DiDi

Is DiDi safe to use?

For the ride itself, mostly yes. DiDi is the ride-hailing app most people in China use, drivers and plates are logged, and in many cities you can have the whole trip audio recorded. The problem is what DiDi has done with data. In July 2022 the Cyberspace Administration of China (CAC) fined it RMB 8.026 billion, about $1.2 billion, after finding that it had illegally collected or processed 64.7 billion pieces of personal information over seven years. For 18 months before that, DiDi could not sign up new users and its apps were off Chinese app stores. We score it 41/100, among the lowest of the ride apps we cover, below Grab (47) and Uber (46) and just above Yandex Go (40).

This page scores DiDi's Chinese passenger app (滴滴出行), published by Didi Chuxing (Beijing) Network Platform Technology. Outside China, DiDi runs a separate app, DiDi Rider, which we describe below.

What the CAC found

The CAC's account of its investigation reads like a list of everything a ride app should not do. It found 16 violations, starting in June 2015, including:

• 11.96 million screenshots collected from users' photo albums without a legal basis
• 8.32 billion items of clipboard and installed-app data collected beyond what was needed
• 107 million passenger face recognition records, plus age, job and family-relationship data
• 167 million precise locations taken while the app ran in the background or during unrelated tasks
• 53.98 billion analyses of passengers' travel intentions without telling them
• 57.8 million drivers' ID card numbers stored in plain text

The regulator also said DiDi kept asking Hitch carpooling users for unrelated phone permissions, and that it had not explained why it processed 19 types of personal data, including device information. It fined DiDi Global RMB 8.026 billion and its chairman Cheng Wei and president Jean Liu RMB 1 million each. The CAC said further findings about data handling that affected national security would not be made public.

The order to pull the apps came first. In July 2021, days after DiDi's New York listing, the CAC opened a cybersecurity review and told app stores to remove DiDi apps over "serious" illegal collection and use of personal data. DiDi's 2024 annual report says 26 of its Chinese apps were taken down and new registrations were suspended until 16 January 2023.

What the app collects now

DiDi's current label in the Chinese App Store lists only identifiers as used to track you, but it links contact info, location, search history, financial info, contacts and health and fitness data to your identity. Its personal information rules, effective 18 June 2026, are detailed. If you consent, the driver's app records audio inside the car for the whole trip, and DiDi keeps the recording for 7 days, or up to 3 years if there is a complaint. Cars with inward cameras record from pickup until about 10 minutes after the trip. DiDi uses device advertising IDs for programmatic ads, shares face images with a face-recognition vendor when you verify your identity, and keeps your data for three years after you delete your account, which it says Chinese e-commerce and ride-hailing rules require.

There are controls. You can turn off personalised content under 我的 > 设置 > 个性化管理, stop clipboard reading in the permission settings, and delete your account under 账号与个人信息管理. DiDi says it now holds ISO 27001 and ISO 27701 certifications and has an external oversight committee for personal data. It also runs a public bug bounty, the DiDi Security Response Center, which rewards reports with points that can be exchanged for gifts.

Rider safety

DiDi's biggest safety crisis came in 2018, when two passengers were killed in separate incidents on its Hitch carpooling service. DiDi suspended Hitch for more than a year to rebuild its safety rules, and it now leans on recording, an emergency button and trusted contacts. The App Store rates the app 4+, even though it includes payments, chat with drivers and carpooling with strangers.

DiDi outside China

DiDi Rider is published by DiDi Mobility Information Technology Pte. Ltd. in Singapore and runs in Latin America, including Mexico, Chile, Colombia and Peru, as well as Australia, New Zealand and Egypt. In Brazil, DiDi rides are booked through its 99 app. Its US App Store label lists only identifiers as used to track you. Google Play says it shares payment info and credit score data with other companies for fraud prevention, and device IDs for advertising. The Australian privacy policy, updated in April 2026, says in-app audio recording runs only when you switch it on, and that data may go to related companies overseas.

The international record is far lighter. In September 2024 the New South Wales Point to Point Transport Commissioner said DiDi had been fined more than A$97,000 after a safety audit, including A$15,400 in court fines for failing to ensure a driver was eligible to drive. The CAC fine covered DiDi's domestic apps, so we have not applied it to DiDi Rider, which we score separately: DiDi Rider (52), and DiDi's Brazilian app 99 (48).

How to use DiDi more safely

1. Agree to trip audio recording in China, as it gives you evidence if something goes wrong.
2. Turn off personalised content and clipboard reading in the app's settings.
3. Share the trip with a trusted contact and check the plate before you get in.
4. Avoid Hitch carpooling late at night, and prefer DiDi Express or a taxi through the app.
5. Delete your account when you leave China, knowing DiDi keeps the data for three more years.

How we scored it

Privacy (30) and regulatory record (38) are the weakest factors: the CAC fine of about $1.2 billion is one of the largest privacy penalties on any app, and it followed 18 months off Chinese app stores. Security (48) reflects driver ID numbers stored in plain text, partly offset by ISO certifications and a public bug bounty. For a Southeast Asian ride app with a cleaner record, compare Gojek.