iFood

Is iFood safe to use?

iFood works and its payments are not the weak point, but its record on data and consumer rules is poor for an app this size. In June 2026 the company confirmed that names and CPF numbers of about 1.2 million customers had leaked six months earlier, and it had not told them. Consumer authorities have fined it five times since 2020. We score it 48/100, level with 99 (48), whose app includes 99Food, and below Keeta (53), Meituan's newer rival.

iFood is the largest food delivery app in Brazil, with about 8.96 million ratings on the Brazilian App Store. It is published by iFood Agência de Serviços de Restaurantes Ltda and belongs to Prosus, which bought full control in 2022 and in 2025 agreed to buy Just Eat Takeaway.com as well.

The 2025 leak iFood did not announce

The leak came to light on 28 May 2026, when a seller on BreachForums claimed 43.8 million iFood customer records and set a deadline of 10 June for a ransom. iFood first denied a breach. On 3 June it confirmed an "isolated incident" in December 2025 that exposed names and CPFs of about 1.2 million people, around 2% of its customers. It said passwords, payment methods and financial records were not affected, and it rejects the 43.8 million figure.

Times Brasil, CNBC's Brazilian licensee, reported, citing TecMundo, that the data came out through a flaw in SIRA, the portal iFood uses to answer police and court requests. The attacker said a hijacked police account gave access and that the data was pulled out slowly over about three months.

iFood told g1 it did not report the incident because it judged there was no relevant risk to users, which the LGPD allows. The ANPD told Estadão it had received no notice and asked the company for explanations after the story broke. iFood's own notice, dated 10 June 2026, says an outside body's compromised credentials were used, that only registration data was reached and that its technical assessment found no risk of relevant harm. It says iFood "segue colaborando integralmente com a ANPD" (continues to cooperate fully with the ANPD), but not whether or when it notified the authority. Name and CPF together are enough to make a scam call sound official.

This was not the first time someone with internal access misused iFood's systems. In November 2021 the account of an outside contractor's employee renamed about 6% of restaurants on the app with political and anti-vaccine slogans. iFood does run a public bug bounty on Bugcrowd that covers its customer apps and pays $150 to $3,750, but security still scores only 47.

What iFood collects and shares

Apple's label is lighter than the Uber Eats one: only the device ID and product interaction are listed as used to track you. But the app links precise location, home address, name, email, phone, payment details, purchase and search history to your identity.

Google Play tells a broader story. It says iFood shares precise and approximate location, name, email, phone number, address, user IDs and purchase history with other companies, with advertising or marketing among the stated purposes for most of them. Data is encrypted in transit and you can ask for deletion.

The customer privacy statement, updated on 1 October 2026, lists eight kinds of recipients, among them "empresas de publicidade e soluções de dados", advertising and data-solutions firms. It says data sent to marketing and analytics firms is anonymised or masked, and it describes targeted ads on social networks and search engines. It sets no fixed retention periods. Privacy scores 40, level with Just Eat and Keeta.

Deleting your account is easier: the policy gives the in-app path Perfil > Ajuda > Privacidade e Dados > "Quero excluir minha conta e meus dados".

Fines from Procon and the fee case

Most fines come from consumer authorities:

• Procon-SP, August 2020: R$2,523,695.14 for poor service, minimum order values and abusive terms, including a clause saying iFood was not liable for leaks of the data customers enter.
• Procon Carioca, December 2021: R$1,508,240 after iFood did not answer questions about the restaurant-name incident.
• Procon-MG: R$252,500 (October 2023) and R$404,000 (May 2024) over minimum orders set by a McDonald's and a café in Varginha, then R$1,505,000 (October 2025) over minimum orders in general. iFood said it would appeal the last one.

In May 2026 Senacon, the federal consumer secretariat, opened sanction proceedings against iFood and Keeta under a rule that apps must show how much of a price goes to the platform, the courier and the restaurant. Senacon said iFood had not provided the requested information and found signs that customers could be misled about the "delivery fee" and "service fee". Fines can reach R$14 million; iFood said it was adapting its systems.

State prosecutors have also gone to court. In February 2025 a Goiás judge banned minimum order values on iFood in a case brought by the state prosecutor's office (MPGO) and ordered R$5.4 million in collective damages, but the state appeals court overturned that ruling in March 2026. In June 2026 MPGO filed a new suit in Goiânia over orders marked as undelivered without proof, chats with couriers cut off after delivery and automatic refusals of refunds. It asks for changes to the app and collective damages; the court chose to hear iFood before ruling on urgent measures.

Competition matters count for less in our score because restaurants, not diners, are the main parties harmed. CADE settled its exclusivity case with iFood in February 2023: no fine, but limits on exclusive contracts for 54 months. On 22 October 2026 CADE closed a complaint by aiqfome, Magazine Luiza's delivery app, that iFood was dodging those limits in smaller cities.

Scams at the door and in your messages

The best-known iFood scam happens at delivery. A courier asks for an extra fee and charges it on a card machine with a broken screen. Procon-SP counted 35 complaints in early 2020, with charges between R$1,000 and R$5,000, and said iFood answers for its couriers under the consumer code even though they are not employees. Brand phishing is the other risk: in June 2026 a fake "World Cup scratch card" in iFood colours promised Pix prizes. iFood says it ran no such promotion.

How to use iFood more safely

1. Pay in the app and refuse any extra charge at the door, especially on a card machine you cannot read.
2. Treat calls, texts or WhatsApp messages that quote your CPF and ask for a code, a Pix or a "security update" as fraud.
3. Ignore promotions that arrive outside the app or ifood.com.br, and never pay a fee to claim a prize.
4. On iPhone, tap "Ask App Not to Track" and allow location only while using the app.

How we scored it

Regulatory record (62) is the strongest factor, held down by five Procon fines, the open Senacon case and the Goiás prosecutors' suit. Privacy (40) is the weakest, because of data shared with advertisers. Security (47) reflects the 1.2 million-customer leak that iFood chose not to report and the 2021 insider incident, with some credit for a paid bug bounty.