Temu and its parent company, PDD Holdings, have agreed to new restrictions on how the online shopping platform stores and accesses Texas consumers’ personal data under a settlement announced by Texas Attorney General Ken Paxton on October 16, 2026.
The proposed agreement requires Temu to store Texans’ personal information, including sensitive data, on commercial servers located in the United States and owned and controlled by an American company. It also restricts access to identifiable data by people and entities based in China, introduces annual independent security audits and requires a $3 million payment to the state.
The 27-page agreed judgment sets out the terms negotiated by Texas and the companies, including Whaleco Inc., which operates Temu. However, the publicly available copy has a blank judicial signature line and no signing date, leaving the court’s formal entry of the judgment unconfirmed.
The restrictions do not amount to an absolute ban on every transfer of data to China. The agreement permits certain access where a consumer gives specific consent and allows limited access to non-sensitive information when reasonably necessary for functions such as order processing and delivery, fraud prevention, platform security and compliance with US or Texas law.
Temu would also have to identify in its US privacy policy the categories of Texas consumers’ information that may be shared with third parties outside the country. The agreement requires a US-based compliance officer and directs the company to review inactive Texas accounts at least quarterly. Personal data associated with accounts that have had no login, order or other affirmative interaction for 24 consecutive months must be deleted unless an applicable retention exception applies.
Independent firms would be required to test Temu’s mobile app annually for malware, spyware and unauthorised data-collection code. Separate annual audits would assess compliance with the agreement’s data-storage and access restrictions. Material noncompliance identified through the applicable annual audits can trigger an $8 million civil penalty under the relevant provision, alongside requirements to correct the problem.
The settlement also addresses product safety. Temu would have to arrange independent annual testing of a cross-section of products commonly purchased by Texas consumers for substances including lead, PFAS compounds, phthalates, formaldehyde and heavy metals. Products confirmed to exceed applicable federal safety standards must be removed within two business days, and affected Texas buyers must receive direct notification and a full refund.
The $3 million payment is payable to the State of Texas, rather than a general compensation fund for Temu customers. Under the proposed judgment, payment is due within 30 days after the agreement’s effective date.
Texas filed its lawsuit against PDD Holdings and Whaleco in February 2026, alleging deceptive business practices, excessive collection of personal information and inadequate disclosure of how consumer data could be handled or accessed. The case also challenged aspects of Temu’s promotional practices and product-safety controls. Those allegations were not findings made after a trial.
Temu denies wrongdoing. The agreed judgment states that the settlement is not an admission of liability and does not constitute a judicial finding that the companies violated the law.
The judgment defines its effective date as the date it is signed by the court. Its payment and compliance deadlines are measured from that date, which is not established by the unsigned public copy.
Discover more from Aree Blog
Subscribe now to keep reading and get access to the full archive.
