Is Costco safe to use?

Costco integrates 25 third-party SDKs spanning infrastructure, analytics, and media. Its App Store privacy label declares cross-app tracking via Browsing History. It collects data linked to your identity including Purchases, Financial Info, Contact Info, and User Content and 2 more categories. It includes 1 advertising or attribution SDK. Whether this is acceptable depends on your personal privacy preferences.

What permissions does Costco need?

Costco requests 10 iOS permissions: App Tracking Transparency, Camera, Photo Library, Location (When In Use), Location (Always), Location (Always & When In Use), Motion & Fitness, Face ID, Bluetooth, and Bluetooth Peripheral.

What data does Costco collect?

According to its App Store privacy label, Costco declares cross-app tracking via Browsing History. It collects data linked to your identity including Purchases, Financial Info, Contact Info, User Content, Identifiers, and Other Data. It collects Location, Search History, Browsing History, Usage Data, and Diagnostics not linked to your identity.

How many SDKs does Costco have?

Costco integrates 25 third-party SDKs. 1 for advertising, 3 for analytics, 15 for infrastructure, and 4 for other.

Does Costco use Google SDKs?

Yes. Costco includes 4 Google or Firebase SDKs: Google Ads Conversion, Firebase Analytics, Google App Measurement, and Firebase Firestore. These are used for ads, analytics, and cloud services.

Does Costco use App Tracking Transparency?

Yes. Costco requests the App Tracking Transparency permission, which means it asks for your consent to track your activity across other companies' apps and websites.

Does Costco access your location?

Yes. Costco requests location access. The developer states: "We will use your location to help you find nearby warehouses and quickly open your app to the digital membership card. You can opt out at any time by updating your preference on your device's settings page.".

Does Costco access your camera?

Costco requests access to your camera. The developer says this is for "This will allow you to take a photo and then submit it to the Costco Photo Center". These permissions are only active when you grant them in iOS Settings.

Does Costco run in the background?

Yes. Costco registers 3 background modes, which means it can perform certain tasks when you're not actively using it.

What are some alternatives to Costco?

Other shopping apps include Harbor Freight , AE + Aerie , Afterpay , ALDI Grocery Pickup & Delivery , AliExpress , and Victoria's Secret . Each app takes a different approach to shopping and varies in its data collection and SDK usage.

Shopping · Privacy report

Costco

Free · ★4.9 · Costco Wholesale Corporation

Is Costco safe?

It collects a lot of your data, and shares it with trackers.

Our take. Costco carries 4 third-party trackers and its own label declares it links 6 categories of your data to you. It collects a lot itself, and shares a lot with outside companies.

Privacy footprint · vs 80 shoppingModerate

Trackers from other companies4 · some

typical shopping: 5

Data the app links to you6 types · some

typical shopping: 8 · from its own privacy label

What it collects about you

Costco links 6 categories of your data to you.

From the developer's own App Store privacy label. These are the kinds of data Costco ties to your identity, and it also declares it shares data to track you across other apps.

PurchasesFinancial InfoContact InfoUser ContentIdentifiersOther Data

Who else is inside

It carries trackers from 2 companies.

Third-party SDKs found in the app, matched to the company that publishes each. Present in the code; we do not observe what they transmit.

🏢Other third partiesadvertising

A third-party SDK.

SDKs

🇺🇸GoogleAnalytics

Firebase, AdMob and Google analytics SDKs, built to record how you use the app and serve ads.

SDK

How it compares

Where it sits among shopping.

Every one of these apps we have scanned, on the two measures above: third-party trackers it carries (across) and data it links to you on its own label (up). Toward the top right is more invasive.

Each dot is one shopping app. Costco sits to the lower left, lighter than most.

Other signals

One more flag.

Each is a fact read straight from the app. The same checks run on every app we scan. Only the ones that apply here are shown.

It declares cross-app tracking

Its own App Store label says it tracks you across other companies apps and websites using your advertising identifier.

The evidence

What it's built from.

All 25 SDKs in the app, grouped by what they are for. 4 are third-party trackers.

1advertising

3analytics

21standard libraries

4 of the 25 are third-party trackers. The rest are the app's own code and standard open-source building blocks.

Show the full SDK list

Other third partiesadvertising

Google Ads Conversion · Google App Measurement · Adaptive SDK

GoogleAnalytics · USA

Firebase Analytics

Standard libraries21 · on-device

The app's own code plus open-source interface, storage and networking libraries.

How we know this

Counterspy downloads the app from the App Store and statically analyzes its compiled binary. Embedded SDKs are matched against a signature database and resolved to the company that operates each. We also read the developer's App Store privacy label, which lists the data the app says it collects and links to you. We do not run the app or intercept its traffic, so we report capabilities present in the code and the developer's own disclosures, not proven transmission. We assess privacy and data collection, not malware, security flaws, or developer intent. Reports are automated and never edited for payment. Scan v26.3.4, 2026-04-01.

Third-party trackers are advertising, analytics and attribution SDKs detected by static signature matching. Presence shows a capability is compiled in, not that it ran or transmitted data.
"Data the app links to you" is the count of data categories the developer declares as Data Linked To You in its App Store privacy label. Labels are self-reported and not verified by Apple.
Comparison across the 80 shopping in our corpus. Trackers: median 5. Data linked to you: median 8.