Consumer Apps · Restaurant/Loyalty App · Structural / no discrete incident
Chipotle
Headline
The exact same practice under scrutiny across the restaurant industry — charging MORE for delivery orders than in-store pickup, sometimes 13% higher on the same menu items…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
The exact same practice under scrutiny across the restaurant industry — charging MORE for delivery orders than in-store pickup, sometimes 13% higher on the same menu items — has been specifically tested by Chipotle, per industry reporting, even as the underlying delivery FEE is marketed separately as if it's the only added cost.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected for the customer-facing app specifically.
Data sharing
An October 2025 breach compromised EMPLOYEE Workday payroll accounts (not the customer-facing rewards app) — attackers gained 'unauthorized logins' (Chipotle attributed the incident to phishing; reports of attempted direct-deposit changes to divert paychecks were not independently verified this pass), potentially exposing names, Social Security numbers, birthdates, and bank account/routing numbers. A resulting employee class action (Jasso v. Chipotle, seeking to represent 'thousands' of employees, ~$5M+ at stake) was filed in Jan 2026 alleging 'wrongful, reckless, and grossly negligent' data security — but the named plaintiff, Christian Jasso, voluntarily DISMISSED the suit (C.D. Cal.) on or about Feb. 10, 2026 (without prejudice, meaning it could theoretically be refiled), leaving the underlying breach's legal resolution unclear as of this research.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. PUBLIC COMPANY (CMG). Service route: c/o General Counsel / Corporate Secretary, Newport Beach, California — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy chipotle.com/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service chipotle.com/terms-of-use | Not fetched yet | NO (HTML only) |
| Website chipotle.com | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: California. Provisions of CCPA/CPRA on file:
| Provision | Type | Source |
|---|---|---|
| Right to Deletion Cal. Civ. Code § 1798.105 | hard | source |
| Right to Correction Cal. Civ. Code § 1798.106 | hard | source |
| Right to Know / Access Cal. Civ. Code § 1798.110 | hard | source |
| Right to Limit Use of Sensitive Personal Information Cal. Civ. Code § 1798.121; Cal. Code Regs. tit. 11, § 7027 | hard | source |
| Right to Data Portability Cal. Civ. Code § 1798.130(a)(3)(B)(iii) | hard | source |
| Privacy Policy / Privacy Notice Requirements Cal. Civ. Code § 1798.130(a)(5); Cal. Code Regs. tit. 11, § 7011 | hard | source |
| Sensitive Personal Information — Categories Cal. Civ. Code § 1798.140(ae) | hard | source |
| Service Provider and Contractor Contract Requirements Cal. Civ. Code § 1798.140(ag); Cal. Code Regs. tit. 11, § 7051 | hard | source |
| Applicability Threshold (2025 CPI-Adjusted) Cal. Civ. Code § 1798.140(d) | threshold | source |
| Privacy Risk Assessment — Mandatory for High-Risk Processing (Eff. Jan. 1, 2026) Cal. Civ. Code § 1798.185(a)(15); Cal. Code Regs. tit. 11, §§ 7150-7157 | hard | source |
| Right to Opt Out of Sale or Sharing Cal. Civ. Code §§ 1798.120, 1798.135 | hard | source |
| Sale vs. Sharing Distinction Cal. Civ. Code §§ 1798.140(ad), 1798.140(ah) | hard | source |
| Enforcement — CPPA and AG; Civil Penalties (2025 CPI-Adjusted) Cal. Civ. Code §§ 1798.155, 1798.199.90; Cal. Bus. & Prof. Code § 17206 | hard | source |
| Notice at Collection Cal. Code Regs. tit. 11, § 7012 | hard | source |
| Cybersecurity Audit — Annual Independent Audit Requirement (Eff. Jan. 1, 2026) Cal. Code Regs. tit. 11, §§ 7120-7124 | hard | source |
| Automated Decision-Making Technology (ADMT) — Notice, Opt-Out, and Access Rights Cal. Code Regs. tit. 11, §§ 7200-7222; Cal. Civ. Code § 1798.185(a)(16) | hard | source |