
This paper examines the impacts of data privacy regulations (such as the General Data Protection Regulation), on the on-demand food-delivery market. Specifically, we consider a food-delivery platform that determines order bundling, order assignment, and courier payments at each step, alongside a group of couriers who make short-term decisions on whether to accept assigned orders and long-term decisions on whether to allow the platform to use their historical behavioral data (e.g., order acceptance and rejection history) for operational decision-making. We formulate a Markov Decision Process (MDP) to simulate the platform’s operational strategies and a Multi-Agent Contextual Multi-Armed Bandit (MA-CMAB) framework to simulate the couriers’ decisions under the data privacy regulation. The platform’s MDP involves mixed-integer decisions, and a novel hybrid multi-agent reinforcement learning framework is proposed to combine a Double Deep Q-Network (DDQN) for discrete order assignment strategies and Proximal Policy Optimization with KL and CLIP (PPO-KL-CLIP) for continuous payment decisions. For the couriers, we develop a Maximum Likelihood Estimation (MLE)-based Thompson Sampling method to derive their optimal strategies. To address the interaction between the platform and the couriers, we employ a two-stage training framework that the first stage trains a general policy for the platform that adapts to any courier strategy, while the second stage derives the optimal strategies for the couriers. The proposed model and algorithm are validated using real-world food-delivery data from Hong Kong, comparing scenarios under data privacy regulations with a benchmark case without such regulations. Interestingly, the findings reveal that, contrary to initial expectations, data privacy regulations not only protect couriers but may also result in higher platform profits and improved customer experiences. By giving couriers the flexibility to decide whether to share their work-related data for order assignments and payment decisions, the regulations attract more active couriers, thereby improving overall system performance. Specifically, the number of active couriers increases under regulation, particularly during peak hours, leading to more food-delivery orders served and higher platform profits. Customers also benefit from shorter delivery times and lower overtime rates. These findings highlight the potential of data privacy regulations to reshape labor dynamics in the gig economy, creating a win-win scenario for platforms, couriers, and customers. The code of this paper is publicly available at https://github.com/RS2002/GDPR-Food-Delivery .