Keeta, the delivery platform of Chinese technology conglomerate Meituan, has officially began its pilot operations in Brazil, initially launching in the coastal cities of Santos and São Vicente, in São Paulo state. The company is expanding to the state capital before a full national rollout.
Meituan is widely considered the largest on-demand delivery service in the world by order volume, a standing earned through its dominant scale in the Chinese market, which serves approximately 770 million annual users.
Keeta’s arrival in Brazil marks the Chinese company’s first major expansion in Latin America and immediately elevates critical national security discussions regarding data sovereignty, the nature of Chinese corporal control, and the potential disruption to the Brazilian delivery market.
The weaponization of consumer data
The most serious threat posed by Meituan’s entry is not economic, but a national security risk rooted in the mass aggregation of sensitive consumer data. Delivery apps require and collect a vast array of information, which, when compiled in bulk, becomes a powerful tool for intelligence and espionage.
This bulk data poses a direct national security risk to Brazil’s defense and governance structures. Keeta collects precise, real-time geolocation data linked to user accounts.
Intelligence agencies can use this data to build exhaustive movement profiles on military, government, law enforcement, and critical infrastructure personnel, identifying the unknown sensitive locations these individuals frequent, such as private offices or secret meeting points. Aggregated order and delivery data can also reveal patterns of life near military installations, key government buildings, or undisclosed intelligence sites. Furthermore, this level of detailed consumer data exposes highly sensitive lifestyle patterns that could be exploited for blackmail, coercion, or malign foreign influence operations against public figures. Finally, the transfer of this data could be used as raw material for training advanced artificial intelligence (AI) systems, enhancing the Chinese Communist Party’s (CCP) espionage capabilities globally.
The foundational security issue is that the distinction between a private company and the state is functionally erased in China. The company’s ultimate loyalty is to the CCP, not to Brazilian law or customer privacy.
This structural reality creates a conflict between a foreign state’s legal authority and Brazil’s data sovereignty.
Data sovereignty versus foreign state
The prospect of state-mandated data access directly challenges Brazil’s legal safeguards.
Luiz Augusto D’Urso, a lawyer specializing in digital law and president of the National Cybercrime Commission of the Brazilian Association of Criminal Lawyers (ABRACRIM), addressed this unique threat.
“One point to note when talking about Chinese apps is that, in some cases, certain local laws require greater state intervention in technology companies and their databases, including possible access. This can create an environment of less control over the security, destination, and use of user information, especially when these apps from China operate in foreign territory,” says D’Urso, who also highlighted the robustness of Brazil’s domestic protection.
“The LGPD [Brazil’s General Personal Data Protection Law] imposes fundamental principles of transparency, purpose, and security, requiring that data be used only for legitimate purposes and with the consent of the data subject. In addition, it establishes strict liability for companies that process such data, meaning that, under these Brazilian laws, if a leak or misuse occurs, such companies may be held civilly or administratively liable, and criminal liability may extend to directors, depending on the case,” explains D’Urso.
The key vulnerability, however, is that while Brazil’s LGPD applies extraterritorially to fine or sanction a company, its efficacy against a company acting under the direct, legally-mandated compulsion of a sovereign state — in this case China — is an untested legal frontier.
Market investment and competition
Meituan is committed to investing more than $1 billion over five years for its platform expansion. The company strategically chose the São Paulo coast cities due to the high density of small and medium-sized restaurants. Prior to the launch, Keeta had already registered more than 700 restaurant brands and was training over 2,000 delivery partners.
Keeta is expected to utilize an aggressive market strategy, employing zero fees, aggressive discounts, and subsidies to quickly challenge the dominance of iFood (which has about 80 of the market share), Colombian company Rappi, and 99Food (backed by China’s DiDi Chuxing).
The competition has already led to legal action. Keeta initiated a legal battle by accusing 99Food of engaging in alleged unfair competition. A court in São Paulo recently partially ruled in Keeta’s favor, blocking 99Food from enforcing restrictive exclusivity clauses with partner restaurants.
This fierce market competition often intensifies concerns regarding labor conditions. Meituan’s employment model has historically faced criticism regarding worker exploitation, and the pressure to reduce delivery prices could translate to reduced income and increased precarity for delivery workers across the sector.
D’Urso points to the regulatory oversight available: “The National Data Protection Authority (ANPD) was created to oversee compliance with the LGPD and apply sanctions. Such punishments may include fines, data blocking, and even a ban on operations. The ANPD has already established itself as an active technical body, which strengthens the environment of digital trust in the country,” the lawyer says. “Even for foreign applications, when they operate in Brazil or process Brazilian data, the legal provisions apply, and they must comply with national legislation, that is, they are subject to LGPD rules. This is an important advance, as it allows the country to demand minimum security and privacy standards, regardless of the company’s origin.”
The long-term impact on Brazil’s digital infrastructure and national defense posture will depend on how the government responds to the geopolitical and legal complexities posed by this state-aligned foreign company.
