” Zauderer’s interest in withholding those facts was “minimal.” Id. A State, the Court concluded, may compel a commercial speaker to disclose (1) “purely factual and uncontroversial information” (2) “about the terms under which his services will be available,” so long as the disclosure is (3) “reasonably related to the State’s interest” and (4) not “unjustified or unduly burdensome.” Id. Since then, we have employed Zauderer to sustain compelled disclosures in a number of commercial settings. In New York State Restaurant Ass’n v. New York City Board of Health, for example, we upheld a New York City ordinance requiring certain restaurants to post calorie-content information on their menus because the 12 of 25 City had “demonstrated a reasonable relationship between the purpose of [the] disclosure requirement[] and the means employed to achieve that purpose.” 556 F.3d 114, 134 (2d Cir. 2009). Likewise, in National Electrical Manufacturers Ass’n v. Sorrell, we held that Zauderer governed a Vermont requirement that manufacturers label mercury-containing lamps with disposal information, because the compelled statement was purely factual and reasonably related to the State’s interest in alerting consumers to the mercury in the products they may buy. 272 F.3d 104, 114–15 (2d Cir. 2001). More recently, in CompassCare v. Hochul, we sustained a requirement that employers note in their handbooks the existence of New York’s workplace antidiscrimination protections, treating that notice as a disclosure of information “about the terms under which . . . services will be available,” specifically the terms of employment under New York law. 125 F.4th 49, 64–65 (2d Cir. 2025) (omission in original) (quoting Zauderer, 471 U.S. at 651). Varied as these disclosures were, each reinforced Zauderer’s threshold requirement that, to be lawfully compelled by the State, speech be “about the goods or services the speaker may offer.” Volokh v. James, 148 F.4th 71, 86 (2d Cir. 2025). Calorie counts were about the food restaurants sell, mercury warnings 13 of 25 about the lamps manufacturers make, and antidiscrimination notices about the legal terms of employment. We have rejected calls to apply Zauderer’s deferential standard where the disclosure at issue was not about the speaker’s own goods or services. In Safelite Group, Inc. v. Jepsen, for example, we confronted a Connecticut law that required insurance claims administrators to name a competitor whenever they recommended their affiliated auto-glass shops. 764 F.3d 258, 260 (2d Cir. 2014). We concluded that Zauderer was not a good fit. Every prior application of the exception, we observed, had involved a disclosure “about a company’s own products or services.” Id. at 264. Connecticut’s disclosure requirement, however, was about a third party, there a competitor. That distinction was “important, indeed, dispositive.” Id. The disclosure here—customers’ personal information—is not information “about” Marketplace. Information about Marketplace might, for instance, describe the commissions restaurants pay, how the Platforms rank and display restaurants, or the grounds on which they may deactivate a restaurant’s account. See, e.g., Uber Techs., Inc. v. City of Seattle, 168 F.4th 1202, 1216–17 (9th Cir. 2026) (holding, in the alternative, that an ordinance requiring third-party platforms to 14 of 25 inform their couriers of the grounds for account deactivation satisfied Zauderer because the notice “concerns only the service provided”). The Customer Data Law, by contrast, compels the disclosure of each customer’s name, number, email address, delivery address, and order contents. § 20-563.7. Those are facts about third parties who use Marketplace, not about Marketplace itself. The City resists this straightforward conclusion, insisting that the Platforms’ service is the provision of “access to the customers and their orders,” Appellant’s Br. 36 (emphasis added); thus, the City is of the view that the Law compels disclosure “about the very thing that plaintiffs are offering,” id. at 45. But even if the City’s characterization of Marketplace were right, the compelled disclosure would still have to be about the provision of “access to” those customers. Appellant’s Br. 36; see also Appellees’ Br. 37 (disputing the City’s characterization of Marketplace). Access to something means the “ability to obtain or make use of” that thing. Access, Webster’s Third New International Dictionary (2002). To provide access to customers, then, means giving restaurants the ability to reach them through Marketplace. A disclosure about that service might describe the customer base as a whole, such as its size or expected order volume. It would not simply reveal every customer’s full name and contact information. 15 of 25  Nor does the Customer Data Law serve the purpose animating Zauderer’s deferential review. 5 “Protection of the robust and free flow of accurate information is the principal First Amendment justification for protecting commercial speech, and requiring disclosure of truthful information promotes that goal.” Nat’l Elec. Mfrs., 272 F.3d at 114. That information helps the recipient make “intelligent and well informed” economic decisions about the product, service, or transaction before them. Va. State Bd. of Pharmacy v. Va. Citizens Consumer Council, Inc., 425 U.S. 748, 765 (1976). Commercial-disclosure requirements, in other words, “primarily seek to reduce information costs and thereby to establish a more educated and efficient marketplace.” Robert Post, Transparent and Efficient Markets: Compelled Commercial Speech and Coerced Commercial Association in United Foods, Zauderer, and Abood, 40 Val. U. L. Rev. 555, 584 (2006). A calorie count, for instance, may inform a diner’s choice between a hamburger and a salad—or whether to patronize the restaurant at all. 5 We have sometimes described Zauderer’s standard as “rational basis” review. See, e.g., CompassCare, 125 F.4th at 64–65. At the same time, we have observed that Zauderer, though highly deferential, may ask more of the government than rational basis review does. See Volokh, 148 F.4th at 85 n.6 (observing that “some aspects of the Zauderer analysis are arguably more stringent than traditional rational basis review”). We express no view here on whether Zauderer demands only rational basis review or something more, and we therefore refer to the standard as simply “deferential review.” 16 of 25  The customer data whose disclosure is compelled here serves a different purpose entirely. It identifies people who have already ordered and gives the restaurant the contact information needed to reach them, enabling the restaurant, as the City puts it, “to generate more effective marketing.” Appellant’s Br. 36. That may make the data commercially valuable, but it does not make the restaurant better informed about Marketplace or the terms of Marketplace services. * * * For these reasons, Zauderer does not apply. 6 II. The Law Fails Intermediate Scrutiny What, then, is the applicable level of scrutiny in this case? To start, the Customer Data Law compels the Platforms to convey particular content that they would not otherwise disclose. A regulation of that kind is “content[ ]based,” regardless of the character of the speech it compels. Riley v. Nat’l Fed’n of the Blind of N.C., Inc., 487 U.S. 781, 795 (1988) (“Mandating speech that a speaker would not otherwise make necessarily alters the content of the speech.”). For content-based 6 Because we hold that customers’ personal information is not about the Platforms’ own goods or services, we need not and thus do not decide whether the Customer Data Law also satisfies Zauderer’s other requirements—whether the disclosure is “purely factual and uncontroversial,” “reasonably related to the State’s interest,” and not “unjustified or unduly burdensome.” Zauderer, 471 U.S. at 651. 17 of 25 regulations, the level of scrutiny turns on the kind of speech at issue: Commercial speech receives intermediate scrutiny, Vugo, Inc. v. City of New York, 931 F.3d 42, 49 (2d Cir. 2019); noncommercial speech receives strict scrutiny, Nat’l Inst. of Fam. & Life Advocs. v. Becerra, 585 U.S. 755, 766 (2018). Even on the assumption most favorable to the City, that the Law regulates only commercial speech, it fails Central Hudson’s more permissive review. See Sorrell v. IMS Health Inc., 564 U.S. 552, 571 (2011) (explaining that “the outcome is the same whether a special commercial speech inquiry or a stricter form of judicial scrutiny is applied”); Evergreen Ass’n, Inc. v. City of New York, 740 F.3d 233, 245 (2d Cir. 2014) (declining to decide whether intermediate or strict scrutiny applied because the result was the same under both). To satisfy intermediate scrutiny under Central Hudson, the Customer Data Law must (1) “concern lawful activity and not be misleading,” (2) serve a “substantial” governmental interest, (3) “directly advance[]” that interest, and (4) be “not more extensive than is necessary to serve that interest.” Cent. Hudson, 447 U.S. at 566. No one disputes that the customer data concerns lawful activity and is not misleading. 18 of 25  As for the second and third requirements, the City offers two interests. First, the City seeks to support its restaurant industry, which it describes as central to the City’s economic and cultural life. Second, it intends to protect restaurants from what it views as an unfair competitive restraint—the Platforms’ use of accumulated customer data to keep restaurants dependent on their platforms. And according to the City, the Customer Data Law advances both interests in the same way, by giving restaurants customer data with which to market directly to their patrons. We need not address whether the asserted interests are in fact substantial or whether the Law would directly advance them, because even assuming those requirements were met, the Law fails at the final step. The fourth step of Central Hudson “requires a reasonable fit between the means and ends of the regulatory scheme.” Lorillard Tobacco Co. v. Reilly, 533 U.S. 525, 561 (2001). The fit need not be “perfect,” and the government need not adopt the least restrictive means available. Vugo, 931 F.3d at 52 (quoting City of Cincinnati v. Discovery Network, Inc., 507 U.S. 410, 416 n.12 (1993)). Indeed, the City has “considerable leeway in determining the appropriate means to further a legitimate government interest.” Id. at 58 (quoting Clear Channel Outdoor, Inc. v. City of New York, 594 F.3d 94, 105 (2d Cir. 2010)). But that leeway does not reduce intermediate 19 of 25 scrutiny to rational basis review. Discovery Network, 507 U.S. at 417 n.13. The City must still “affirmatively establish” that the Law’s scope is “in proportion to the interest served.” Bd. of Trs. of State Univ. of N.Y. v. Fox, 492 U.S. 469, 480 (1989) (quoting In re R.M.J., 455 U.S. 191, 203 (1982)). That inquiry considers whether the City has “carefully calculated” the costs and benefits associated with the burden on speech, as well as the existence of “numerous and obvious less-burdensome alternatives.” Discovery Network, 507 U.S. at 417 & n.13. The City has not carried its burden. Two features of the Law’s design, taken together, extend its reach beyond what the City has established its interests require. First, the Law “presume[s]” that every customer consents to having their personal information shared. § 20-563.7(b). Second, the Law requires customers who want to opt out of data sharing to do so on an order-by-order basis. Id. The result is a marketing list that no customer asked to join and that none can be confident they have permanently left. The City has offered no evidence that this design serves its interests better than obvious, substantially less burdensome alternatives would. 20 of 25  A. Presumed Consent Under the Law, whenever a restaurant asks, the Platforms must deliver the personal information of every customer who has ordered from that restaurant. Each customer is “presumed to have consented” to the disclosure unless they opt out, whether or not they ever want to hear from that restaurant again. § 20- 563.7(b). The City could have required an opt-in instead, sharing only the contact information of those who asked to be reached. One of the Platforms already uses an opt-in model. Under certain data-sharing agreements, Uber Eats discloses customer data to restaurants if, and only if, customers affirmatively opt in. An opt- in requirement was also before the City Council. Platform representatives had proposed an amendment while the bill was pending, under which a platform “shall enable customers to consent via an opt-in to the sharing of their customer data.” J. App’x 4438–39. The City’s principal response is that any alternative to the Customer Data Law, including an opt-in, “would likely result in less customer data being shared.” Appellant’s R. Br. 27. But “customer data” is the very speech being compelled. Therefore, any less burdensome alternative would by definition result in less data 21 of 25 being shared. See Tech:NYC Amicus Br. 18. Nor has the City established that its asserted interests are advanced simply by maximizing the amount of customer data shared. The City itself says that a small share of a restaurant’s customers— its “loyal patrons”—generates an outsized share of its orders, and that data about those customers is particularly valuable for “targeted marketing.” Appellant’s Br. 12. On the City’s own telling, then, the usefulness of customer data depends in part on whose data is shared, not simply how much is shared. Even if the City had shown that a presumption of consent is more effective than an opt-in, “[t]he question is not whether the [regulation] is the most effective disposition or is more effective than proposed alternatives.” Art & Antique Dealers League of Am., Inc. v. Seggos, 121 F.4th 423, 442 (2d Cir. 2024). Rather, it is whether the “scope [of the regulation] is in proportion to the interest served.” Id. (quoting Long Island Bd. of Realtors, Inc. v. Village of Massapequa Park, 277 F.3d 622, 627 (2d Cir. 2002)). For that reason, if the government imposes “an extraordinarily severe restriction on speech” when “a much less intrusive alternative would have been nearly as effective in achieving [its] asserted interest,” the requisite “fit between the restriction and the interest” may be lacking. Id. The City must show that its 22 of 25 asserted interests would not be “adequately served by other measures that would be less burdensome.” Id. The City has not made that showing. An opt-in would withhold from restaurants only the data of customers who had not affirmatively agreed to share it. Perhaps outreach to those customers would generate repeat orders often enough to advance the City’s asserted interests. Perhaps it would instead be ignored, deleted, or blocked as spam. The City offered no evidence either way. Compare N.Y. State Ass’n of Realtors, Inc. v. Shaffer, 27 F.3d 834, 843–44 (2d Cir. 1994) (holding that a neighborhood-wide ban on real estate solicitation failed Central Hudson’s final step because the State had offered “no evidence of any kind” that a “narrower, resident[-]activated measure” was inadequate), with Anderson v. Treadwell, 294 F.3d 453, 462 (2d Cir. 2002) (later holding the same resident-activated registry satisfied Central Hudson’s final step because its reach was “precisely co- extensive” with the homeowners who had asked not to be solicited). To be sure, the City argues that restaurants’ need for customer data is “self-evident” and a matter of “common sense.” Appellant’s R. Br. 24. But such conjecture does not “affirmatively establish” why consent must be presumed. Fox, 492 U.S. at 480. 23 of 25  B. Repeated Opt-Outs Even when a customer does opt out, that refusal does not last. A customer who declines to consent on Monday’s order is “presumed to have consented” on Tuesday’s. § 20-563.7(b). The Law nowhere lets a customer opt out once and for all. See J. App’x 420 (the City admitting that customers “must opt out of sharing each time they place an online order . . . otherwise, the Customer Data will be shared”); id. at 945 (report opposing the bill while it was pending, warning that it “does not permit consumers to opt-out of data sharing generally and permanently”). The City could have kept a presumption of consent and let a customer’s refusal stand until withdrawn. A standing opt-out would thus deny restaurants only the data of customers who refused once and kept ordering. Without deciding whether such a statute would survive intermediate scrutiny, we observe that a standing opt-out regime could still advance the City’s asserted interests while compelling less speech. The City responds that customers who keep ordering from a restaurant are among those “most receptive to communications.” Appellant’s Br. 53. But a new order shows continued interest in the restaurant’s food, not necessarily a change of mind about sharing personal information or 24 of 25 being solicited. Beyond saying that any alternative would result in less data shared (i.e., less speech compelled), the City identifies no reason, and offers no evidence, as to why customers must repeat the same refusal with every single order. See Fox, 492 U.S. at 480. * * * For these reasons, the Customer Data Law fails intermediate scrutiny. CONCLUSION We hold that the Customer Data Law violates the First Amendment as applied to the Platforms’ Marketplace products. Zauderer’s deferential review does not apply to the Law because the Law compels the disclosure of information about third parties who use Marketplace, not information about Marketplace itself. The Law must therefore satisfy at least intermediate scrutiny under Central Hudson. It fails that standard because the City has not carried its burden to establish a reasonable fit between its asserted interests and the means the Law employs to advance those interests. The judgment of the district court is AFFIRMED. 25 of 25 25-81 DoorDash, Inc. v. City of New York PARK, Circuit Judge, concurring: Today’s opinion correctly concludes that New York City’s Customer Data Law is unconstitutional because the City fails to establish a “reasonable fit between the means and ends of the regulatory scheme.” Lorillard Tobacco Co. v. Reilly, 533 U.S. 525, 561 (2001). The opinion focuses on two relatively technical aspects of the Law—presumed consent and order-by-order opt-outs—that fail under the fourth prong of Central Hudson Gas & Electric Corp. v. Public Service Commission of New York, 447 U.S. 557 (1980). I agree with the opinion in full but write separately to note a deeper problem. The Law compels speech for nothing more than economic favoritism. The City’s stated goal is to “support the restaurant industry” by requiring delivery platforms to disclose valuable customer data to restaurants. Appellant’s Br. 1. The Law’s sponsor explained that the objective was to “strike the right balance and equity between” platforms and restaurants and to “give” restaurants “a better opportunity to compete.” Joint App’x 661 (Transcript of June 8, 2021 Hearing of New York City Council Committee on Consumer Affairs and Business Licensing). 1 of 3  A vague desire to support an industry comprised of tens of thousands of stores is not the type of interest that can justify abridging the freedom of speech of disfavored competitors. Under Central Hudson, we “ask whether the asserted governmental interest is substantial.” 447 U.S. at 566. To determine which interests qualify as substantial in the compelled commercial disclosure context, “history and tradition are reliable guides.” Am. Meat Inst. v. U.S. Dep’t of Agric., 760 F.3d 18, 31 (D.C. Cir. 2014) (en banc) (Kavanaugh, J., concurring in the judgment). For example, the “Government has long required commercial disclosures to prevent consumer deception or to ensure consumer health or safety,” and “[t]hose interests explain and justify” compelled disclosures like “nutrition labels and health warnings.” Id. But here, the City does not even offer consumer protection as a pretext (nor could it because the Law would actually harm consumers by disclosing their personally identifiable information without consent, see ante at 21–25). In Safelite Group, Inc. v. Jepsen, 764 F.3d 258 (2d Cir. 2014), we enjoined the enforcement of a statute that was “highly likely to further covertly protectionist, rather than consumer information, goals” “by protecting” certain businesses against others. Id. at 259, 264. The Law here similarly—but overtly—seeks to 2 of 3 advance protectionist goals by requiring delivery platforms to turn over valuable data for the sole aim of supporting restaurants. I do not think that is a substantial governmental interest under Central Hudson. 3 of 3