Instacart

Is Instacart safe to use?

For your card and account, mostly yes. Instacart runs a paid bug bounty, and we found no confirmed breach of its systems. Its weak points are privacy and how it presents costs. Google Play says it shares your name, email, address, phone number, order history and rough location with other companies for advertising, and in December 2025 it agreed to pay $60 million in refunds to settle FTC charges about fees, refunds and its Instacart+ subscription. We score it 49/100, above DoorDash (42) and Grubhub (40).

What the FTC said about Instacart's fees

The FTC's complaint, filed in the federal court for Northern California, made three main points. First, Instacart advertised "free delivery" on a first order while still adding a mandatory service fee that could raise the cost by up to 15%. Second, it promised a "100% satisfaction guarantee", but customers with a problem usually got a credit towards a future order, and the option to get a refund was hidden in the self-service menu. Third, people who started a free Instacart+ trial were not clearly told they would be charged when it ended or how strict the refund rules were. The FTC said hundreds of thousands of people paid for memberships they did not use and did not get refunds.

Instacart agreed to a stipulated order, which the judge signed on 13 January 2026, so the $60 million judgment is final. It must not misrepresent delivery costs or its guarantee, and it must get express consent before charging for a renewing subscription. Instacart denied any wrongdoing and said the settlement let it focus on shoppers and retailers.

This was not the first case. In August 2022 Washington DC's attorney general settled a suit claiming that from 2016 to 2018 Instacart's checkout showed a default 10% "service fee" where the tip used to be, so people thought the money went to shoppers. Instacart paid $1.8 million to resolve the consumer claims and released $739,057 in disputed sales taxes.

What Instacart does with your data

Apple's label for the app lists only usage data as used to track you across other companies' apps. The rest of the picture is broader. The same label links identifiers and usage data to you for third-party advertising, and links purchases, contact details, your phone contacts and search history to you for Instacart's own marketing. Google Play goes further, saying name, email, user IDs, address, phone number, purchase history and approximate location may be shared with other companies for advertising.

The privacy policy, last updated on 15 January 2026, confirms it. Under California law Instacart says it may have sold or shared identifiers (name, email, phone, address, IP address, device IDs and loyalty numbers) with advertising and analytics partners. Instacart also runs a large advertising business for the brands sold on it, which is part of why your basket is valuable. If you order prescriptions through the app, the policy treats that data as health information covered by HIPAA and says it will not be shared with other companies without your written consent, except to run the service or where the law requires.

You can opt out of sale and sharing through the link in the policy, and Instacart says it honours Global Privacy Control signals from browsers that send them.

Security and account scams

In July 2020 about 278,531 Instacart accounts, with names, order histories and the last four digits of cards, were offered for sale for around $2 each, according to Grocery Dive. Instacart said it was not aware of a breach, blamed credential stuffing and said it would make affected users change their login details. We found no later incident and no confirmed breach of its own systems. Instacart pays for bug reports through HackerOne.

The common risk today is a fake support call or text: someone claims to be from Instacart about an order or refund and asks for the code Instacart just sent you. With that code they can take over the account and order on your saved card.

Prices are a separate question. Reuters reported in late 2025 that the FTC had asked Instacart for information about Eversight, a tool that tests different prices on shoppers. Instacart says retailers set prices and its tests are random. No finding has been made.

How to use Instacart more safely

1. Opt out of the sale and sharing of your data via the privacy policy link, and turn on Global Privacy Control in your browser.
2. On iPhone, tap "Ask App Not to Track" and deny access to your contacts unless you use the referral or gift features.
3. Before you start an Instacart+ trial, note the end date and set a reminder to cancel if you do not want to pay.
4. If an order goes wrong, ask for a refund to your card rather than accepting a credit by default.
5. Never share a login code with anyone, and use a unique password for the account.

How we scored it

Privacy (36) is the weakest factor, because the Play listing and the privacy policy both describe sharing contact and order data for advertising. Regulatory record (44) reflects the $60 million FTC settlement plus the earlier DC case. Security (58) is the strongest, level with scams and harmful content, thanks to the paid bug bounty and no confirmed breach. For a delivery app with a cleaner record, see Just Eat.