Gumtree

Is Gumtree safe?

Gumtree is as safe as the way you pay. If you use its "Buy Now" checkout, your money is held until the item arrives. For everything else (most cars, flats, pets, furniture and pick-ups) you are dealing with a stranger, by cash or bank transfer, with no cover from Gumtree at all. The company has no fines or orders from UK privacy or consumer regulators that we could find. Its weak points are a 2021 data leak, no two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login that we could find, and an app that shares precise location and browsing data with ad partners. We score it 47/100.

Gumtree has been in the UK since 2000 and is one of the country's biggest classifieds sites, with more than 500,000 ratings on the UK App Store. It has changed hands three times since 2021. eBay sold it to Adevinta in 2021 as part of a larger deal. The UK Competition and Markets Authority made Adevinta sell Gumtree UK to clear that deal, and it went to O3 Industries and Novum Capital in December 2021. In September 2024 they sold it on to Ocean Link, an Asian private equity firm, and 58.com, a large Chinese classifieds company. Gumtree did not announce that sale; Novum confirmed it to the trade site Online Marketplaces in February 2025.

When Buyer Protection covers you

Gumtree's terms, effective 30 October 2025, describe a payment and delivery service for selected categories. The buyer presses "Buy Now", pays through Mangopay UK, and the money stays on hold until delivery is confirmed or the dispute period ends. A Buyer Protection fee is added at checkout. If the item does not arrive in the estimated time, or is significantly different from the listing (wrong item, counterfeit, undisclosed damage), you can claim a refund, including the protection and delivery fees. Sellers who use the service may have to pass identity checks.

The limits matter more than the feature. Not every listing has Buy Now, and Gumtree decides which ones do. The terms say plainly that Buyer Protection is not insurance. And none of it applies when you meet to collect, pay by bank transfer, or send money through PayPal on a deal agreed in Gumtree's chat.

The scams to expect

Gumtree's help centre keeps separate scam guides for property, tickets, vehicles, bikes, mobile phones, delivery, PayPal and fake jobs, which shows where the trouble is. The patterns match those on Facebook Marketplace and Kleinanzeigen:

• Rentals: fake listings for flats that look too good for the price, and requests for money before a viewing.
• Vehicles and phones: a seller in a hurry who will not let you inspect or unlock the item. Gumtree advises checking a phone's IMEI against stolen or insured-loss lists before you pay.
• Delivery and phishing: messages and links that pretend to come from Gumtree or a delivery company and ask for card or login details.
• Jobs: fake recruiters who use Gumtree's name, and "online survey" jobs that are not real work.

The rule that defeats most of them is the same: do not pay for something you have not seen, unless it goes through Buy Now.

The 2021 leak and account security

In November 2021, Alan Monie of Pen Test Partners found that every advert's page code contained the seller's email address and their postcode or GPS coordinates, even when the seller had chosen to hide their location map. A separate flaw in an API used by the iOS app returned users' full names without any login. Gumtree fixed the email leak within days and reported it to the Information Commissioner's Office, but the full fix took until 6 December 2021. Gumtree told BleepingComputer it did not notify users. Gumtree's security.txt points researchers to a bug bounty run by Zerocopter, which paid Monie the minimum reward for the API flaw.

We found no two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login in Gumtree's help centre. Its Google Play data safety section also states that data is not encrypted in transit, which may be a form error, but it is what Gumtree declares. Use a password you do not use anywhere else.

What the app shares

Apple's label lists precise and coarse location, search history, browsing history, device ID, product interaction and advertising data as "used to track you" across other companies' apps and websites. Linked to your identity are purchases, address, email, name and phone number, used for Gumtree's own marketing and analytics as well as app functions.

The September 2025 privacy notice says Gumtree does not sell personal data. It does, with consent, share a hashed version of your email and device identifiers with ID5, an advertising company that builds an identity graph to recognise you across sites, and it uses Utiq, a service that creates marketing IDs with your mobile or broadband provider. You can turn personalised advertising off in the privacy settings, and the notice explains your rights clearly, though deletion and data copies are requested through a contact form rather than a button.

How to use Gumtree safely

1. For anything posted to you, use Buy Now where the listing offers it, and check the item before you confirm delivery.
2. For collections, see the item working and pay only then, in a public place. Never pay a deposit to view a flat or reserve a car.
3. Never move the chat to WhatsApp or email, and ignore payment links and courier fees sent by "buyers".
4. Hide your street and phone number in listings; give your address only to a confirmed buyer.
5. Withdraw ad consent in the privacy settings if you do not want ID5 or Utiq tracking.

How we scored it

The regulatory record (88) is Gumtree's best factor, as we found no fines or orders, but no regulator has examined it in depth. Scams and harmful content (38) and privacy (38) are the weakest: escrow covers only some categories, and the store disclosures list precise location tracking. Security (45) loses points for the 2021 leak and the missing two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login. For a marketplace with escrow on every posted sale, compare Vinted.