Coupang Eats

Is Coupang Eats safe to use?

Coupang Eats is a convenient way to order food in Korea, but it carries the baggage of its parent's account system. The app logs in with your Coupang account and runs under the same privacy policy as Coupang's shopping app, and that account was at the centre of Korea's largest data breach in 2025. The app also shares what you do in it with advertising partners and faces two competition cases that are close to a decision. We score it 47/100, below Baemin (54) and Yogiyo, its two main rivals.

Coupang Eats had about 35% of Korean delivery-app card spending in 2024, according to figures the Korea Fair Trade Commission (KFTC) cited, and about 15 million Wow members get free delivery through it. It has about 694,000 ratings on the Korean App Store.

The Coupang breach and what it means for Eats users

Coupang reported a leak of 4,536 accounts in November 2025 and then raised the figure to more than 33 million. The Personal Information Protection Commission (PIPC) found that a former employee, who had built an alternative login system before leaving at the end of 2024, used its signing key to read account pages from April to November 2025. The attacker took names and emails from about 33 million accounts, at least 22.4 million members' shipping addresses (some with door codes) and about 58,000 members' order lists. The PIPC said basic key management and access controls were missing and that the company also broke notification duties and obstructed the investigation.

In June 2026 the PIPC fined Coupang ₩624.7 billion, the largest privacy fine in Korea. Part of it covers the breach; the rest covers Coupang's collection of about 11 million members' visits to other sites and apps through its Coupang Partners ad network. On 7 October 2026 Coupang asked the Seoul Administrative Court to cancel the fines and to suspend them until it rules.

For Coupang Eats users, the account details are the same, so a Coupang Eats user's name and email were almost certainly in the leaked set. The pages the hacker read belonged to the shopping service, and the PIPC left Coupang Eats revenue out of the fine as an independent business. We still score the breach under security, because it hit the login and the company that runs the app.

The courier leak

Coupang Eats has its own record. The PIPC found in November 2024 that from 2019 to November 2021 the Coupang Eats server sent couriers' real names and phone numbers to restaurants through an API, alongside the relay numbers it claimed to send instead. An order-management system used by restaurants kept details of about 135,000 couriers. Coupang was fined ₩278.65 million plus ₩10.8 million for the leak and for telling people late. The harmed people were couriers, not customers, so it counts at half weight for us.

What the app collects and shares

Apple's label lists usage data as used to track you, and purchases, financial details, location, contact details, user content, search history, identifiers and usage data as linked to you. Google Play says app interactions are shared for analytics and advertising.

The Coupang privacy policy, in force since 14 October 2026, has a section for Coupang Eats. It keeps your name, phone number and address until 90 days after you leave, location records for a year after each delivery, and support chats for three years. With your consent, your Coupang activity is used for targeted ads, and the policy lists Appier, Cauly, Criteo, Meta, Buzzvil, Cashslide, Google, Kakao and Branch as companies that receive your service use records for ads. Data goes to Coupang Global in the US, Coupang Asia Holdings in Singapore and CPNG India for development, and non-identifying IDs can go to Coupang companies in China. You can refuse the transfers only by closing your account.

The competition cases

The KFTC has two cases that name Coupang Eats. In the first, examiners say Coupang Eats and Baemin required restaurants to offer prices and terms no worse than on rival apps, and dropped those that refused from free-delivery listings. In June 2026 the KFTC refused Coupang's offer to settle with a ₩60 billion support package. The second case asks whether bundling free Coupang Eats delivery into Wow membership, with a shared account and a shortcut in the shopping app, unlawfully pushed shoppers toward Coupang Eats; a full hearing was set for 28 and 29 October 2026. The KFTC has not published an expected fine for the tying case; Newsis calculated that the legal cap would allow up to about ₩210 billion.

The price-parity charges are mainly about restaurants, which counts at half weight for us. The tying case is partly about consumer choice, so it counts more. In 2025 the KFTC also found ten unfair clauses in the restaurant terms of both apps and recommended that Coupang Eats stop charging commission on discounts that restaurants pay for themselves.

How to use Coupang Eats more safely

1. Expect phishing that quotes your real name, address or past orders, since those details leaked in 2025.
2. Treat any call or text about Coupang compensation, refunds or orders as suspect; open the app instead.
3. Leave the building door code out of your saved address; tell the courier through the in-app chat.
4. Withdraw targeted-ad consent and, on iPhone, tap "Ask App Not to Track".
5. If you leave, remember that closing the account ends Coupang shopping and Coupang Play too.

How we scored it

Regulatory record (60) is Coupang Eats' strongest factor, held down by two pending KFTC cases and the 2024 courier fine. Privacy and security (40 each) are the weakest: wide ad sharing on one side, and on the other a login shared with the account system behind Korea's largest breach. Transparency and control (58) reflects a detailed, dated policy but an all-or-nothing account deletion.