Lazada

Is Lazada safe to use?

For buying, mostly yes. Payment runs through Lazada's own checkout, and its record on counterfeits looks better than its main rival's: the US Trade Representative named Shopee and Indonesia's Bukalapak in its 2024 review of notorious markets, but not Lazada, and Lazada is absent from the 2025 review too. The weaker side is data. The app's App Store label is broad, and Singapore's data regulator found in 2022 that Lazada's grocery arm, RedMart, had left the keys to its systems in source code before a breach.

We score Lazada 50/100. That puts it above Shopee (44) and Alibaba's other consumer stores, AliExpress (44) and Taobao (42).

What the RedMart breach showed

Alibaba-owned Lazada bought RedMart, a Singapore online grocer, in 2016 and moved RedMart's shop onto Lazada's platform in March 2019. In September 2020 an attacker got into the GitHub account of a member of RedMart's development team. According to the Personal Data Protection Commission's decision, a key to RedMart's Amazon cloud environment was hardcoded in the source code there, and a second key sat in plain text in a storage bucket. With them, the attacker reached an old customer database that was neither encrypted nor password-protected, and copied it on 6 September 2020. The data was later offered for sale on an online forum.

The database held records on 898,791 people: names, email addresses, home addresses, phone numbers, partial credit card numbers and hashed passwords. The regulator noted that the code with the key had been open to "a large group of developers" from RedMart, Lazada and Alibaba. It fined RedMart S$72,000 (about US$53,000) on 28 October 2022. In its favour, RedMart stored only partial card numbers, told users even though the law did not yet require it, and forced a password reset on every affected current Lazada account.

The data was more than 18 months old and came from a site that had already closed, so the direct damage was limited. The lesson is about practice inside the group, and it is why security scores 50 rather than higher. Alibaba's paid bug bounty on HackerOne lists Lazada's domains, a point in its favour, although the programme was paused for new reports when we checked in October 2026.

What the app collects

Lazada's label in Singapore lists only one type of data as used to track you across other companies' apps: identifiers. That is narrower than Shopee, which also lists purchases and contact details. The list of data linked to your identity is long, though. It includes payment info, precise location, address, phone number, email, your phone's contacts, photos or videos, audio, search and browsing history, and a category Apple calls "sensitive info".

The privacy policy, in the version dated 26 May 2026, explains some of this. Location is used to show nearby deals and track deliveries, contacts come in when you use "Find My Friends" or similar features, and data on how you browse is used for "more relevant advertising". It also allows sharing with "any entity within the Lazada Group, including its holding companies", with sellers, with partners in lending, banking and credit cards, and with service providers, any of which may be outside your country. To delete data or withdraw consent, you contact Lazada through its online chat or a country contact. The policy does not describe a self-service tool.

Fines and complaints

Lazada's regulatory record is short and the amounts are small:

In Vietnam the commission also ordered Recess, the local operator, to review how it informs consumers, and said the company cooperated. Neither fine is large, but one concerns data security, which is why the regulatory record scores 72 and not in the 80s.

How to shop on Lazada more safely

1. Pay only through Lazada checkout, and never move a deal to WhatsApp, Telegram or a bank transfer at a seller's request.
2. Buy branded electronics, cosmetics and medicines from LazMall stores, which are brand-owned or authorised.
3. Read recent reviews with photos and check how long the shop has traded before ordering anything expensive.
4. Refuse contacts and microphone access in your phone settings unless you need a feature that uses them. Shopping works without them.
5. Use a password you do not use elsewhere. The RedMart database leaked hashed passwords, and reused passwords are what attackers try first.

How we scored it

Privacy (42) is the weakest factor, because of the broad label, the contacts and "sensitive info" categories, and sharing across the group and with finance partners. Security (50) reflects the RedMart breach and the regulator's findings about keys in source code. Scams and harmful content (50) is better than for Shopee because Lazada has not been named in recent counterfeit reviews. The regulatory record (72) is the strongest factor, with two small fines.