Uber Eats

Is Uber Eats safe?

Uber Eats is safe enough for getting dinner delivered, but it is not a private app, and its owner's record with consumer regulators is mixed. We found no data breach specific to Uber Eats, and Uber pays outside researchers to report bugs. Against that, Apple's privacy label lists your purchases, contact details and searches as data used to track you, and the FTC and 21 states are suing Uber over the Uber One subscription that most heavy Uber Eats users meet. We score it 50/100, a little above its ride-hailing sibling Uber (46) and DoorDash (42).

Uber Eats has its own app but shares one account, one privacy notice and one security team with Uber. This page scores the Uber Eats app's own label and the decisions that concern food delivery. Ride safety and the fines over drivers' data are covered on the Uber page.

What Uber Eats shares for advertising

Apple's label puts purchases, contact info, search history, identifiers, usage data and "other data" under Data Used to Track You. Linked to your identity are your purchases, payment details, location, contact info, user content and searches.

Google Play is unusually frank. It says Uber Eats shares your name, email address, user IDs, address, phone number, device IDs, in-app searches, app interactions and purchase history with other companies, all for "advertising or marketing". Contacts and location are collected too, although both are optional.

Uber's privacy notice, updated on 22 October 2026, explains where that data goes. Uber personalises ads for its own services and for other companies, and it personalises sponsored listings and promotions from restaurants and shops inside the app. Ad publishers can receive audience lists, and ad intermediaries can receive identifiers, approximate location, order details and how you reacted to ads. Restaurants get your name, address, special instructions and allergies, plus the items you ordered, which the notice says "may include drug prescriptions" when you order from a pharmacy.

You can switch off ad personalisation in Uber's Privacy Center. That does not stop restaurants seeing what they need to cook and deliver your order.

The Uber One lawsuit

In April 2025 the FTC sued Uber in federal court in San Francisco over Uber One, the subscription of up to $9.99 a month that promises $0 delivery fees on Uber Eats orders and discounts on rides. The FTC says Uber signed people up without consent, charged some free-trial users early, overstated the savings and made cancelling hard, with up to 23 screens and 32 actions. In December 2025 the FTC and 21 states plus Washington, DC filed an amended complaint that adds a claim that some members were still charged delivery fees despite the free-delivery promise. Uber denies the allegations, and there is no ruling yet.

Because the case names the delivery benefit inside Uber Eats, we count it here as a pending regulator suit. It is the main reason Uber Eats does not score higher on regulatory record.

The other decision that names Uber Eats is older. In December 2022 Chicago settled for about $10 million over Uber Eats and Postmates listing restaurants without consent and charging commissions above the city's pandemic cap of 15%. Most of the money went to restaurants, so we count it at half weight.

Security and the shared Uber account

Uber runs a paid bug bounty on HackerOne, and ubereats.com is listed as eligible for rewards. Google Play says data is encrypted in transit.

The shadow over the security score is Uber's 2016 breach. Intruders downloaded unencrypted files from Uber's cloud storage holding more than 25 million names and email addresses and 22 million names and phone numbers of US riders and drivers, the FTC said. Uber paid them $100,000 through its bug bounty and did not disclose the breach until November 2017. Uber Eats uses the same accounts, so we count that history here too, though the breach reaches the 10-year limit after which old incidents stop lowering a score. We found no breach specific to Uber Eats since.

Scams to watch for

The main risk is not the food but your account. In October 2026 a Texas TV station described scammers who call or text as "Uber Eats support", claim there is a problem with an order and ask for the one-time code Uber has just sent you. With it they take over the account and place large orders from fake restaurants they control. Uber Eats support works inside the app and never needs that code.

Alcohol is better handled than on some rivals. In the US you must be 21 to buy it, and Uber's terms say the courier checks a government photo ID at the door and will not leave alcohol unattended.

How to use Uber Eats more safely

1. Never read out or forward a code Uber texts you. Hang up and open Help in the app instead.
2. On iPhone, tap "Ask App Not to Track", and turn off ad personalisation in Uber's Privacy Center.
3. Check whether you are paying for Uber One. If you did not mean to subscribe, cancel it in the app's account settings and keep a screenshot.
4. Keep contacts access off; the app works without it.
5. Check the total, including service and delivery fees, before you tap to order.

How we scored it

Regulatory record (58) and scams and harmful content (58) are Uber Eats' strongest factors: the pending FTC case and the Chicago settlement weigh on the first, and code-theft scams on the second. Privacy (38) is the weakest, because both store labels say contact and order data are used for advertising. Security (54) gains from the paid bug bounty but still carries the 2016 breach of the shared Uber accounts. For a Gulf alternative, see Keeta.