Just Eat

Is Just Eat safe to use?

Yes, within the usual limits of a delivery app. Just Eat Takeaway.com, the group behind Just Eat, Lieferando, Thuisbezorgd and Takeaway.com, pays researchers to report security bugs, and we found no disclosed breach of its customer data and no privacy or consumer fine. The catch is tracking: Apple's label for the UK app lists purchases, financial information, location and search history among data used to track you. We score it 58/100, close to Wolt (60) and well above Glovo (46).

One company behind four brands

Most people outside the Netherlands know only one of the names. Just Eat runs in the UK, Ireland, Switzerland and several other markets; Lieferando in Germany and Austria; Thuisbezorgd in the Netherlands; Takeaway.com in several other European countries. All of them use one privacy statement, and the data controller is Takeaway.com Group B.V. in Amsterdam. That is why we score them on one page.

In 2025 Prosus, the investment arm of South Africa's Naspers, bought the group. The European Commission cleared the deal in August 2025 only after Prosus promised to cut its large stake in rival Delivery Hero, which owns Glovo and foodpanda, and to give up its say in that company. The privacy statement now says Just Eat may share personal data with Naspers and Prosus on a need-to-know basis.

What the apps track

The labels differ by country. For the UK Just Eat app, Apple lists purchases, financial info, location, search history, identifiers, usage data and "other data" as used to track you. For Lieferando in Germany the list is shorter: purchases, location, identifiers, usage data and diagnostics. Neither label links data to you for third-party advertising, only for Just Eat's own marketing.

Google Play tells a simpler story for both apps: "No data shared with third parties". The privacy statement does not quite match. It says Just Eat may share data with "third party marketing partners" depending on your cookie choices, uses technology from other companies to track how you interact with its ads on other platforms, and may show you personalised ads elsewhere if you agree. We score privacy on the broader description.

What helps is that this tracking rests on consent in Europe and the UK. The statement says personalised ads and tracking cookies need your agreement, and without it you still see ads, just not ones built from your orders. It also says some data, such as your last address and saved logins, is kept for a year after your last activity.

Security and scams

Just Eat Takeaway.com has run a paid bug bounty on Bugcrowd since April 2019, and Google Play says data travels over encrypted connections. We found no disclosed breach of the group's own customer data. Grubhub, the US business it sold to Wonder in January 2025, had breaches in 2025 and 2026, but those are Grubhub's systems and do not count here (see our Grubhub page).

As with other delivery apps, the practical risk is phishing: a text, email or call that mentions a real order or a refund and asks you to log in through a link or read back a code. Refunds and vouchers show up in the app and on your card statement, so check there before you act.

The CMA star ratings case

On 26 March 2026 the UK's Competition and Markets Authority opened a consumer law investigation into whether Just Eat's rating system has inflated some restaurants' and grocers' star ratings, giving people a misleading picture of quality. It is one of five review cases the CMA opened that day under its new consumer powers, which let it decide whether the law was broken without going to court. The CMA says no conclusion has been reached and its next update is due in winter 2026 to 2027. Until then we count it as an open inquiry, which lowers the regulatory score a little but is not a finding.

How to use Just Eat more safely

1. Decline personalised cookies and ads when the app or site asks; you can change this later in your settings.
2. On iPhone, tap "Ask App Not to Track" to limit the tracking on Apple's label.
3. Read restaurant reviews, not just the star rating, until the CMA case is settled.
4. Treat any message about a refund or voucher as suspect until you see it in the app.
5. Use a unique password and remove saved cards you no longer use.

How we scored it

Regulatory record (82) is the strongest factor: we found no fine, and the CMA case is still an inquiry. Privacy (40) is the weakest, because Apple's labels list purchases and location as used to track you and the privacy statement allows sharing that Google Play's label leaves out. Security (64) reflects a long-running paid bug bounty and no disclosed breach.