JD.com (京东)

Is JD.com safe?

JD is one of the safer ways to shop online in China, mainly because much of what it sells comes from its own warehouses and its own couriers deliver it. The weak spots are elsewhere. China's market regulator fined JD about 635 million yuan in April 2026 for letting tens of thousands of unlicensed cake sellers into its food-delivery business, and the app's privacy policy is broad: it tracks you with device identifiers and can ask your mobile carrier for a score of your internet behaviour.

We score JD 44/100, close to Taobao (42) and well above Pinduoduo (31).

The ghost-takeaway fine

On 17 April 2026 the State Administration for Market Regulation (SAMR) fined seven platforms a combined 3.597 billion yuan over "ghost takeaway" shops. The decision named Beijing Jingdong 360 Du E-commerce, the company behind the JD platform, alongside Pinduoduo, Meituan, Taobao, Tmall, Douyin and Ele.me.

JD's numbers stand out. According to the decision as quoted by Tencent News, 37,845 cake sellers on JD had uploaded no food licence and 5,345 had used forged ones, 43,190 in all. Of these, 4,858 had made sales worth about 77.3 million yuan. JD also gave order-forwarding services API access to orders, so a "ghost" shop could take a birthday cake order and auction it to the cheapest kitchen without telling the customer. In one test order described in the case, inspectors paid 252.40 yuan for a cake, and the kitchen that made it received 76.80 yuan.

SAMR confiscated about 6.7 million yuan of income and fined JD about 626 million yuan for the licence failures and 2 million yuan for not stopping the order transfers, about 635 million yuan (about US$89 million) in all. It stopped JD adding new cake shops for three months and fined the legal representative and two food-safety directors personally. JD said it fully accepted the decision and would improve its checks.

This is a consumer case about food safety and misleading orders, so it counts in full. It was not JD's first: in December 2020 SAMR fined Beijing Jingdong Century Information Technology, which runs JD's own retail, 500,000 yuan for raising prices before Double 11 discounts and other misleading promotions. Earlier in 2026 SAMR had summoned JD with other platforms over cut-throat competition, and Beijing regulators summoned it in March over its compliance set-up; summons without a finding are context only.

What JD collects

Apple's China label says identifiers are used to track you across other companies' apps. Linked to you are health and fitness data, purchases, financial info, contact details, contacts, user content, search history, identifiers and usage data.

The basic-function privacy policy, effective 6 September 2026, adds detail. For fraud and account checks JD collects device identifiers, the processes running in its own app, Bluetooth and Wi-Fi MAC addresses, IP address and SIM card information. With your permission it also collects GPS location, nearby Wi-Fi lists and cell towers while you browse the home page, search or quick delivery. Two clauses go beyond what most shopping apps say. First, accepting the policy lets JD ask the mobile carrier behind your number for a model score of your internet behaviour, to predict what you might buy; JD says the score is de-identified. Second, if you registered with a Hong Kong phone number, JD may share your personal information with third-party marketing firms. Data is stored in mainland China.

The 2016 data sale

In December 2016 a 12 GB file with tens of millions of records, including user names, passwords, emails, QQ numbers, phone and ID numbers, was sold on the black market and linked to JD. JD said the data came from the 2013 Struts2 flaw that hit many Chinese websites, that it had fixed the systems at the time and asked affected users to secure their accounts, and that a small number had not done so. By JD's account the data was taken through that 2013 flaw, more than ten years ago, so it does not lower the security score; even the 2016 sale passes the ten-year mark in December 2026. We found no breach of JD accounts since. JD runs a security response centre for outside researchers and says its data storage holds China's level-3 security certification and ISO 27000.

JD Finance (京东金融)

JD's money products sit in a separate app, JD Finance (京东金融), published by Beijing Jingdong Financial Technology Holdings. It sells gold, funds, loans and insurance. It is listed only on the China App Store, where it had about 276,000 ratings in October 2026, and not in the US, UK, Hong Kong or Singapore stores. Its Apple label says identifiers are used to track you, and links contact details, purchases, financial info and usage data to you. We have not scored it separately.

JD Pay (京东支付), one of the payment options at JD's checkout, is run by Wangyin Zaixian (网银在线), according to JD Pay's own site. On 12 August 2025 the Beijing branch of the People's Bank of China warned Wangyin Zaixian (Beijing) Payment Technology, confiscated about 2.19 million yuan of income and fined it about 7.43 million yuan, about 9.62 million yuan in all. The ten breaches included weak real-name checks on merchants, transaction records that were not complete or traceable, and rule breaks on customer reserve funds. The decision names the payment company, not the JD shopping app, so it is context here and does not change the score.

How to use JD more safely

1. Prefer items marked 京东自营 (sold by JD) for branded or expensive goods.
2. For cakes and meals, open the shop page and check the food licence and address before you order.
3. Switch off personalised ads under My, Account settings, Privacy settings, Ad management.
4. Use a unique password and turn on the payment password; never pay a "seller" outside JD checkout.
5. Download your data under Privacy settings before you close the account.

How we scored it

Privacy (30) is the weakest factor, because of identifier tracking, Wi-Fi and Bluetooth data and the carrier behaviour score. Scams and harmful content (45) reflects the 43,190 unchecked cake sellers, offset by JD's own retail stock. The regulatory record (46) counts one large consumer fine in full, plus the small 2020 pricing fine. Security (52) and transparency and control (52) are the strongest, with no recent breach, a security response centre, data download and in-app deletion.