Candy Crush Saga

Is Candy Crush safe?

Candy Crush Saga is safe in the way most people mean it. There is no violent or sexual content, players cannot message strangers freely, and we found no fine or regulatory order against the game in its 14 years on the App Store, although EU consumer authorities opened an action over its in-game currency in September 2026. Where it does poorly is privacy. Apple's label lists six kinds of data that King may use to track you across other companies' apps and websites, and King's own policy says it switches on targeted advertising by default wherever the law allows.

We score it 57/100. That puts it level with Fortnite, which has much better privacy but a record of heavy fines, and ahead of Coin Master, whose spins work like a slot machine.

What data Candy Crush collects

The label King gave Apple is long for a puzzle game. Data used to track you covers purchases, coarse location, contact info, user content, identifiers and usage data. Linked to your identity, it adds your contacts, photos or videos and crash data. For third-party advertising specifically, King lists coarse location, your device ID and advertising data.

The privacy policy, last updated in February 2026, fills in the picture. Location is collected at state or country level from your device settings, not by GPS. Advertising partners receive your ad identifier and device details and, in King's words, "will combine this information with information which they have collected about you". King's partner page lists 188 companies, from large ad exchanges to small measurement firms. Under California law King says it sells or shares internet activity, inferences and coarse location with those partners.

That matters because ad auctions leak. In January 2025 a hacked data broker, Gravy Analytics, had millions of location records published online. The data came from real-time bidding, the auctions that decide which ad an app shows, and Candy Crush was among the apps named in the list of sources. King was not accused of selling that data, but the episode shows where ad-supported games send information once it leaves the app.

Spending: the real risk for most players

Candy Crush is free and makes its money from small purchases. Among the top purchases the App Store lists, extra moves and extra lives cost $0.99 and gold bar packs run from $0.99 to $7.99. The offers are timed for the moment you run out of moves a few candies short of a win. There are no loot boxes or random prizes in Candy Crush Saga, which keeps it out of the gambling debate that surrounds Coin Master, but the small, frequent charges add up.

The game has no spending limits or parental controls of its own. Control sits with the phone: Apple's Ask to Buy and Screen Time, or Google Play's purchase authentication.

Contact with other players

Most of the game is solo. King's policy says some of its games let players message each other, and that usernames and chat messages can stay cached on other players' devices even after you delete your data. This is a far smaller channel than the open voice and text chat of shooters or Roblox, and we found no pattern of grooming or harassment cases tied to Candy Crush.

Offers of free gold bars or unlimited lives outside the game, and modified copies of the app, are a common way to hand over a Facebook login or install something unwanted. Download only from the official stores.

Who owns Candy Crush, and the EU action

King, the studio behind Candy Crush, belongs to Activision Blizzard, which Microsoft bought in October 2023. Microsoft's Xbox announcement of the deal names Candy Crush Saga among the franchises joining Xbox. The game still runs under King's own privacy policy rather than Microsoft's.

On 30 September 2026 the EU's Consumer Protection Cooperation network opened coordinated actions against nine game companies, including King.com Operations (Malta) Limited, after a market check flagged Candy Crush Saga for further assessment. The authorities are looking at how virtual currencies such as gold bars are sold, whether real-money prices are clear, whether players are pushed to buy more currency than they need, the 14-day right of withdrawal and safeguards for children. An opened action is not a finding and King has not been fined, so we take three points off the regulatory score, the same as for Minecraft, and will update the page when the authorities report.

How to play Candy Crush with less tracking

1. On an iPhone, tap "Ask App Not to Track" when the game asks. On Android, delete or reset your advertising ID in Google settings.
2. Inside the game, open the settings and the privacy section and switch off targeted advertising. King stores this choice in a cookie or tied to your ad ID, so resetting the ID can bring targeted ads back.
3. Refuse the contacts permission unless you want to invite friends.
4. Turn on purchase approval for children: Ask to Buy on iPhone, or a password for every purchase in Google Play.
5. To delete your data, King asks you to remove its games from your devices first and then send a request through its support pages. Unspent gold bars and progress are lost for good.

How we scored it

Regulatory record (82) is Candy Crush's best factor: no fine or order names the game, three points below the 85 for a clean record, because of the EU consumer action opened in September 2026. Scams and harmful content (72) is strong because there is little contact with strangers. Privacy (40) is its weakest factor, held down by the broad tracking label, targeted ads on by default and a long list of ad partners.