Temu has agreed to pay Texas $3 million and rewrite how it handles Texans' personal data and product safety after settling a state lawsuit, with the company now required to store residents' information on American-owned servers and submit to independent annual audits for the next four years.
Texas Attorney General Ken Paxton announced the deal this week, calling it a first-of-its-kind agreement that forces the Chinese-founded e-commerce giant to restrict access by people or entities based in China to Texans' personally identifiable data unless it is encrypted, according to facts reported by The Dallas Express. Paxton said the settlement was “a historic victory for data privacy, consumer protection, and Texans who deserve to know products are safe.” The judgment stems from a lawsuit Paxton filed on February 19, 2026, against PDD Holdings Inc. and Whaleco Inc., the entity that operates Temu, accusing the companies of deceptive trade practices, improper data collection, misleading promotions and pricing, and inadequate disclosures about how consumer information is used or shared.
Under the judgment, Temu must pay the $3 million within 30 days after it takes effect, covering civil penalties, attorney fees, investigative fees, and costs. The company must also designate a U.S.-based compliance officer, disclose categories of Texans' data that may be shared outside the United States, and provide a one-click link in its U.S. privacy policy letting logged-in users reach account deletion directly.
Steep Penalties Attached to Annual Audits
The structural remedies carry real financial teeth. Temu faces an $8 million civil penalty for each failed annual app-security or data-access audit that finds material failures, and must correct any material audit noncompliance within 60 days. A separate $8 million penalty applies for material noncompliance found in the annual sensitive-data protections audit, and the company must hire an independent firm each year to test the current mobile app — in both the Apple App Store and Google Play Store versions available to Texas consumers — for malware-like behavior, spyware, or unauthorized data-collection code.
Temu must also identify inactive Texas consumer accounts at least quarterly and generally delete data for accounts inactive for 24 consecutive months, defined as no login, order, or other affirmative interaction during that period. The injunction tied to the judgment remains in effect for four years, and the Collin County court that handled the case retains continuing authority to enforce it. Both Temu and PDD Holdings denied wrongdoing and violating any law, and the settlement resolved the case without a trial or adjudication of the allegations — meaning it is not an admission of liability.
Product Safety Rules Add Refunds and Seller Bans
Beyond data handling, the settlement imposes new product-safety obligations. Temu must monitor U.S. and Texas recall and safety alerts and remove recalled, prohibited, or noncompliant products within two business days of an alert being published. An independent firm must annually test a cross-section of products commonly purchased by Texas consumers for lead, PFAS, phthalates, formaldehyde, and heavy metals.
If that testing finds a harmful material above an applicable federal safety standard — defined in the judgment as a confirmed harmful product — Temu must pull the listing within two business days, terminate the seller and any affiliated stores owned by the same merchant within five business days, notify Texas customers who bought the item, and issue full refunds. Failing to terminate a seller on time can trigger a $600,000 civil penalty, absent a demonstrated identification error. Sellers must also submit product-compliance certificates, manufacturer or private-labeler identification, testing information, and shipment information before listing certain regulated products in Texas.
Part of a Broader Pattern of State and Federal Pressure
Texas is not alone in targeting Temu's practices. Arkansas Attorney General Tim Griffin filed his own lawsuit in Cleburne County Circuit Court back in June 2024, alleging Temu functions as “malware and spyware” that secretly harvests and monetizes user data, according to the Office of the Arkansas Attorney General. Federal regulators have scrutinized the platform too: in September 2024, Consumer Product Safety Commission members Peter Feldman and Douglas Dziak publicly called for a formal federal investigation into Temu and Shein over compliance with the Consumer Product Safety Act, per Morrison Foerster.
That scrutiny tracks a troubling national pattern — nearly 92% of all Chinese-manufactured products subject to federal recalls or safety warnings through mid-September 2025 were linked to major online shopping platforms including Temu, Shein, Amazon, and Walmart, according to the Consumer Federation of America. Overseas, European Union regulators fined Temu €200 million, or roughly $232 million, in May 2026 under the Digital Services Act after finding the platform failed to protect consumers from unsafe or illegal products, as reported by PBS News — an echo of the €200 million Digital Services Act fine Hoodline previously noted in EU tech enforcement coverage.
Texas's Growing Privacy Enforcement Machine
The Temu settlement builds on a enforcement framework Texas has steadily expanded. The Texas Data Privacy and Security Act took effect on July 1, 2024, granting residents explicit rights to access, delete, and opt out of the sale or processing of their personal data, with enforcement power resting exclusively with the state Attorney General's office, according to the Office of the Texas Attorney General. That same month, Paxton launched a specialized Data Privacy and Security Initiative within the Consumer Protection Division, building what the American Bar Association describes as one of the largest state-level privacy enforcement teams in the nation.
That team has already produced two of the largest single-state privacy settlements in U.S. history: a $1.4 billion settlement with Meta in July 2024 over unauthorized biometric data collection, and a $1.375 billion settlement with Google in May 2025 over location and search tracking, according to ICLG. Compared with those figures, Temu's $3 million payment looks modest — but the structural requirements and recurring $8 million audit penalties are designed to keep pressure on the company for years rather than deliver a one-time payout.
Texas has also moved against Temu through its technology procurement rules. The Texas Department of Information Resources lists PDD Holdings, Temu, and Pinduoduo among prohibited software, applications, and developers barred from state-owned devices and networks, subject to exceptions, and Governor Greg Abbott expanded that state technology ban list in January 2026 to add Temu and other Chinese technology companies and platforms. Paxton's office has said Temu had more than 82.4 million active U.S. users as of September 2023.
Market and Trade Pressures Compound the Fallout
The settlement also lands amid broader financial headwinds for Temu's parent company. PDD Holdings saw its stock fall 1.24% on Wall Street following the announcement, as the deal marked the first time Temu agreed to restrict data transfers to China and store Texans' personal data on U.S.-based servers controlled by American entities, according to TipRanks. PDD Holdings was founded in 2015 by Chinese billionaire Colin Huang and relocated its legal corporate headquarters from Shanghai to Dublin, Ireland, in 2023, while keeping its primary executive and operational hubs in China, per Forbes.
Temu's low-cost business model has also taken a hit from trade policy changes. The federal de minimis tariff exemption, which historically let packages valued under $800 enter the U.S. duty-free, was suspended for Chinese imports on May 2, 2025, and extended indefinitely across transport modes by U.S. Customs and Border Protection in June 2026, according to Avalara — sharply raising import costs for Temu's products just as the company now faces new compliance obligations under the Texas judgment, which applies to Texas consumers and remains subject to continuing enforcement authority by the Collin County court.
