Coupang

Is Coupang safe to use?

For getting a parcel to your door by morning, Coupang works. For keeping your personal data safe, it has the weakest record of any large shopping app we score. In 2025 a former employee read about 33 million Coupang accounts for seven months without being noticed. Korea's privacy regulator then found the company had also been storing members' visits to other websites and apps without consent. We score Coupang 34/100, below Temu (42) and well below its own food-delivery app Coupang Eats (47), which shares the account but not most of the findings.

Coupang is Korea's largest online retailer, with more than 50 million Google Play downloads. It sells its own stock and private-label goods next to hundreds of millions of listings from outside sellers. One Coupang account covers shopping, Coupang Eats and Coupang Play.

What happened in the 2025 breach

The Personal Information Protection Commission (PIPC) published its findings in June 2026. The attacker had built Coupang's backup login system before leaving the company at the end of 2024, and could still use its signing key, which staff could view in plain text and which was never replaced after he left. After a test in January 2025, he forged login tokens and walked through account pages from April to November 2025.

He took names and emails from 33,057,012 member accounts, almost 64 million shipping-address entries belonging to 22.4 million members, 4,226 unmasked building door codes and the order lists of 58,349 members. Counting every page he opened, the PIPC put the total at 33,222,472 member accounts. At least 4,338,368 people who were not members were exposed because they sat in someone else's address book, which brings the PIPC's count to about 37.6 million people. Coupang only noticed when customers reported blackmail emails in November 2025.

The PIPC said this was "not sophisticated hacking" but missing basic controls. More than 44 million tokens for accounts that did not exist went unnoticed. Coupang also deleted about five months of web logs after the regulator ordered it to keep them, and kept 2.5 million address entries and 318,000 bank account numbers of former members that its own rules said should be gone. It fined Coupang ₩423.6 billion for the breach plus ₩16.8 million for late notice and late deletion.

Tracking you on other sites

The second half of the ₩624.7 billion fine is about advertising. Through Coupang Partners, its affiliate programme, Coupang ads run on other websites and apps. The PIPC found that from December 2024 to February 2026 Coupang stored, without consent, which of 15.6 million web pages and apps 11.2 million members had visited, linked to their member numbers and advertising IDs. It fined Coupang ₩201.1 billion and said Coupang had also failed to stop partners running "hijack ads" that pushed people into the Coupang app against their will. Coupang deleted the records in April 2026.

Apple's privacy label does not reflect much of this. It lists only diagnostics as used to track you, and financial and contact details, user content and identifiers as linked to you. The privacy policy in force since 14 October 2026 says that, with your consent, Coupang shares service-use records with Appier, Cauly, Criteo, Meta, Buzzvil, Cashslide, Google, Kakao and Branch for targeted ads. It also sends data to Coupang companies in the US, Singapore and India for development, and the only way to refuse those transfers is to close your account. We score privacy on the broader policy and the PIPC findings, not on the label.

Fake rankings and misleading prices

In June 2024 the Korea Fair Trade Commission (KFTC) announced a fine of about ₩140 billion, a provisional figure that Korean media later reported as ₩162.8 billion, the largest ever in Korean retail. It found that from 2019 Coupang fixed at least 64,250 of its own products near the top of its "Coupang ranking" search results, and had 2,297 employees write 72,614 reviews averaging 4.8 stars for its private-label goods. Coupang is fighting the decision in court.

In June 2026 the KFTC added the legal maximum ₩500 million fine for "Wow member price" ads. From 2020 to 2022 these showed a one-time coupon price as if Wow members always paid it. A separate KFTC case, reported in December 2024, covers how Coupang got members to accept a Wow fee rise through the checkout button. Another asks whether Coupang unlawfully pushed shoppers to Coupang Eats through the shared account, a shortcut in the shopping app and free delivery in Wow membership; the KFTC is hearing that tying case on 28 and 29 October 2026.

What Coupang changed

Coupang gave every notified account vouchers worth ₩50,000 in January 2026. Only ₩5,000 of that could be spent on ordinary Coupang shopping. In April 2026 it switched on passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary login in Korea, months after launching it in Taiwan. Coupang runs its own vulnerability disclosure programme, named in its security.txt file. Since May 2026 it has also paid researchers through a public HackerOne bug bounty, but that programme covers only Coupang's Taiwan sites and app, not the Korean service. On 7 October 2026 Coupang asked the Seoul Administrative Court to cancel both PIPC fines and to suspend them until it rules.

How to use Coupang more safely

1. Set up passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary login and use it instead of your password.
2. Expect texts and calls that quote your real address or past orders, and never follow a link about a Coupang refund or compensation.
3. Remove door codes from saved addresses; give them to the courier in the delivery note for one order instead.
4. Withdraw targeted-ad consent and refuse tracking on your phone.
5. For Coupang's own brands, read low-star reviews and check the seller name before trusting the ranking.

How we scored it

Regulatory record (22) is the weakest factor: two record fines from two regulators in two years, plus smaller KFTC cases. Security (28) reflects a breach caused by basic key and monitoring failures, only partly offset by passkeysPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary. Scams and harmful content (50) is the strongest, since the main risks are rigged rankings and phishing rather than harmful content.