Viator

Is Viator safe?

For booking a walking tour, a museum ticket or a day trip, yes. Viator has no fine or regulator order on record, payment goes through Viator rather than to a stranger, and most tours can be cancelled up to a day ahead. Two things hold the score back. Its privacy policy gives it room to sell data to ad networks and data aggregators, and Viator is only the agent: the tour itself, and much of what can go wrong, belongs to an independent operator. We score Viator 58/100.

Viator is the agent, not the tour company

Viator, owned by the Tripadvisor group, is a marketplace. Its terms say it acts as a "disclosed agent" for the supplier, that it does not provide or own any experiences, and that operators are independent contractors whose acts, errors and listing inaccuracies it is not liable for. Consumer protection laws in the UK, the EU and other places still apply, and the terms say so.

In practice that means the risk is less about fraud than about mismatch: a tour that runs shorter than described, a pickup that never comes, a guide who does not show. Viator's support handles the complaint, but the outcome depends on the operator and on the listing's own terms. Tripadvisor's app sells the same experiences, because both brands run on Viator's supply, booking and fraud-prevention platform.

Refunds and cancellations

Viator's standard policy lets you cancel or change a booking up to 24 hours before the start time. That is generous, but it is a default, not a promise. Listings marked "All Sales Final", including group bookings, cannot be refunded or changed, nothing is refunded once a tour has started, and the cancellation policy shown on the listing at the time of booking is the one that applies. Changes you ask for depend on the operator agreeing. Viator also recommends travel insurance, which is worth taking seriously for expensive multi-day trips.

What happens to your data

The stores tell a mild story. Apple's label lists only device ID as used to track you, with name, email and coarse location linked to you for Viator's own marketing. Google Play goes further and says the Android app shares no data with other companies.

The privacy statement, effective June 2026, is broader, so we score on it. Viator says it may "sell" or "share", as US state laws define those words, identifiers, internet activity, purchase information and inferences drawn from them with business partners, social media sites, advertising networks and data aggregators. It may also give hashed email addresses to third parties that use them to target ads at you. On the plus side, you can opt out with a "Do Not Sell or Share" link in the app, and Viator treats a Global Privacy Control signal from your browser as an opt-out. Viator passes your details to the operator, which is needed to run the tour.

Security and the 2014 breach

In September 2014 Viator disclosed that attackers had reached its systems. About 880,000 customers may have had payment card details exposed and about 560,000 more had account details taken, roughly 1.4 million in total. The breach is more than 10 years old, so it does not lower today's score, and the Tripadvisor group's 2025 annual report says it has found no cybersecurity incident that materially affected it.

Today's policy describes encryption in transit, firewalls and intrusion detection. What Viator lacks is a bug bounty. Tripadvisor pays researchers through Bugcrowd, but its programme lists Viator among the group brands that are out of scope, and we found no programme of Viator's own or public detail on two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login. That keeps security below Tripadvisor's.

How to book tours on Viator more safely

1. Read the cancellation line on the listing before you pay, and avoid "All Sales Final" for anything weather-dependent.
2. Read recent reviews with photos, and check the operator's name on the listing.
3. Keep all payment inside Viator; an operator that asks for cash or a transfer to "confirm" a booking is a warning sign.
4. Contact Viator straight away if a tour does not run as described, and pay by credit card so you can dispute the charge.
5. Use the "Do Not Sell or Share" link, or turn on Global Privacy Control in your browser.

How we scored it

Privacy (44) is the weakest factor, because the policy allows data sales to ad networks and data aggregators even though the store labels look light. Regulatory record (86) is the strongest, with no fine or order on record but no public regulator review either. Scams and harmful content (64) reflects a marketplace of independent operators where mismatched tours, not fraud, are the common problem. GetYourGuide scores 61 and Klook 56.