Temu Settles Texas Lawsuit for $3 Million Over Consumer Data Privacy and Product Safety

Temu Agrees to New Privacy Rules After Texas Lawsuit

Temu, the online shopping platform owned by Chinese e-commerce group PDD Holdings, has agreed to pay $3 million to Texas to resolve a lawsuit concerning consumer data privacy and product safety. The agreement requires the company to introduce stricter controls over personal information, strengthen cybersecurity oversight, and improve its procedures for identifying potentially dangerous products.

The settlement was announced on October 16, 2026, by Texas Attorney General Ken Paxton. It follows allegations that Temu’s shopping application collected sensitive information inappropriately and that certain products offered through its marketplace could contain hazardous materials.

Under the agreement, Texans’ personal data must be stored on US-based servers owned and controlled by American entities. Access from China will be restricted, subject to limited exceptions for essential business purposes. The company must also arrange independent cybersecurity reviews and conduct annual product safety testing.

Temu has denied wrongdoing. The settlement establishes new obligations for the company but should not be interpreted as a court finding that the original allegations were proven.

The agreement is significant because it combines a financial payment with specific requirements intended to protect consumers and reduce future compliance risks.

What Was the Texas Lawsuit Against Temu About?

The legal dispute centred on allegations concerning Temu’s handling of customer information and the safety of products sold through its platform.

In February 2026, Texas Attorney General Ken Paxton filed a lawsuit against PDD Holdings and WhaleCo Inc., the company operating Temu in the United States. The complaint alleged that Temu misled consumers about its data practices and used application functions that could access sensitive information beyond what was necessary for ordinary shopping activities.

Texas officials also questioned whether consumers’ information could be accessed by entities in China.

Alongside the privacy allegations, the state raised concerns about potentially hazardous substances in products available through Temu’s marketplace.

These claims brought two important consumer protection issues together:

• Personal data security: Whether the application adequately limited the collection, storage, and access of sensitive customer information.
• Product safety: Whether products sold through the marketplace were subject to sufficient checks for potentially harmful materials.

The lawsuit represented the state’s allegations, not a final judicial finding against Temu. The company disputed the accusations and agreed to resolve the case under the settlement’s terms.

What Changes Must Temu Make Under the Settlement?

The agreement requires Temu to implement several measures affecting how it handles consumer information and monitors products.

1. Store Texans’ personal data in the United States

One of the central requirements is that Texans’ personal data be stored on servers located in the United States and owned and controlled by American entities.

The agreement also limits access to that information from China, subject to exceptions for essential business needs.

For example, certain information may need to be transferred to support order fulfilment or other necessary retail operations. Any such access must comply with the settlement’s requirements.

The purpose is to establish stronger controls over where consumer data is stored and who can access it.

2. Strengthen cybersecurity oversight

Temu must strengthen its security procedures and arrange an independent review of its application’s code for potential malware and spyware concerns.

Independent oversight is intended to provide additional scrutiny of the software and identify potential security weaknesses.

However, the settlement should not be interpreted as confirmation that Temu’s application was proven to contain spyware. The underlying allegations were disputed.

3. Introduce annual product safety testing

The agreement also requires annual independent testing to identify products that contain dangerous chemicals or materials.

If a product is confirmed to contain hazardous substances, Temu must take specified corrective actions, including removing the product from its marketplace.

The company must also terminate the responsible seller and its affiliated stores, notify affected Texas consumers, and issue full refunds under the agreement’s product safety provisions.

These requirements are intended to improve accountability and provide customers with clearer remedies when dangerous products are identified.

How Much Is Temu Paying Texas?

Temu has agreed to pay the state $3 million as part of the settlement.

The agreement also provides for a potential $8 million penalty for each year in which specified data security provisions are violated. This is a conditional enforcement provision, not an additional payment that Temu has automatically been required to make.

The main financial and compliance provisions are summarised below.

The settlement therefore combines a financial resolution with requirements designed to govern Temu’s future conduct.

Temu Lawsuit Timeline: Key Events Behind the Settlement

The Texas agreement followed several years of growing scrutiny over Temu’s data practices and business operations.

The earlier security allegations were not equivalent to findings of wrongdoing. Likewise, the Texas settlement does not automatically resolve separate cases brought by other states.

Why Is Temu’s Chinese Ownership a Concern for US Officials?

Temu operates under PDD Holdings, a company with Chinese origins. Its ownership and cross-border business relationships have prompted questions from US officials about the protection of American consumers’ personal information.

The broader concern involves the possibility that data collected by foreign-linked technology companies could become accessible to parties outside the United States.

Texas alleged that Temu’s application could access information beyond what was appropriate for its retail functions and raised concerns about possible access by Chinese entities.

It is important to distinguish those allegations from proof that the Chinese government actually obtained Temu customers’ information. The settlement does not establish that such access occurred.

The new US data storage and access restrictions are intended to address the risks identified by Texas officials. Their effectiveness will depend on the company’s compliance, the independent reviews, and enforcement of the agreement.

How Could the Settlement Affect Temu Customers?

The settlement introduces specific protections for Texas consumers, particularly regarding data handling and products confirmed to contain dangerous materials.

Customers may benefit from stricter access controls over their personal information and clearer procedures for addressing unsafe products.

The refund and notification requirements are particularly important because they establish steps Temu must take when testing confirms that a product contains hazardous materials.

However, the agreement does not guarantee that every product sold through the platform is safe or that every potential cybersecurity risk has been eliminated.

Consumers should continue to review application permissions, avoid sharing unnecessary personal information, and check product descriptions and safety information before purchasing items.

The agreement’s specific requirements for Texas consumers should also not be assumed to apply identically to customers in every other US state or country.

Could Temu Face More Lawsuits in the United States?

The Texas settlement does not automatically end the legal challenges Temu faces elsewhere.

Arizona filed a separate lawsuit in December 2025 concerning alleged data collection and consumer protection violations. That case involves its own allegations and legal proceedings.

Other states may also examine online marketplace practices, particularly where concerns arise about consumer privacy, product safety, or the transparency of business operations.

However, the Texas settlement does not automatically establish liability in other jurisdictions or require other states to accept the same terms.

Its broader significance lies in demonstrating how state authorities can use litigation and negotiated agreements to impose specific consumer protection obligations on online businesses.

Conclusion

Temu’s agreement to pay Texas $3 million marks an important development in the state’s legal dispute over consumer privacy and product safety.

The settlement requires stronger controls over Texans’ personal data, restrictions on access from China, independent cybersecurity reviews, and annual product testing. It also establishes procedures for removing confirmed hazardous products, terminating responsible sellers, notifying affected consumers, and providing refunds.

Temu denied wrongdoing, and the agreement should not be presented as a judicial finding that the original allegations were proven.

The next important issue is how the company implements the new requirements and whether separate legal challenges lead to additional restrictions. For consumers, the case highlights the importance of transparent data practices, effective cybersecurity, and meaningful product safety protections in online shopping.