Tmall (天猫)

Is Tmall safe?

Tmall is a reasonably safe place to buy branded goods in China: most stores belong to the brands themselves or to licensed retailers, and payment runs through Alipay or WeChat Pay inside Alibaba's checkout. What it is not is private. The app runs on your Taobao account, Apple's label says it tracks you with device identifiers, and China's market regulator fined it about 31.7 million yuan in April 2026 for letting unlicensed cake sellers trade.

We score Tmall 46/100, a little above Taobao (42) and JD (44), and far above Pinduoduo (31).

Tmall or Taobao?

Both belong to Alibaba's Taotian Group, and Tmall stores also appear in search results inside the Taobao app. The Tmall app is a separate download, run by a separate company, Zhejiang Tmall Network, under its own privacy policy, and it has about 1.65 million ratings on China's App Store. The difference that matters to a shopper is who sells. Taobao is open to millions of small sellers. Tmall admits brands and larger retailers, and a flagship store (旗舰店) is run by the brand or its authorised partner.

That shows in outside reviews. The US Trade Representative's 2025 review of notorious markets names Taobao, with right holders reporting high volumes of counterfeits, but does not name Tmall. Fakes are still possible from smaller Tmall resellers, so check the store name for expensive items.

What Tmall collects

Apple's China label lists identifiers as used to track you. Linked to you are purchases, financial info, contact details, contacts, search history, browsing history and identifiers. Location, user content, usage data and diagnostics are listed as not linked to you.

The basic-function privacy policy, effective 1 November 2025, says Tmall collects OAID, IDFA, Android ID, crash logs, device and network details for account and fraud checks, and combines them with your member and order data. It reads the clipboard when you open the app to spot share codes, uploading the content only when it matches a Tmall link, and may ask for motion sensors during sales events such as Double 11. Advertising partners receive data about ad reach and results but, the policy says, not your personal identity. Cross-border purchases through Tmall Global need ID checks for customs. Data collected in mainland China is stored there.

Because Tmall uses your Taobao account, your profile, orders and footprint follow you between the two apps. That also means Taobao's history applies: a court found in 2021 that a crawler had collected about 1.18 billion Taobao customer records before he was stopped in 2020.

The 2026 fine

On 17 April 2026 the State Administration for Market Regulation (SAMR) fined seven platforms over "ghost takeaway" food sellers. Decision 2026 No. 19, as quoted by Ifeng Tech, found that 49 cream-cake sellers on Tmall had uploaded no food licence when they joined, and 207 had uploaded only a pre-packaged food filing or a licence that did not cover cream cakes. SAMR confiscated about 4.1 million yuan, fined Tmall 25.6 million yuan for the licence failures and 2 million yuan for not stopping order transfers that misled consumers, about 31.7 million yuan (about US$4.5 million) in all, and stopped it adding cake shops for six months. Taotian Group said it would carry out the decision and check sellers across its platforms.

We count this consumer case in full. Alibaba Group's 2021 antitrust fine of 18.228 billion yuan, whose decision names the Taobao and Tmall platforms, was about pressure on merchants, so it counts at half weight. In December 2020 SAMR also fined the company behind Tmall's own retail, Hangzhou Haochao E-commerce, 500,000 yuan for raising prices before Double 11 discounts and other misleading promotions. We found no privacy fine naming Tmall.

An 18+ shopping app

China's App Store rates Tmall 18+. The listing says the app contains gambling, loot boxes, ads and messaging, and occasionally shows horror themes, references to alcohol, tobacco or drugs, simulated gambling, and sexual content or nudity. It does not say which features cause this. In practice, a teenager on a parent's account can reach these features, so check what the account allows before handing it over.

How to use Tmall more safely

1. For branded or expensive goods, buy from the flagship store and check the store name.
2. Switch off personalised ads and recommendations under Me, Settings, Privacy.
3. For cakes and fresh food, check the shop's food licence on its page.
4. Keep payments in Tmall checkout; do not follow a seller to another app.
5. Remember that closing a Tmall account closes your Taobao account too.

How we scored it

Privacy (34) is the weakest factor, because of identifier tracking and the shared Taobao profile. Scams and harmful content (48) reflects brand stores and fewer fakes, held back by the cake-seller findings and the 18+ rating. Security (50) has no Tmall breach but Alibaba's bounty is paused. The regulatory record (54) is the strongest factor, with one mid fine in full, a small 2020 pricing fine and the 2021 antitrust fine at half weight.