Grubhub

Is Grubhub safe to use?

Grubhub will deliver your dinner, but it is one of the weaker delivery apps we cover on data and on straight dealing with customers. It disclosed breaches in February 2025 and January 2026, its Apple label lists precise location and purchases among data used to track you, and in December 2024 the FTC and Illinois charged it with hiding fees, locking people out of their gift-card money and listing restaurants that had never agreed to work with it. We score it 40/100, just below DoorDash (42) and Uber (46).

Two breaches in a year

In early February 2025 Grubhub said it had traced unusual activity to an account belonging to a contractor that worked for its support team. The intruder reached contact information for diners, merchants and drivers who had dealt with customer care: names, email addresses and phone numbers. For some campus diners the card type and last four digits were taken, and hashed passwords from "certain legacy systems" were exposed. Grubhub said Marketplace passwords, full card numbers, bank details and Social Security numbers were not touched, and it removed the contractor from its systems.

In January 2026 Grubhub confirmed a second incident: "unauthorized individuals" had downloaded data from some of its systems. It said financial information and order history were not affected but did not say whether customer data was. Sources told BleepingComputer that the ShinyHunters group was trying to extort Grubhub over data from its Salesforce and Zendesk support systems, which Grubhub did not confirm.

A few weeks earlier, on 24 December 2025, scam emails promising a tenfold return on Bitcoin went out from addresses on b.grubhub.com, a real Grubhub subdomain used to write to restaurants. Grubhub said it contained the problem. We found no public bug bounty for Grubhub on HackerOne or Bugcrowd.

The FTC case: fees, frozen accounts and fake listings

On 17 December 2024 the FTC and the Illinois attorney general sued Grubhub, and Grubhub agreed to settle; the court entered the order on 31 December. The complaint said:

• Grubhub advertised low or free delivery, then added "service" and "small order" fees that were really delivery charges, so the final price was often more than double the advertised one.
• It blocked accounts that held large gift-card balances without warning. In one month, 97% of the accounts it locked were never unlocked.
• Since at least 2019 it had listed up to 325,000 restaurants that had not agreed to be on Grubhub, more than half the restaurants on the app.
• It told New York drivers they could earn up to $40 an hour when the median was about $10.

The judgment was $140 million, suspended to $25 million because Grubhub could not pay more. Grubhub must now show the full cost of delivery, tell people when it blocks an account and offer an appeal, make Grubhub+ easy to cancel with a yearly reminder, and list restaurants only with their consent. In August 2026 the FTC sent more than $23.8 million to 640,038 drivers and diners.

It was not the first fee case. In December 2022 Grubhub paid $3.5 million to settle a Washington DC lawsuit over hidden fees and deceptive marketing, including $2.7 million for local customers.

What the app shares

Grubhub's Apple label is long. Under "Data Used to Track You" it lists purchase history, precise and coarse location, name, email, phone number, identifiers, usage data and other data. For its own marketing it also links search and browsing history to you. Google Play says installed apps and your phone number may be shared for advertising.

The privacy policy, in effect since 5 January 2026, says Grubhub shares identifiers, commercial information and internet activity with ad networks for targeted ads, but not payment data or geolocation. That sits awkwardly with an Apple label that lists precise location as tracking data; we score on the broader of the two. Grubhub says it does not sell data for money, offers a "Do Not Sell or Share" opt-out without needing an account, and says it will try to recognise the Global Privacy Control browser signal where the law requires it.

Grubhub has been owned by Wonder, the food company founded by Marc Lore, since 7 January 2025.

How to use Grubhub more safely

1. Use the "Do Not Sell or Share My Personal Information" page, and turn on Global Privacy Control in your browser.
2. On iPhone, tap "Ask App Not to Track"; on Android, check which permissions the app has.
3. Compare the menu price with the checkout total before you pay, and check what Grubhub+ includes before you subscribe.
4. Do not keep a large gift-card balance in your account.
5. Treat emails from Grubhub addresses that ask for money, crypto or logins as scams; real offers appear in the app.

How we scored it

Privacy (33) is the weakest factor: a tracking label that covers location and purchases, and ad sharing confirmed in the policy. Security (38) follows from two breaches in a year and no public bug bounty. Regulatory record (42) reflects the $25 million FTC and Illinois settlement and the earlier DC case, both about harm to diners. Scams and harmful content (52) is the strongest, since the app has little user content.