A restaurant searching hundreds of millions of delivery customers becomes a controller of that data.

In July 2026 SevenRooms launched Global Guest Search, letting restaurants search DoorDash and Deliveroo consumers.

SevenRooms launched a feature on 21 July called Global Guest Search. It lets restaurants search what the company describes as hundreds of millions of eligible DoorDash and Deliveroo consumers, so a host can recognise a guest they have never served before.

Read one way this is the reverse of what I wrote about in May. Then the argument was that a booking through a platform channel leaves the operator with the cover and the platform with the guest. This runs the other direction. DoorDash is pushing consumer data down to the restaurant rather than holding onto it. If you are a SevenRooms customer that is real value and I’m not going to pretend otherwise.

What the announcement doesn’t cover is what information comes across. If a restaurant is seeing its own past takeaway customers, most people would find that fair enough, though it’s still a different purpose from getting food delivered to the door. If the pool is genuinely hundreds of millions, it includes people that restaurant has never dealt with in any form. The announcement covers both with the same sentence.

Then you read the privacy policies. Deliveroo’s UK customer policy was published on 18 May. It describes one route by which a restaurant gets your details. You make a dine-in booking request through Deliveroo, or you contact the restaurant yourself and quote your phone number, and Deliveroo shares your name and email to facilitate that booking. It also says partners get the minimum needed to fulfil your order, and it allows sharing inside the DoorDash group where necessary for those purposes. SevenRooms lives inside that group, so there is a path. What’s not in there is anything preparing a customer to be searchable by a restaurant they have never ordered from.

The SevenRooms policy was updated on 16 June, five weeks before this launched. It still says guest information goes only to the venue where the reservation was made, and that venues cannot use the platform to reach other venues’ guests. DoorDash and Deliveroo do not appear in it as a source of guest data flowing to venues. On GDPR it positions SevenRooms as a processor acting for the venue, which does not describe a flow where the venue never collected the data and never asked for it.

Wherever that gap lies, it’s not with the platform. A restaurant receiving personal data about someone it has never served becomes a controller of it, and owes that person a notice saying what it holds and where it came from, usually before it ever contacts them. The SevenRooms master agreement already puts guest notices, data subject requests and opt-outs on the client, which is the restaurant.

None of this makes the feature unlawful. There are answers that would settle it. They’re just not published.

So, four questions. What information comes across? Which consumers are eligible and how did they become eligible? Which markets is it live in? And when a guest asks the restaurant where it got their details, who answers?