Taobao

Is Taobao safe to use?

Taobao is a real, enormous marketplace, and payment and delivery are handled inside Alibaba's systems rather than by the seller alone. That makes it reasonably safe to order from. The two things to know before you sign up are where your data goes and what is in the box. Taobao's overseas privacy policy says it stores data on servers in mainland China, and the US Trade Representative's 2025 review of notorious markets still names Taobao, with right holders reporting high volumes of counterfeit and pirated goods.

We score Taobao 42/100, just below Alibaba's other consumer store AliExpress (44) and level with Temu (42).

Where does your data go?

For users outside mainland China, Taobao is run by Taobao (Singapore) E-Commerce Pte. Ltd. Its overseas privacy policy, effective 2 September 2025, says plainly: "我们在中国大陆境内服务器存储数据", that is, data is stored on servers inside mainland China. Data is held abroad only in specific cases, such as where local law requires it. The Singapore company may also have Zhejiang Taobao Network, a mainland company, process data for it. For most shoppers that is a convenience trade-off. For anyone whose purchases or address are sensitive, it means the data sits under Chinese law, and the policy lists requests from authorities among the reasons it may disclose data without asking.

The policy is broad on advertising. It names Google, X, Facebook, Instagram and AppsFlyer as partners that may receive your ID, items you saved or added to your cart, and device information, and says they may combine it with data from their own platforms to target ads. Apple's label lists identifiers as used to track you, and purchases, financial info, contact details, contacts, search history and browsing history as linked to you.

One gap for foreign users: the overseas policy we opened was in Chinese, and it says the Chinese version prevails if translations differ. Disputes about how your data is handled go to arbitration in Hong Kong under HKIAC rules.

The 1.18 billion record scrape

Taobao's biggest known security failure was not a hack of its servers but a crawler. A court in Shangqiu, Henan, found in 2021 that a developer's software had collected about 1.18 billion pieces of Taobao customer information, including user IDs, nicknames and phone numbers, before police detained him in August 2020. The data fed a business promoting Taobao goods for commission in WeChat groups, and Taobao's own checks flagged the developer because of the volume he pulled. He and the man who hired him were sentenced to three years and three months and three years and six months in prison.

The court record lists IDs, nicknames and phone numbers, not passwords or payment data, but the case shows Taobao's anti-scraping controls let harvesting reach a huge scale before anyone stopped it. Alibaba runs a paid bug bounty on HackerOne that covers *.taobao.com, although the programme was paused for new reports when we checked in October 2026.

Fakes, live streams and what to buy

The USTR review gives Alibaba credit for working with brands and investing in anti-counterfeiting tools since its 2023 reorganisation. It also says right holders still find high volumes of fakes, mixed results when they ask for listings to come down, and limited transparency about repeat infringers. In practice that makes Taobao better for unbranded goods, parts and Chinese brands, than for anything with a famous logo at a low price.

Live shopping is a large part of the app. The Singapore listing sells live-stream top-up packs from S$0.98 to S$1,299, and the app is rated 13+ with contests. If teenagers use a family account, check the payment method attached to it.

The 2026 food-safety fine

On 17 April 2026 China's State Administration for Market Regulation fined seven platforms a combined 3.597 billion yuan in its "ghost takeaway" cases, and two of them were Alibaba companies: Zhejiang Taobao Network, which runs Taobao, and Zhejiang Tmall Network. According to the decision summarised by Ifeng Tech, 881 cake sellers on Taobao had traded without the food-business licence checks the law requires. Taobao was fined 44.05 million yuan for skipping those checks, 2 million yuan for failing to stop sellers' conduct that harmed consumers, and lost about 925,000 yuan in income, about 47 million yuan in all. It was also barred from adding new cake shops for three months. Tmall was fined about 31.7 million yuan in a separate decision over 256 sellers. Taotian Group, Alibaba's unit for Taobao and Tmall, said it would carry out the decision and check its sellers across the platform, Xinhua reported.

This is a consumer case about food from unlicensed kitchens, so we count it in full. It concerns shops selling inside mainland China, but the decision names the Taobao platform itself.

Is Taobao banned in India?

Yes. On 2 September 2020 India's IT ministry blocked "Mobile Taobao" among 118 apps, citing reports that apps collected and shared users' data "in surreptitious manner" and sent it to servers outside India. Because the stated reason is the apps' own data handling, we count the block as an order. A later order on 24 November 2020 also blocked Taobao Live, Alibaba's live-shopping app, but cited sovereignty only.

How to use Taobao more safely

1. Buy branded goods from official Tmall flagship stores, not from small sellers with prices far below the brand's own.
2. Read recent reviews with photos, and check how long the store has traded.
3. Pay through Taobao checkout only. Do not move to a chat app or bank transfer at a seller's request.
4. Turn off personalised ads and recommendations under My Taobao, Settings, Privacy, and limit ad tracking in your phone's settings.
5. Use a delivery address you are comfortable having stored in China, and download your data under Settings, Privacy before you close the account.

How we scored it

Privacy (32) is the weakest factor, because of storage in mainland China and ad sharing with Western platforms. Scams and harmful content (38) comes next, driven by the USTR's counterfeit findings. Security (48) is held back by the billion-record scrape. Transparency and control (50) is the strongest factor, just above the regulatory record (47). That counts the 2026 food-safety fine and India's 2020 block in full, and Alibaba Group's 2021 antitrust fine, whose decision names Taobao and Tmall, at half weight under our rules, because it was about pressure on merchants rather than harm to shoppers.