Missouri Attorney General Catherine Hanaway sued Temu Tuesday, alleging the discount shopping app secretly collects precise location and other sensitive data from users' phones and is built to evade detection, her office said in a news release. The case shows states using consumer protection law to police data security and possible foreign access in widely installed apps, an issue that reaches into corporate policies on what employees can run on their phones.

What Happened

The petition, filed in the Circuit Court of Cole County, names PDD Holdings, formerly known as Pinduoduo, along with Whaleco, which does business as Temu, and Temu Payments. It brings four counts under the Missouri Merchandising Practices Act, the state's main consumer protection law, and one for unjust enrichment.

The state says its claims about how the app works rest on a forensic review by experts it hired, who examined Temu's code and that of its predecessor, the Pinduoduo app. According to the petition, the app collects users' real-time location to within 10 feet, details of nearby Wi-Fi networks, and lists of other installed apps and accounts. The release also cites access to the phone's microphone and camera.

RelatedU.S. Begins Selecting Leaders for Program Enlisting Firms Against Foreign Cybercriminals

The petition alleges that Temu uses layers of encryption and code that checks whether the app is being examined by researchers, in order to hide its data collection. It also alleges that a tool built into the app lets Temu change its behavior on a user's phone without going through the Apple or Google app store review process. And it says Temu reuses large portions of code from the Pinduoduo app, which Google suspended from its Play store in March 2023 over malware concerns.

The state also points to PDD's operations in mainland China, where it says the law can require companies to give authorities access to data. The release says PDD acknowledges that risk in its filings but that users are not told about it when they sign up. Separately, the suit accuses Temu of deceptive pricing, misleading claims about product quality, a lack of age checks and listings that use trademarks of Missouri teams and brands without permission.

Missouri is seeking a permanent injunction, restitution and civil penalties of $1,000 per violation, plus its investigation costs. "My advice to all Missourians is to delete this app," Hanaway said in the release. A response from Temu was not included in the release or in an Insurance Journal report on the suit. All claims are allegations that the companies can contest in court.

Why It Matters

For security and compliance leaders, the most consequential allegation is technical: that an app can change its own code after installation, outside app store review. If a court accepts that claim, it would weaken the assumption many organizations make that apps approved by Apple or Google stores are safe enough for work devices. Companies that let staff install consumer apps on phones that also carry corporate email and data may want to revisit their allow lists and mobile device management settings.

The suit also shows how states are approaching apps with ties to China. Rather than relying on federal national security tools, Missouri frames the issue as consumer deception: users were not told what data was collected or that it could be reachable by Chinese authorities. That route lets a single state attorney general seek penalties and court orders without waiting for federal action.

Because the technical findings come from an expert team hired by the state, they have not yet been tested in court. How they hold up against Temu's own experts will matter for other states weighing similar cases.

What to Watch

Watch for Temu's formal response and any motion to dismiss or move the case to federal court. Also watch whether the court allows the state's forensic findings to be examined in detail, and whether other attorneys general bring similar claims or rely on Missouri's technical evidence.