Temu Agrees to $3 Million Settlement in Texas Data Privacy Lawsuit
Online shopping platform Temu has agreed to pay $3 million to Texas and introduce significant changes to its data privacy and product safety practices following a lawsuit brought by Texas Attorney General Ken Paxton.
The settlement, announced on October 16, 2026, addresses allegations that Temu improperly collected consumers’ personal information and exposed sensitive data to potential access by Chinese entities. Texas also raised concerns about potentially hazardous materials in products sold through the platform.
Under the agreement, Temu must store Texans’ personal data on US-based servers owned and controlled by American entities, restrict access from China subject to limited business necessities, and strengthen its cybersecurity and product safety procedures. The agreement also requires annual independent product safety testing.
The company must remove products confirmed to contain dangerous materials, terminate the responsible sellers and their affiliated stores, notify affected consumers, and issue full refunds. Texas also stated that violations of specified data security provisions could trigger an $8 million penalty for each year in which a violation occurs.
Temu did not admit wrongdoing as part of the settlement. The company said it had reached an agreement to resolve the matter and would continue serving consumers and supporting businesses in Texas.
The settlement marks a significant development in the growing debate over the handling of American consumer data by foreign-owned technology and retail companies.
Why Did Texas Sue Temu?
The legal dispute began with concerns about how Temu’s shopping application collected, accessed, and handled personal information.
In February 2026, Texas Attorney General Ken Paxton filed a lawsuit against PDD Holdings Inc. and WhaleCo Inc., which operates Temu in the United States. The lawsuit alleged that the company misled consumers about its data practices and used software functions that could provide inappropriate access to information stored on users’ devices.
According to the attorney general’s allegations, the app’s code could access more information than necessary for an ordinary online shopping service. Officials also raised concerns about the possibility of sensitive American consumer data being accessible to entities in China.
Temu denied the allegations. The claims in the original lawsuit should therefore be distinguished from the obligations the company accepted under the settlement.
The Texas case focused on two broad areas:
- Data privacy and cybersecurity: Whether Temu’s data collection practices and app functions adequately protected consumers’ personal information.
- Consumer product safety: Whether products available through the marketplace could expose customers to potentially harmful chemicals or materials.
The settlement addresses both issues by imposing new requirements on the company’s data handling and product monitoring practices.
What Are the New Data Privacy Restrictions?
One of the most important elements of the agreement is the requirement to keep Texans’ personal data on servers located in the United States that are owned and controlled by American entities.
The settlement also restricts access to that information by individuals and entities based in China, subject to limited exceptions for essential business functions.
For example, information needed to fulfil an online order, such as a customer’s shipping address, may be transferred to China when necessary under the agreement’s terms. The restrictions are intended to limit access to American consumers’ information while allowing essential retail operations to continue.
The requirements represent a more specific commitment than a general promise to protect customer privacy. They establish conditions concerning where data is stored and who can access it.
The settlement also requires Temu to strengthen its cybersecurity safeguards. Reuters reported that the agreement includes the appointment of an independent cybersecurity auditor to examine the app’s code for malware and spyware, addressing one of the concerns raised in Texas’s lawsuit.
However, the agreement should not be interpreted as proof that the allegations about spyware or unlawful data collection were established in court. Temu denied wrongdoing and agreed to the settlement’s restrictions.
Temu Must Introduce Stronger Product Safety Testing
The agreement is not limited to privacy and data security. It also introduces new obligations concerning products sold through Temu’s marketplace.
Texas officials raised concerns about the possibility of dangerous chemicals and materials appearing in products such as clothing, household goods, children’s toys, and baby products.
Under the settlement, Temu must conduct annual independent product safety testing to identify items containing dangerous substances or materials.
If testing confirms that a product contains hazardous materials, the company must take several steps:
- Remove the affected product from the marketplace.
- Terminate the responsible seller and its affiliated stores.
- Notify Texas consumers who may have purchased the product.
- Issue full refunds to affected consumers.
The agreement also requires stronger product audits and safety standards, including measures relating to clothing and children’s items.
These requirements are intended to strengthen consumer protection. They do not mean that every product sold on Temu is unsafe or that all products identified in the original allegations have been confirmed to contain harmful substances.
The practical impact will depend on how the company implements the testing, reporting, removal, and refund procedures.
How Much Will Temu Pay Texas?
Temu has agreed to pay $3 million to the state of Texas as part of the settlement.
In addition, the agreement establishes the possibility of an $8 million penalty for each year in which specified data security provisions are violated. These are potential penalties, not an additional amount that Temu has automatically been ordered to pay under the settlement.
The financial provisions create two distinct obligations:
| Settlement provision | What it means |
| $3 million payment | The amount Temu agreed to pay Texas to resolve the case. |
| Potential $8 million annual penalty | A possible penalty for violations of specified data security provisions. |
| Independent cybersecurity review | An independent auditor will examine the app’s code for security concerns. |
| Annual product testing | Products will be tested for dangerous chemicals and materials. |
| Consumer refunds | Full refunds are required for affected Texas consumers under the agreement’s product safety provisions. |
The settlement is designed to address both the state’s claims and future compliance. The potential penalties give Texas an additional enforcement mechanism if the company fails to follow the specified data security requirements.
Temu Lawsuit Timeline: From Privacy Concerns to Settlement
The Texas settlement follows a series of developments that brought Temu’s data practices under increased scrutiny in the United States.
| Date | Development |
| 2023 | A report by short seller Grizzly Research alleged that Temu’s app contained functions capable of extracting extensive user information. Temu disputed the claims. |
| 2025 | Concerns about data handling continued, while Temu expanded efforts to localise US data storage. |
| December 2025 | Arizona filed a separate lawsuit against Temu and its parent company over alleged data collection and consumer protection violations. |
| February 19, 2026 | Texas Attorney General Ken Paxton filed suit against Temu’s operating entities over alleged deceptive practices and improper data collection. |
| October 16, 2026 | Texas announced a settlement requiring data security restrictions, product safety measures, and a $3 million payment. |
The timeline illustrates how concerns that initially emerged through security reports developed into legal disputes brought by state authorities.
The allegations in those earlier reports and lawsuits were disputed by Temu. The settlement with Texas establishes specific obligations for the company, but it does not automatically resolve separate lawsuits filed by other states.
Why Are US Authorities Concerned About Temu’s Chinese Connections?
Temu operates under PDD Holdings, a multinational company founded in China. Its ownership and business connections have attracted scrutiny from US officials concerned about cross-border data access.
The concern is broader than Temu alone. US authorities have examined whether foreign-linked technology companies adequately protect American consumers’ personal information and whether data could become accessible to foreign governments.
In Temu’s case, Texas officials alleged that the shopping app’s software could access information beyond what was appropriate for its retail functions. They also raised concerns about the possibility of data being exposed to Chinese entities.
These concerns are allegations, not proof that the Chinese government accessed Temu users’ information. The publicly reported settlement does not establish that such access occurred.
The new restrictions on US data storage and access are intended to reduce the risks identified by Texas officials. Whether the measures provide sufficient protection will depend on compliance, independent auditing, and effective enforcement.
The case also highlights the growing importance of data localisation, a practice in which personal information is stored within a particular country or jurisdiction.
How Could the Settlement Affect Temu Customers?
The settlement directly establishes new requirements for Texas consumers’ data and certain product safety practices. Its provisions should not automatically be assumed to apply in identical form to every Temu customer elsewhere in the United States or internationally.
For Texas shoppers, the main changes concern the handling of personal information, product testing, and remedies when hazardous products are confirmed.
Customers may benefit from clearer limits on data access and stronger procedures for identifying unsafe goods. The refund and notification requirements could also improve the process for dealing with products confirmed to contain dangerous materials.
Nevertheless, the settlement does not guarantee that every product is risk-free or that every possible data security threat has been eliminated.
Consumers should continue to review app permissions, avoid providing unnecessary personal information, and check product descriptions and safety information before making purchases.
Could Other States Take Similar Legal Action?
Temu has faced separate legal challenges from other US states over allegations concerning data privacy, consumer protection, and product practices.
Arizona, for example, filed a lawsuit against Temu and PDD Holdings in December 2025, alleging unlawful data collection and other consumer-related violations. Temu denied those allegations as well.
The Texas settlement may become an important reference point for other states examining similar concerns. However, it does not automatically resolve those separate cases or require other states to adopt the same approach.
Each proceeding depends on its own allegations, applicable laws, evidence, and any settlement reached by the parties.
The agreement nevertheless demonstrates that state authorities are increasingly using litigation and negotiated restrictions to address concerns about consumer data and online marketplace safety.
Conclusion
Temu’s agreement to pay Texas $3 million and introduce new privacy and product safety measures marks a major development in the state’s legal challenge against the online shopping platform.
The settlement requires US-based storage of Texans’ personal data, restrictions on access from China, independent cybersecurity oversight, annual product safety testing, and procedures for removing hazardous products and refunding affected consumers.
The case began with allegations that Temu’s app collected personal information inappropriately and that products sold through the platform could contain dangerous materials. The company denied wrongdoing and did not admit liability under the settlement.
The next important question is how effectively Temu implements the new requirements and whether other states pursue similar agreements or continue their separate lawsuits.
For consumers, the case serves as a reminder that affordable online shopping should be accompanied by clear privacy protections, transparent data practices, and effective product safety standards.
