Pinduoduo (拼多多)

Is Pinduoduo safe?

Pinduoduo works for buying cheap goods in mainland China, and payment runs through WeChat Pay or Alipay. As an app, though, its security record is very weak. In March 2023 Google found malware in versions of Pinduoduo distributed outside its store and suspended the app from Google Play, and independent researchers found that the app exploited about 50 Android flaws. Three years later the app was still missing from Google Play when we checked in October 2026. Then, in April 2026, China's market regulator fined Pinduoduo about 1.52 billion yuan, the largest of seven "ghost takeaway" penalties.

We score it 31/100, well below its sister app Temu (42) and Alibaba's Taobao (42).

What happened in 2023?

In February 2023 Chinese researchers accused Pinduoduo of shipping Android code that abused flaws in phones. On 20 March Google told TechCrunch that "off-Play versions of this app that have been found to contain malware have been enforced on via Google Play Protect", and that the official Play Store app was suspended "for security concerns". Google Play is not available in mainland China, where people install Pinduoduo from phone makers' own stores, so the warning reached few of its users.

CNN then asked several firms to examine version 6.49.0, released in late February. Check Point Research, Oversecured and WithSecure found code built for privilege escalation, which gives an app more access to the phone than Android allows. Oversecured's founder counted about 50 exploited flaws, most in the custom code of Samsung, Huawei, Xiaomi and Oppo phones. WithSecure said the app could keep running in the background, resist being uninstalled and read activity in rival shopping apps. Check Point found a way to push updates that skipped app-store review.

Pinduoduo rejected the claims at the time. A version released on 5 March 2023 removed the exploits, according to two experts CNN spoke to, although Oversecured said the underlying code was still present. A Pinduoduo employee told CNN that a team of about 100 engineers had built the exploits and was disbanded days later. These are the reports of researchers and an anonymous insider; no regulator has ruled on them. We found no public bug bounty or security response centre for Pinduoduo.

What the app collects now

Apple's China label lists financial info, contact info, contacts, user content, identifiers, usage data and diagnostics as linked to you. Unlike Taobao and JD, it shows no "used to track you" section.

The privacy policy, version 4.1.1 of 30 June 2025, goes further. For account and fraud checks Pinduoduo collects your installed-app list, MAC address, OAID or IDFA, network details and motion sensors, and IMEI on versions before 6.63.0. It reads the clipboard to spot share codes, may ask for ID or face verification when you recover an account, and lets advertising partners combine data with what they hold themselves. Data is stored in mainland China, except where a cross-border order needs it abroad.

Fakes and the 2026 fine

The US Trade Representative's 2025 review of notorious markets says right holders still find high volumes of counterfeits on Pinduoduo, with one reporting that most products in some fashion and sport categories were fake. It also describes slow takedowns and complaint tools that brands find hard to use.

On 17 April 2026 the State Administration for Market Regulation (SAMR) fined seven platforms over "ghost takeaway" food sellers. Pinduoduo's share was the largest. According to decision 2026 No. 22, quoted by Ifeng Tech, 4,522 cake sellers had uploaded no food licence and 4,941 held licences that did not cover cream cakes. The platform also gave two order-forwarding services API access to orders, so shops could pass customers' cakes to other kitchens without telling them. SAMR found that Pinduoduo refused to supply material without reason, supplied false material and used "violence and soft resistance" against inspectors. It fined the company about 1.52 billion yuan, about US$214 million, and stopped it adding new cake shops for nine months. Two managers were fined personally. Pinduoduo said it accepted the decision.

This is a consumer case about food safety and misleading orders, so it counts in full. In 2021 SAMR had also fined the company behind Duoduo Maicai, the grocery service inside the app, 1.5 million yuan for below-cost dumping and misleading prices.

How to use Pinduoduo more safely

1. Install Pinduoduo only from Apple's App Store or your phone maker's store, and keep it updated.
2. On Android, check the app's permissions after each update and deny contacts, location and storage unless a feature needs them.
3. Switch off personalised ads under Personal centre, Settings, Account and security, Personalised ad management.
4. For branded goods, assume a very low price means a copy, and buy from official brand stores.
5. Do not let children top up live-stream coins; the app is rated 4+ but sells coin packs up to ¥2,998.

How we scored it

Security (22) is the weakest factor, because of the 2023 malware findings from Google and three security firms. Privacy (25) is close behind, with app-list and sensor collection and ad partners who can combine data. Transparency and control (50) is the strongest: the app offers data download, deletion and ad switches. The regulatory record (42) reflects one large consumer fine and an obstruction finding.