The FTC sanctions Uber-owned alcohol delivery company Drizly and its CEO for data privacy abuses; Drizly will have to implement new data controls and training
Cat Zakrzewski / Washington Post :
Context & Ripple Effects
Drizly arrived at the FTC's doorstep via acquisition: Uber paid $1.1B for the alcohol delivery startup in early 2021 with co-founder and CEO Cory Rellas expected to stay on, and by that summer the agency was already probing the deal and Uber's Gopuff partnership on anti-competitive grounds as part of an antitrust review. Today's action shifts the attack surface from competition to privacy — and, unusually, names the CEO himself as a sanctioned party.
The timing matters for what came after: Uber kept running Drizly 'independently within the Uber family' and even folded it into its advertising plans before ultimately shutting the service down in January 2024. A consent decree imposed mid-life constrains how much user data the business could monetize during exactly the window Uber was trying to build an ads product around it.
First-order effects
- Drizly must implement new data controls and employee training under FTC supervision, raising its compliance costs while operating inside Uber.
- CEO Cory Rellas is personally sanctioned — a direct hit to the executive Uber retained at acquisition, and a precedent that liability follows the founder into the acquirer.
Second-order effects
- The sanction compounds the scrutiny from the FTC's earlier antitrust review of the Drizly purchase, giving regulators two parallel lines of attack on the same deal.
- Any plan to personalize or advertise against Drizly's user data — the direction Uber's ads push was heading — now runs up against court-mandated data limits, devaluing part of what Uber paid $1.1B for.
Third-order effects
- If the pattern holds — this case, then the FTC's later amended complaint with 21 states and DC over Uber One billing practices — privacy and consumer-protection enforcement becomes a recurring, escalating tax on large platforms rather than a one-time settlement.
- Sanctioning CEOs individually points toward personal accountability becoming standard in data-privacy cases, changing how founders price acquisition risk and how acquirers diligence a target's data practices.
The trend: The FTC is moving from isolated privacy settlements toward sustained, multi-front enforcement against the same platform companies — including holding their executives personally liable — making data-governance failures a structural cost of M&A.