Trip.com

Is Trip.com safe to use?

For booking a flight or hotel, mostly yes: we found no record of a data breach at Trip.com, and its parent company told US investors in April 2026 that it had suffered no material cybersecurity incident. The concerns are about data and accountability rather than fraud. The app collects a lot, the privacy notice allows wide sharing, and the company behind it does most of its business in China, where the market regulator imposed one of its largest penalties on it in July 2026. We score Trip.com 52/100, with low confidence because little is published about how the app protects accounts.

Who runs Trip.com, and why it matters

Trip.com is the international brand of Trip.com Group, the company formerly called Ctrip.com International. It also owns the Chinese booking sites Ctrip and Qunar and the flight search engine Skyscanner. The app's legal operator is Trip.com Travel Singapore Pte. Ltd., and the group now lists a Singapore address as its principal office. Its 2025 annual report still says plainly that "since our inception, we have conducted the majority of our operations in China". It also notes that its auditor is in mainland China.

That is not proof that your data sits in China, and Trip.com's privacy notice does not say where it stores it. What the notice does say is that data "may be transferred to and stored at a destination outside your country". It may go to group companies, partners, advertisers and "government authorities, law enforcement, regulators" in connection with its stated purposes. The annual report explains the legal background: China's Data Security Law and Personal Information Protection Law forbid companies in China to hand data stored there to foreign courts or police without approval from Chinese authorities. For a traveller that mostly matters when you would want a regulator or court outside China to reach that data.

What the app collects

Apple's privacy label is one of the broader ones among travel apps. Location, contact info and identifiers are listed as used to track you across other companies' apps and websites. Linked to your identity are health and fitness data, purchases, payment info, precise location, contacts, photos or videos, search and browsing history, usage data and diagnostics. Name and contact details are also used for third-party advertising.

Some of this follows from travel itself. Airlines need passport numbers, and the notice lists passport number, passport photo and date of birth for flights. Health data is collected for insurance claims, medical refunds and the in-app SOS service. Others are choices: the notice says third parties use cookies for cross-device tracking to tailor ads. Compare Booking.com, whose label lists only device identifiers, though its policy covers much more.

Refunds and complaints

The consumer problems on record are about money back. In June 2026 Korea's Fair Trade Commission fined Trip.com's Singapore and Korean companies KRW 10 million. It found that between February 2020 and July 2025 they refunded 13,010 cancelled flights, worth about KRW 3.1 billion, as airline vouchers rather than to the original payment method. A pop-up had told customers that vouchers might be the only option under airline policy, which the regulator found restricted their right to cancel. The fine was small, but it came with a corrective order and an order to report on refunds.

The Chinese antitrust penalty

On 25 July 2026 China's State Administration for Market Regulation found that Trip.com Group had abused a dominant position. It had restricted hotels through exclusive arrangements and imposed unreasonable terms. The regulator ordered it to refund RMB 122 million in hotel deposits it had deducted, confiscated RMB 1.66 billion (about US$244 million) of gains and fined it RMB 3.52 billion (about US$519 million). That fine equals 7.5% of its 2025 sales in China. Trip.com said it "sincerely accepts" the decision. The case concerns hotels, not travellers' data, but a total of about US$763 million makes it a serious finding against the group. Because it is a competition ruling rather than a privacy or consumer one, we count it for less than a data fine of that size.

How to use Trip.com more safely

1. Turn off precise location for the app in your phone settings; you can still search by city.
2. Do not give the app access to your contacts unless you need a feature that uses them.
3. Pay by credit card, so you can use a chargeback if a refund stalls.
4. If a flight is cancelled, ask for a refund to your card in writing; in many countries, including EU states and Korea, a voucher is optional.
5. Book SOS or insurance features only if you accept that health details go to Trip.com.

How we scored it

Privacy (35) is the weakest factor, because of tracking by location and contact info and a notice that allows wide sharing without naming destinations. The regulatory record (63) is the strongest by a point, even with China's antitrust penalty, counted at reduced weight because it concerns hotels, and Korea's refund ruling. Security (62) and scams and harmful content (62) follow, as we found no breach and little scam risk on the platform, but published security detail is thin. WeChat, the Chinese app with the most direct government-access concerns, scores 36.