Personal Information Commission Urges Coupang to Revise Liability Exemption Clause and Simplify Withdrawal Process

"Exemption Clause Creates Unclear Burden of Proof, Contradicts Personal Information Protection Act"

The Personal Information Protection Commission has called on Coupang, which recently experienced a large-scale member information leakage, to revise its third-party exemption clause. The commission also requested that the complicated withdrawal process for Wow Membership members be simplified.

At a plenary meeting held on the afternoon of December 10, the commission reviewed Coupang's response to the incident and its handling of personal information, and made these statements.

Song Kyunghee, Chairperson of the Personal Information Protection Commission, is presiding over a video plenary meeting held on December 3, 2025, at the Government Seoul Office in Jongno-gu, Seoul, to address the Coupang personal information leakage incident and prevent secondary damage. Photo by Jo Yongjun

First, the commission confirmed that Coupang had added a clause to its terms and conditions last month stating that it would not be liable for any damages caused by illegal access to its servers by third parties, and demanded that this clause be revised. Coupang added this provision after the member information leakage incident occurred last month.

The commission pointed out that this clause makes Coupang's exemption from liability and the burden of proof for damages caused by intent or negligence unclear. It added that this not only runs counter to the intent of the Personal Information Protection Act but also causes unnecessary confusion for users.

According to the Personal Information Protection Act, if a user suffers damages due to an illegal act by a personal information handler, the user can claim compensation, and the handler must prove that there was neither intent nor negligence.

The commission stated that it would require Coupang to improve the relevant provisions and would also submit its opinion to the Fair Trade Commission, which oversees terms and conditions.

The commission also called for the simplification of Coupang's complicated membership withdrawal process. Users subscribed to Coupang's paid Wow Membership service must cancel their membership before withdrawing, but the cancellation process involves multiple steps and requires reconfirmation of the user's intent, making it complex. In some cases, members were unable to cancel their membership until the remaining period had expired, making immediate withdrawal impossible.

In response, the commission urged Coupang to simplify the withdrawal process and make it publicly accessible so that data subjects can easily understand it, in order to guarantee users' rights.

The commission also reviewed Coupang's actions following its emergency resolution on December 3. The review found that Coupang revised its incident notification wording from "exposure" to "leakage" regarding personal information, included previously omitted items such as shared entrance passwords in its notifications, and posted notices on both its website and the Coupang application, thereby partially implementing the commission's resolutions.

However, the commission requested further improvements regarding the lack of a specific notification plan for non-members whose information was leaked from delivery address lists, as well as insufficient accessibility and visibility of the notices posted on the website and app.

Additionally, the commission instructed Coupang to strengthen its own monitoring and immediate response systems. This comes amid recent suspicions that Coupang account information is being circulated on the internet and dark web. The commission required Coupang to submit the results of its actions regarding these demands within seven days.

A commission official stated, "We plan to impose strict sanctions if any legal violations by Coupang are confirmed through a prompt and thorough investigation," adding, "We will also continue to implement necessary preventive measures to ensure that secondary damage from the misuse of leaked information does not occur."