Wallapop - Sell & Buy Security & Privacy Scorecard

Android

48
Overall trust score
Unsafe
45
Security
50
Privacy

Activity, browsing, and purchase behavior is shared with multiple ad and analytics companies including Facebook, Adjust, and LiveRamp to build profiles and target ads. Data flows through at least six tracking services spanning behavioral analytics, advertising, and data brokering.

Best for

Casual buyers and sellers comfortable with ad tracking

Avoid if

You avoid Facebook and ad-network data sharing

Findings

  • 2 critical
  • 7 high
  • 7 medium
  • 2 low
  • 0 info

0 issues identified across security and privacy analysis.

Top security issues

  • Unencrypted Storage of Authentication Tokens
  • Cleartext Traffic Allowed for Primary Domain
  • Chat Database Encryption Key Stored Unencrypted

Top privacy issues

  • Pre-Consent Attribution Tracking (GDPR Violation)
  • Precise Location Tracking in Analytics Events
  • Extensive Event Tracking (734 Event Types)

Full analysis

Wallapop - Sell & Buy

Overall Score: 45/100 | Privacy Score: 50/100

Scan date: 2026-01-21

What This Means for You

Activity, browsing, and purchase behavior is shared with multiple ad and analytics companies including Facebook, Adjust, and LiveRamp to build profiles and target ads. Data flows through at least six tracking services spanning behavioral analytics, advertising, and data brokering.

Recommendation: Use With Caution

Best For: Casual buyers and sellers comfortable with ad tracking
Avoid If: You avoid Facebook and ad-network data sharing

Key Findings

Data Security - 8 findings (1 critical, 3 high, 4 medium)

Network Security - 1 finding (1 high)

Code Safety - 0 findings

Privacy - 4 findings (1 critical, 1 high, 2 medium)

Privacy Concerns

What Data is Collected

Wallapop collects in-app browsing and search activity, items viewed and saved, purchase and listing history, device identifiers, and behavioral patterns that build a persistent profile tied to the account across sessions.

Third-Party Data Sharing

Data is routed to multiple external companies across several categories:

  • Advertising: Facebook Ads, LiveRamp ATS (data brokering)
  • Behavioral analytics: Adjust, Amplitude, mParticle, Rudderstack
  • Engagement and messaging: Braze
  • App analytics: Firebase Analytics

Understanding the Scores

Category Score
Security 45/100
Privacy 50/100
Data Security 40/100
Network Security 65/100
Code Safety 70/100
Data Collection 60/100
Data Sharing 65/100
User Control 55/100

Positive Security Features

  • Payment processing is delegated to established providers (Stripe, Klarna, Google Pay) rather than handled in-app directly, meaning payment details are managed by dedicated financial services with their own security standards.
  • Google Sign-In is offered as an authentication option, removing the need to create and store a separate password with the app.

Areas for Improvement

  • Behavioral data is shared with a large number of advertising and analytics companies, including data brokers. Reducing the number of third-party integrations would give users more control over where that information goes.
  • Personal data storage and protection within the app scores lowest of any category, with the highest concentration of severe findings.
  • The app offers limited privacy controls, leaving users with little ability to restrict behavioral tracking or opt out of data sharing from within the app itself.

About This Analysis

This scorecard is based on static analysis of the published app at the time of scanning. Results reflect findings from that version and may not represent subsequent updates.

App Details

  • App: Wallapop - Sell & Buy
  • Package: com.wallapop
  • Scan Date: 2026-01-21

Versions & scan history

ScanDateOverall score
#5 (current) 48/100
#3 42/100
#1 58/100