Chinese online retailer Temu has agreed to tighter data-security and product-safety restrictions to settle a lawsuit brought by the state of Texas over alleged privacy violations and risks linked to goods sold on its platform.
The settlement requires Temu to store Texans’ personal data on servers located in the United States and controlled by American entities.
The company must also restrict access to that data from China except where information is needed for essential business functions, such as delivering a product to a customer.
Temu will pay $3 million to Texas and submit to third-party cybersecurity reviews of its mobile application.
The company has denied wrongdoing.
FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals
Texas Lawsuit Focused on Data Collection and China Access
Texas Attorney General Ken Paxton sued Temu earlier this year, accusing the company of collecting far more information from users than was necessary for an online shopping platform.
The lawsuit alleged that Temu’s app used software functions capable of accessing sensitive information on users’ devices.
Texas also claimed that the company’s data practices created a risk that information belonging to American consumers could be accessed by entities in China.
Temu operates under PDD Holdings, a company founded in China that later moved its principal executive offices to Ireland.
The settlement does not amount to an admission that Texas proved those allegations.
Instead, Temu has agreed to change how it stores, handles and protects consumer information.
Under the new requirements, personal data belonging to Texans must be stored on American-owned and controlled servers physically located in the United States.
Access from China must be limited to information needed for specific business operations.
That could include details such as a shipping address when an overseas seller needs the information to fulfil an order.
Independent Cybersecurity Audits Become Mandatory
Temu will also face ongoing checks of its technology.
The settlement requires third-party cybersecurity audits of the company’s application code and data-security practices.
That matters because regulators have increasingly focused on what mobile applications can access after installation.
Shopping apps may legitimately need information such as an address, payment details or device information.
Problems arise when an app requests permissions or collects information that is not necessary for the service being provided.
Independent reviews are intended to test whether Temu’s systems comply with the restrictions imposed by the settlement.
Texas has also attached a significant financial consequence to future breaches.
Violations of certain data-security provisions could expose Temu to penalties of $8 million for every year the violation continues.
The size of that potential penalty is designed to make continued compliance more than a voluntary commitment.
Settlement Also Targets Dangerous Products
The agreement goes beyond privacy.
Temu will be required to conduct annual independent product-safety testing for items sold through its marketplace.
Texas had raised concerns about reports that some goods available on the platform, including clothing and children’s products, contained potentially hazardous materials.
Under the settlement, products confirmed to contain dangerous chemicals or substances must be removed.
Temu must also terminate sellers responsible for those goods and affiliated stores connected to them.
Affected consumers must be notified and offered full refunds.
This creates a stronger obligation on the marketplace itself rather than leaving responsibility entirely with third-party sellers.
Online marketplaces have often argued that they provide the technology connecting buyers and sellers rather than manufacturing the products themselves.
Regulators are increasingly challenging that distinction when platforms control listings, payments and access to consumers.
Texas Expands Pressure on Big Tech Privacy Practices
The Temu settlement is part of a wider privacy enforcement campaign by Texas.
The state has pursued cases against major technology companies over biometric information, location data, smart television tracking and other forms of consumer data collection.
In 2025, Texas finalised a $1.375 billion privacy settlement with Google over allegations involving location and biometric information.
Earlier this year, LG also agreed to change how its smart televisions collect viewing information following action by the Texas attorney general.
The Temu case adds cross-border data access to that enforcement agenda.
For multinational technology and e-commerce companies, the practical challenge is that individual US states are increasingly imposing their own privacy conditions even without a single comprehensive federal privacy law.
That can force companies to design different data-handling rules for different jurisdictions.
The settlement could also influence how other states approach Temu and similar online marketplaces.
Texas described the agreement as the first state settlement of its kind involving Temu.
What this means for you:
Temu users in Texas should receive stronger protections around where their personal information is stored and who can access it. The case also shows why app permissions and data-sharing practices matter even when using an ordinary shopping platform.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
