Temu, the China-linked discount shopping app, has agreed to keep Texas shoppers' personal data on U.S. servers and to limit when it can be sent to China, settling the state's data privacy claims, Reuters reported Friday, citing documents made public that day. Texas is the first state to resolve such claims against Temu, and its terms give other states suing the company, and regulators weighing other China-linked apps, a concrete model to copy.
What Happened
Under the settlement, Temu will pay Texas $3 million, Reuters reported. Texas said the company could face a penalty of $8 million for each year in which it violates the data security provisions. Texas officials said it is the first time Temu has agreed to keep personal data on U.S. servers and to restrict when that data can be sent to China. The agreement also limits access from China to U.S. data needed to complete a purchase, such as shipping addresses.
The deal reaches beyond data. Temu agreed to annual independent product safety testing to find items containing dangerous chemicals and materials. When testing finds them, Temu must remove the products, terminate the seller and its affiliated stores, notify affected Texas consumers and give them full refunds. Attorney General Ken Paxton said the settlement requires Temu "to implement rigorous new product audits and safety standards," pointing to clothing and children's items. He also said it will stop Temu from collecting and using Americans' data, though Reuters did not detail how.
Temu did not admit wrongdoing. The company said it "has come to an agreement to resolve this matter" and that it remains focused on serving consumers and supporting businesses in Texas. Texas had alleged that Temu used code that gave it an inappropriate level of access to users' devices, an allegation Temu denies.
The attorney general's office said Temu had more than 82.4 million active U.S. users as of September 2023. The agreed final judgment was filed in the 471st District Court in Collin County, Texas.
Why It Matters
The settlement converts a broad national security worry, that Chinese authorities could reach Americans' data held by a China-linked company, into specific operating rules backed by money: where the data is stored, when it can be sent to China and what each year of noncompliance costs. Because the terms came out of a state consumer protection case rather than federal action, they show that a single attorney general can extract data-handling commitments from a foreign-owned platform.
For other states, the Texas terms set a reference point. Several states have sued Temu alleging it unlawfully harvests U.S. user data that the Chinese government could access, following reports that Temu and its parent, PDD Holdings, built invasive mechanisms into their apps. Those states can now cite commitments Temu has already accepted when they negotiate. For companies whose apps or data flows touch China, the deal signals that state enforcers are prepared to write storage location and access limits into settlements, not just collect fines.
The penalty is the enforcement lever. Under the judgment, Temu must hire a qualified independent firm to assess its compliance each year and give the attorney general's office the firm's report, and it owes $8 million for each failed annual audit.
Context
The Texas deal comes days after Missouri Attorney General Catherine Hanaway sued Temu on Oct. 13, alleging that its app covertly collects users' location and device data and is built to evade detection. Missouri is seeking a permanent injunction, restitution and civil penalties of $1,000 per violation. That case is one of the several still pending.
What to Watch
- Whether Missouri and the other states seek the same localization and access limits, or stricter ones, in their own cases.
- What the first annual independent assessment of Temu's data handling finds.
- Whether Temu applies the same data handling to customers outside Texas, which the reported terms do not require.
