"Personal information protection commission imposes fine of approximately 624.7 billion won on Coupang", 12 June 2026

The Personal Information Protection Commission (Chairperson Song Gyeong-hui) has imposed a fine of approximately 624.6 billion won on Coupang for leaking the personal data of roughly 37.55 million people last year and collecting it without authorisation. A further fine of 248 million won was imposed on its subsidiary Coupang Fulfillment Service (CFS), which unlawfully used employee data in the course of industrial accident litigation.

…

During its investigation, the Commission also confirmed that Coupang had collected and stored records of users' visits to third-party websites and applications without their consent. The investigation found that, in operating its advertising business Coupang Partners, Coupang had unlawfully collected the third-party online activity records of approximately 11.17 million users and stored them in an advertising database.

The Commission also established that Coupang had been aware of so-called "hijack advertising" by some of its advertising partners yet had failed to impose appropriate sanctions. Hijack advertising is a practice whereby users are forcibly redirected to the Coupang website or application even without clicking on an advertisement. The Commission issued a corrective order requiring Coupang to strengthen its oversight and supervision of advertising partners.

Further investigation by the Commission confirmed that CFS had registered the personal data of 71 National Police Agency press corps journalists — none of whom had any employment history at its logistics centres — on an employment-restriction list, and had used weight data held for employee health-management purposes in the course of industrial accident litigation.

Coupang stated on the day: "We sincerely apologise for the concern caused to our customers and the public," whilst also expressing regret that "the proactive measures taken to prevent secondary harm in connection with last year's data breach, and our explanations based on a clear account of the facts, were not sufficiently reflected in the Commission's decision."