Miami-Dade sets table for food delivery app regulations amid privacy concerns

Image via AP.

App-based food delivery services operating in Miami-Dade could soon face new regulations — and up to $10,000 in daily fines — under a proposed ordinance being considered by the County Commission.

Proponents like Commissioner Kionne McGhee, the measure’s sponsor, and the Digital Restaurant Association (DRA) say it will improve communication between restaurants and customers while bringing much-needed transparency and accountability to the companies linking them.

Its detractors, including the tech-focused and tech-funded Chamber of Progress, warn it will expose people’s private information without their consent and invite unwanted contact.

The proposed ordinance, which cleared an introductory reading June 21 by an 8-1 vote, would create Miami-Dade’s first set of operational standards for food delivery services.

Among other things, it would require companies like DoorDash, Grubhub and Uber Eats to clearly itemize for customers the cost breakdown of transactions, including the price of food, delivery, tips, commissions and promotional fees.

Though the companies largely do it already, the measure would codify requirements that the services must disclose to customers the method of delivery, anticipated date and time of the delivery, the name of the person performing the delivery, if applicable, and confirmation of the delivery.

Notably, the ordinance would alter the degree to which delivery apps function as intermediaries between restaurants and customers by requiring that both parties receive the other’s contact information.

That change would be minimally impactful on restaurants, almost all of which publicly share their names, locations, phone numbers and email addresses.

But the measure could lead to consumers being contacted with offers, advertisements and other marketing communications long after the transaction ended.

It’s a possibility the ordinance itself contemplates: “Subject to applicable privacy laws, a food delivery platform may not unreasonably restrict a public food service establishment from directly marketing to or contacting a customer obtained through the food delivery platform.”

That “applicable privacy laws” condition is vital. Florida’s new Digital Bill of Rights, which Gov. Ron DeSantis signed in June, requires major companies to ask consumers to opt in on sharing their personal data.

But there is no mention of opting in or out in the ordinance itself, which the Chamber of Progress noted in an Aug. 9 letter to Miami-Dade Commission Chair Oliver Gilbert III.

“In the proposed legislation, data sharing requirements pose privacy risks for customers and cybersecurity risk for restaurants … circumvent (the) consumer’s privacy rights and force sensitive personal details to be widely shared,” wrote Kouri Marshall, one of the group’s directors of state and local public policy.

Miami-Dade Commissioner Raquel Regalado, who cast the sole “no” vote in June, said the measure works counter to county privacy priorities.

“As a county, we are moving away from collecting personal information (because) of the risk and potential liability,” she told Florida Politics by text. “This ordinance is in conflict with this trend.”

The measure includes steep civil penalties for delivery services, including a $10,000-per-violation fine for restricting restaurants from using customer information to market to them directly. Apps would face $10,000-per-day fines for listing restaurants without their permission, not clearly providing to restaurants their terms and conditions, or for limiting the number of transactions businesses could dispute.

That last change is sorely needed for a business arrangement in which delivery companies hold significant advantages over the food establishments they rely upon, a DRA spokesperson said.

As noted by the Financial Times, the Digital Restaurant Association has ties to former Uber CEO Travis Kalanick, whose CloudKitchens startup of so-called “ghost kitchens” stands to gain greatly from the ordinance’s passage.

“When a customer is unhappy with their delivery — if it’s cold because the driver had to deliver to other addresses beforehand or the food has ingredients a customer is allergic to — the refund comes from the restaurant. So, at the end of the month, the apps go back to the restaurants and say, ‘You sold $10,000 worth of food but had $2,000 worth of disputes; here’s $8,000,’ and restaurants have no way to dispute that,’” the spokesperson said.

He added that the ordinance will bring standards for delivery apps in line with other digital services.

“When you use Orbitz or Expedia, the hotel and rental car companies get all your information,” he said. “Delivery apps are the only place where they don’t share the consumer’s information with the business they’re using — restaurants that are actually handling our food and know their products far better than the apps.”

In a phone interview, McGhee pushed back on the suggestion his ordinance will expose people’s sensitive data. He said people’s private information “would not be disclosed outside what is already disclosed,” such as their names, addresses and phone numbers.

However, he also vowed to modify the measure’s language “to make it even tighter.”

McGhee’s ordinance, next up for a public hearing Sept. 11 at the Chairman’s Policy Council & Intergovernmental Affairs Committee, differs from similarly targeted regulations outside the Sunshine State.

As Miami Today detailed, a recently effective Portland law caps the amount of money food delivery services can take from restaurants at 15% for delivery orders and 4% for takeout. No such caps exist in the Miami-Dade measure.

In Texas, it’s illegal for apps to charge restaurants fees unless it is agreed to in writing. California prohibits apps from charging more than what restaurants do for menu items. And similar to the proposal in Miami-Dade, an Iowa law that passed last year bars apps from offering deliveries from restaurants with which they do not have an agreement.

“It doesn’t let a third party delivery system just take Mike’s logo and take Mike’s menu and put it in their mobile app because a consumer believes you have a relationship and Mike does not have any idea who it is,” Iowa Restaurant Association President and CEO Jessica Dunker told PBS in May 2022.

“It also has a certain amount of liability so that if the driver runs over someone with a car it isn’t Mike’s fault that that has happened.”