Tokopedia

Is Tokopedia safe to use?

As a shop, broadly yes: Tokopedia is one of Indonesia's largest marketplaces, payment runs through the app, and it does not appear in the US counterfeit reviews that named two of its rivals in 2024. As a keeper of your data, it is weaker. Its App Store label lists five kinds of data that may be used to track you across other companies' apps, its privacy policy covers ID cards, biometrics and constant location, and in May 2020 data on about 91 million accounts was offered for sale on the dark web.

We score Tokopedia 46/100, a little above Shopee (44) and below Alibaba's Lazada (50).

Who runs Tokopedia now

Since 31 January 2024, TikTok has owned 75.01% of Tokopedia, and GoTo, the group that used to own it, holds the other 24.99%. In September 2025 Indonesia's competition authority, KPPU, fined TikTok Nusantara (SG) Rp15 billion because it had notified the takeover after the 19 March 2024 deadline. That is a filing breach that did not harm users, so it counts only as context here.

The privacy policy, last updated on 15 August 2025, is written by "PT Tokopedia and/or its affiliates". It allows data to be shared with affiliates and stored on servers inside and outside Indonesia, including by affiliates and partners. It does not say which countries.

What the app collects

The Indonesian App Store label is one of the broader ones we have seen on a shopping app. Purchases, location, identifiers, usage data and "other data" may be used to track you across apps and websites owned by other companies. Contacts, identifiers, purchases and usage data are linked to your identity, and precise location is listed as collected but not linked.

The policy goes further than the label. Identity data can include your name, date of birth, ID card (KTP) and tax (NPWP) numbers, and "photos and/or biometric data". Contact data includes your phone's contact list. It says Tokopedia "will track and collect" your real-time location every time you use the app on a phone, partly to show how close a courier is, and that you can turn location tracking off in your phone settings at the cost of some features. Data is used for marketing Tokopedia's products and those of its group companies.

The 2020 breach and the lawsuit

In early May 2020 data on about 91 million Tokopedia accounts was offered for sale on a dark web forum. Tokopedia said user data security was its priority and that it was working with the authorities. The communications minister said his ministry and the national cyber and crypto agency, BSSN, would investigate with Tokopedia. We could not find a published finding, a sanction, or a public account of how the attackers got in.

A consumer group, Komunitas Konsumen Indonesia, sued Tokopedia and the communications minister in the Central Jakarta District Court (case 235/Pdt.G/2020/PN.Jkt.Pst), asking for Rp100 billion and arguing Tokopedia had failed to keep a proper security system. We found no judgment against Tokopedia. Under our rules a consumer-group suit is context, not a regulatory finding, so the breach itself is scored under security.

For bug reports, TikTok's paid HackerOne programme lists some Tokopedia domains, such as the seller and shop centres. We could not confirm a separate programme for the main shopping app.

Age rating and scams

Tokopedia is rated 4+ in the Indonesian App Store, which is low for a marketplace with chat between strangers, live selling, payments and insurance. Lazada and Shopee are rated 13+ in Singapore. Scam risk follows the usual marketplace pattern: most problems start when a buyer is pulled off the platform.

How to use Tokopedia more safely

1. Pay only through Tokopedia checkout, and refuse any seller who asks you to transfer money directly or to continue on WhatsApp.
2. Change your Tokopedia password if you have had the account since 2020, and do not reuse it anywhere else.
3. Turn location access to "While Using" or off in your phone settings, and deny contacts access unless you need it.
4. Do not upload ID or face photos unless a payment or lending feature you really need requires it.
5. Buy branded goods from official stores, and check shop age and recent reviews with photos.

How we scored it

Privacy (35) is the weakest factor, because of five tracking data types on the label and a policy that covers biometrics and constant location. Security (42) is held down by the 91-million-account breach with no published outcome. Transparency and control (48) and scams and harmful content (48) are middling. The regulatory record (83) is the strongest factor: we found no fine on Tokopedia for privacy or consumer protection.