Grab is a Southeast Asian super-app offering ride-hailing, food/grocery delivery, and payments, operated by Grab Holdings Limited, a Cayman Islands-incorporated company listed on Nasdaq (GRAB). Grab's own privacy notice discloses collecting precise location and telematics (speed/braking) data, using cookies/SDKs/web beacons for analytics and advertising, and sharing device and advertising identifiers with partners to serve ads across other companies' apps and websites; Apple's App Store label for the Grab app corroborates cross-app tracking and third-party advertising use of purchase, location, and contact data. Singapore's Personal Data Protection Commission (PDPC) lists an enforcement decision against Grabcar tagged "Financial Penalty," published 3 October 2018, though the full decision text is rendered client-side and could not be independently verified via direct fetch or a Wayback snapshot (both returned the same metadata-only page shell).
TRACK RECORD
1 ENFORCEMENT ACTION
[2018-10-03]
Singapore's Personal Data Protection Commission (PDPC) enforcement-decisions listing includes a decision titled "Breach of Protection Obligation by Grabcar," published 3 October 2018 and tagged "Financial Penalty," "Protection," "Transport and Storage," and "PHV Private Hire Vehicle" — confirming PDPC imposed a monetary penalty on GrabCar for a data-protection breach. The full decision text is served client-side by PDPC's site and was not retrievable via direct fetch or a Wayback snapshot of the same URL.
Grab's Privacy Notice states that when users use map-related features such as Live Location Sharing, Grab collects precise location information from the user's device with permission, and separately discloses passive collection of telematics data (speed, acceleration, and braking data) via devices installed in vehicles, alongside device information, IMEI numbers, and advertising identifiers.
Grab Holdings Limited's FY2025 Annual Report on Form 20-F, filed with the SEC as a foreign private issuer, states that Grab Holdings Limited (formerly J1 Holdings Inc.) is "an exempted company limited by shares incorporated under the laws of the Cayman Islands," and the filing's cover page lists its Class A ordinary shares as trading under ticker GRAB on the Nasdaq Stock Market LLC.
Apple's App Privacy label for Grab lists "Third-Party Advertising" as a purpose for data linked to a user's identity, including Purchase History, Financial/Payment Info, Precise Location, Contact Info, and Identifiers.
Grab's Privacy Notice states that cookies and related technologies are used, among other purposes, to "serve you relevant advertisements across other apps and websites owned by other companies (whether by us or by other advertisers)" — a cross-service, cross-company ad-targeting disclosure.
Singapore's Personal Data Protection Commission (PDPC) enforcement-decisions listing includes a decision titled "Breach of Protection Obligation by Grabcar," published 3 October 2018 and tagged "Financial Penalty," "Protection," "Transport and Storage," and "PHV Private Hire Vehicle" — confirming PDPC imposed a monetary penalty on GrabCar for a data-protection breach. The full decision text is served client-side by PDPC's site and was not retrievable via direct fetch or a Wayback snapshot of the same URL.
Apple's App Privacy label for the Grab app (developer: Grab.com) discloses that Purchases, Financial Info, Location, Contact Info, Search History, Browsing History, Identifiers, Usage Data, and Diagnostics data may be used to track users across apps and websites owned by other companies.
Grab's Privacy Notice discloses that Grab and third parties it partners with use cookies, web beacons, tags, scripts, and advertising identifiers, and that software development kits (SDKs) "which have similar functions to cookies" may be installed in the Grab App to let partners collect information about user interactions.