Grab

Is Grab safe to use?

Grab is the ride and delivery app most people in Southeast Asia use, and taking a car booked through it is safer than flagging down an unmarked one, because the driver, route and fare are logged. Where Grab is weaker is data. Its App Store privacy label is among the longest of any travel app we have scored, Singapore's privacy regulator has fined it three times, and the region's competition authorities have fined it over fares. We score it 47/100, a little above Uber and below Bolt.

The app is published by GrabTaxi Holdings Pte. Ltd. in Singapore and is rated 13+. Grab says it serves more than 670 million people in Singapore, Indonesia, Malaysia, Thailand, the Philippines, Vietnam, Cambodia and Myanmar, with rides, food, grocery and parcel delivery, and the GrabPay wallet in one app.

What Grab collects for advertising

The Apple label lists nine kinds of data that may be used to track you across other companies' apps and websites: purchases, financial info, location, contact info, search history, browsing history, identifiers, usage data and diagnostics. For third-party advertising, Grab links purchase history, payment info, precise location, your name, email and phone number, support messages and device IDs to your identity. Contacts, photos and audio are also collected for some purposes. Grab's privacy notice adds that it may record audio and video inside vehicles that have recording devices, ask for selfies to verify your identity, and keep those selfie images for up to 10 years.

Google Play's data safety section adds detail Apple's does not. It says the app may collect calendar events, for purposes that include advertising or marketing, and the list of apps installed on your phone, and that contacts, device IDs, calendar events and installed apps may be shared with other companies for fraud prevention and security.

The app description is frank about the business model: Grab offers "personalized targeted advertising" from Grab, its partners and certain third-party apps based on activity on your devices. You can switch this off under Privacy and Consent Management in the app's settings. Do it once; it is the most useful privacy step on this page.

Grab's data protection record

Singapore's Personal Data Protection Commission (PDPC) found Grabcar in breach of its duty to protect personal data three times in two years:

• October 2018: a S$6,000 penalty for failing to prevent the disclosure of GrabHitch drivers' personal data.
• June 2019: a S$16,000 penalty for failing to protect customers' data; one customer's details reached another customer in an email Grab sent.
• September 2020: a S$10,000 penalty and a direction, for failing to put reasonable security in place to stop unauthorised access to GrabHitch drivers' and passengers' data through the mobile app. An app update had exposed the data of 21,541 people, and the commissioner noted it was the fourth time Grab had been found in breach of this duty.

The amounts are small, and none of these incidents was a large breach. The pattern matters more than the sums: repeated exposure through app changes is why security scores 56 rather than in the 60s. On the positive side, Grab runs a paid bug bounty programme on HackerOne, updated in October 2026, and Google Play says data is encrypted in transit.

In the Philippines, the National Privacy Commission issued a notice of deficiencies on 31 January 2020 and ordered Grab to stop its passenger selfie verification and a pilot of in-car audio and video recording in about 180 cars in Metro Manila. The regulator said Grab's privacy impact assessment took into account "only the risks faced by the company" and did not state a legal basis for the processing. Grab said the features met the legal criteria but suspended them.

Vietnam added a consumer fine in August 2026. Its competition commission fined Grab more than VND 1.3 billion (about US$51,000) for six violations, among them not letting customers choose whether their data could be shared with or transferred to third parties, banned clauses in its terms, undisclosed payments to influencers and incomplete display of reviews. Grab was ordered to stop the violations and review its policies.

Fares, competition and the Uber deal

When Uber sold its Southeast Asian business to Grab in March 2018, Singapore's competition regulator CCCS found that the deal substantially lessened competition. It said Grab held about 80% of the market and that effective fares rose by 10% to 15% afterwards, and it fined Grab S$6,419,647 and Uber S$6,582,055. It also ordered Grab to drop exclusivity deals with drivers and taxi fleets and to keep its pre-merger pricing algorithm.

The Philippine Competition Commission monitored Grab's pricing commitments after the same deal. In December 2019 it found that Grab had overcharged passengers; Grab refunded PHP 14.1 million to riders' GrabPay wallets and paid a further PHP 2 million over driver cancellations, while saying its fares complied with transport rules.

Malaysia's competition commission proposed a RM86.77 million fine in 2019 over clauses that stopped drivers from advertising for rivals. The High Court quashed it in 2023, and in October 2025 the Federal Court refused the commission leave to appeal, so no fine stands.

Rider safety

Grab offers the usual ride-hailing protections: a named driver with a photo and plate, a recorded route, and in-app chat so you do not need to share your phone number. What we could not find is a published count of assaults or other serious incidents on Grab rides, of the kind Uber and Lyft have released in the US. Without it, riders have to trust the tools without seeing the record, which is why scams and harmful content scores 54.

How to use Grab more safely

1. Turn off personalised advertising under Privacy and Consent Management in the app.
2. Deny calendar and contacts access unless a feature you actually use needs it.
3. Check the plate, car model and driver photo before you get in, and share your trip with someone you trust at night.
4. Keep a PIN or biometric lock on GrabPay and never read a one-time code to anyone, including someone claiming to be Grab support.
5. Pay inside the app rather than in cash where you can, so the fare is on record if there is a dispute.

How we scored it

Privacy (30) is the weakest factor: nine data types used for tracking, with financial info and browsing history among them. Regulatory record (48) reflects the S$6.4 million CCCS merger penalty, where riders paid higher fares, plus three small PDPC fines, a Philippine overcharging refund and fine, a privacy cease-and-desist order and Vietnam's 2026 consumer fine. Malaysia's quashed proposal does not count. Security (56) is held back by the repeated PDPC findings, and helped by an active bug bounty. For a ride app with a lighter tracking label, compare inDrive.