DoorDash

Is DoorDash safe to use?

Your card is safe enough on DoorDash; your personal data is less so. The company has disclosed three breaches since 2019, the most recent in late 2025, and its App Store label lists location, purchases and contact info among data used to track you across other companies' apps. Regulators have also acted on how it treats people's data and money: California fined it for selling customer data without an opt-out, and New York and Washington DC made it pay over how Dashers' tips were used. We score it 42/100, among the lowest of the ride and delivery apps we cover, though Grubhub (40) and DiDi (41) sit lower.

Three data breaches in six years

The first came to light in September 2019. DoorDash said an unauthorised party, working through a third-party service provider, reached data on about 4.9 million customers, Dashers and merchants. For people who joined before 5 April 2018 it exposed names, emails, delivery addresses, order histories, phone numbers and hashed passwords, as well as the last four digits of some cards, and about 100,000 Dashers' driver's licence numbers. The breach is less than ten years old, so it still counts in our score.

In August 2022 DoorDash said it had spotted suspicious activity from a vendor's network. The vendor had been phished, and the attackers used stolen staff credentials to reach some of DoorDash's internal tools. A spokesperson linked it to the attack on Twilio earlier that month, part of a wider campaign that tricked staff at many companies into typing one-time codes into fake login pages. Customers' names, emails, delivery addresses and phone numbers were exposed, and for a small group, basic order details and the type and last four digits of their card.

The third was disclosed in November 2025. An employee was targeted by a social engineering scam, and an unauthorised party got into internal systems. Names, addresses, email addresses and phone numbers of customers, Dashers and merchants were exposed. DoorDash said no Social Security numbers, ID documents, or bank or card details were taken, and that Wolt and Deliveroo customers were not affected. It did not say how many people were involved.

None of the three exposed full card numbers. All three exposed exactly what a phishing caller needs: your name, your address and a reason to believe they are from DoorDash.

What the app shares for advertising

The DoorDash app is published by DoorDash, Inc. and rated 13+. Its Apple privacy label lists purchases, location, contact info, identifiers and usage data under "Data Used to Track You". For third-party advertising it links purchase history, precise and coarse location, your address, email and device IDs to you. For its own marketing it also collects contacts, search and browsing history.

California's attorney general showed where that can lead. On 21 February 2024 the state settled with DoorDash for a $375,000 civil penalty under the California Consumer Privacy Act. Its investigation found that in January 2020, the first month the law was in force, DoorDash traded California customers' names, addresses and order histories to a marketing cooperative so it could advertise to other businesses' customers, without notice or a way to opt out. DoorDash must now review its contracts with marketing and analytics vendors.

Tips and fees

The largest penalty concerns Dashers' tips. On 24 February 2025 New York's attorney general announced a $16.75 million settlement. From 2017 to September 2019, DoorDash's pay model used part of customers' tips to fund the pay it guaranteed Dashers, so a bigger tip often did not raise a Dasher's pay. Washington DC settled a similar case for $2.5 million in November 2020. DoorDash says the model was retired in 2019 and disputes wrongdoing, and it says Dashers now receive 100% of tips.

These are consumer-protection cases rather than privacy fines, but they go to whether the app tells you the truth about where your money goes.

Delivery scams to watch for

DoorDash has little user content, so harassment is rarely the problem. The scams are about your account. A local news report in October 2026 described criminals calling or texting customers as "support", claiming a problem with an order and asking for a one-time code. With it they take over the account and place large orders from fake restaurants they control. Dashers and restaurants get offers of free equipment that are really attempts to collect logins and Social Security numbers.

Compare Uber Eats, which faces the same scams and has a similar tracking label.

How to use DoorDash more safely

1. Never read out or forward a code sent by DoorDash. Real support does not ask for one.
2. Hang up on any call about your order and check it in the app yourself.
3. Use a unique password and remove saved cards you no longer use.
4. On iPhone, tap "Ask App Not to Track". In US states with privacy laws, use DoorDash's privacy request options to opt out of sale and sharing.
5. Leave contact syncing off; the app does not need your address book to deliver food.
6. After each breach notice, expect phishing that uses your real name and address.

How we scored it

Privacy (33) and security (38) are the weakest factors: a tracking label that covers location and purchases, a confirmed data sale, and three breaches since 2019. Regulatory record (48) reflects repeated settlements in California, New York and Washington DC. Scams and harmful content (58) is the strongest, since the main risk is phishing rather than harm from other users. For a shopping app with a similar label, see Walmart (51).