Temu settles Texas data privacy lawsuit: US servers, code audit and $3 million payment

Online marketplace Temu has agreed to limits on how it handles the personal data of shoppers in Texas, and to pay the state 3 million dollars, to settle a lawsuit brought by Texas Attorney General Ken Paxton, according to settlement documents made public on Friday, 16 October 2026. Under the deal, Temu will store Texans' personal data on servers in the United States and send to China only the information needed to complete an order, such as a shipping address. It must also hire an independent cybersecurity auditor to inspect its app's code for malware and spyware. Temu did not admit wrongdoing. Texas is the first state to resolve such claims against the company.

Temu, a low-price marketplace linked to China, has faced growing scrutiny in the United States, where officials have raised concerns about Chinese apps collecting large amounts of personal data. The Texas suit went further than most, claiming the app's code reached into users' phones far beyond what a shopping app needs. Temu has always denied this.

The settlement matters because of what it requires rather than the money. Three million dollars is small for a company of Temu's size. The rules on where data is stored and the independent code audit are more significant, because they give an outside party the right to look inside the app. The Attorney General's office called the deal a first of its kind, and described it as "a historic victory for data privacy, consumer protection, and Texans". The penalty clause, up to 8 million dollars a year for violations, gives the state a way to enforce those terms over time.

The product-safety terms are a reminder that the case was not only about data. Texas also raised concerns about harmful substances in goods sold on the platform. Annual independent testing and a duty to remove and refund flagged items put more responsibility on the marketplace itself, rather than leaving it all to the thousands of sellers who list products there.

For technology start-ups and app builders everywhere, the case shows the direction of regulation. Governments increasingly want to know where user data is kept, who can reach it from abroad, and whether an app's code does what its makers say. Data localisation and independent audits, once seen as unusual demands, are becoming standard tools. Indian start-ups building apps for global markets face a similar trend at home, where data protection rules are also tightening, so the Texas terms are a useful example of what regulators may ask for.

Short-term: Temu must change how it stores and transfers Texans' data and appoint an outside auditor. The settlement also gives the other states suing the company a template they may push for in their own cases.

Long-term: If more states follow Texas, data localisation and outside code audits could become the norm for foreign shopping and social apps operating in the US, raising compliance costs for platforms built abroad.

Who is affected: Temu and its owner PDD Holdings; shoppers in Texas; other US states with pending suits; and app developers who handle user data across borders.

Questions and Answers