Temu agrees to data privacy curbs in Texas lawsuit

Chinese online retailer Temu has agreed to settle data privacy claims raised by Texas and will restrict how it handles personal data from shoppers in the state, according to documents made public on Friday.

Temu faces several lawsuits from US states concerned that the company unlawfully harvests US user data that could be accessed by the Chinese government. Texas is the first to resolve such claims. It is also the first time the company has agreed to keep personal data on US servers and restrict when it can be sent to China, Texas officials said.

The company agreed to conduct annual independent product safety testing to identify products containing dangerous chemicals and materials. Temu must remove any products found to contain dangerous materials, terminate the seller and its affiliated stores, notify affected Texas consumers and issue full refunds.

Texas Attorney General Ken Paxton said the settlement also requires Temu “to implement rigorous new product audits and safety standards to protect consumers from dangerous materials in products, including clothing and children’s items.”

He added it will prevent Temu from collecting and using Americans’ data.

Temu had more than 82.4 million active users in the US as of September 2023, Paxton’s office said.

Temu will pay US$3 million to the state as part of the settlement and Texas said failure to abide by various data security provisions would result in a potential US$8 million penalty each year a violation occurs.

Several states sued Temu in the wake of reports alleging Temu and parent company PDD ‌Holdings used invasive mechanisms in their apps.

Temu, which did not admit wrongdoing, said in a statement the company “has come to an agreement to resolve this matter as we continue to focus on serving consumers and supporting businesses across Texas.”

Under the terms of the settlement, Temu agreed to restrict access to US data necessary to fulfill a transaction, such as shipping addresses, to China.

Texas alleged that Temu used code that allows an inappropriate level of access to users’ devices. Temu has denied the allegations.