Texas Attorney General Ken Paxton announced Friday that online retailer Temu has agreed to sweeping new requirements governing Texans’ personal data, mobile-app security, product testing, recalls, and refunds to settle a lawsuit filed by the state in February.
The court-approved agreement requires Temu to pay Texas $3 million and submit to independent annual audits. Material failures in certain app-security or data-access audits can trigger an $8 million civil penalty for each failed annual audit, according to the judgment entered in Collin County’s 471st Judicial District Court. The injunction generally remains in effect for four years.
Texas Settlement Reaches Beyond $3 Million Payment
Paxton judgment for consent, order fulfillment, fraud prevention, platform security, and legal compliance.
The company must designate a U.S.-based compliance officer, disclose categories of Texans’ data that may be shared outside the United States, and identify inactive Texas consumer accounts at least quarterly. Data tied to accounts inactive for 24 consecutive months generally must be deleted unless retention remains reasonably necessary for specified legal or business purposes. The judgment defines an inactive account as one with no login, order, or other affirmative interaction with Temu during that period.
Temu must also place a “one-click” link in its U.S. privacy policy for logged-in users to reach the account-deletion process.
Annual App Tests Will Look For Spyware And Hidden Collection
Temu must hire an independent firm to test the then-current version of its mobile application each year for behavior consistent with malware, spyware, or unauthorized data-collection code. The requirement applies to versions available to Texas consumers through the Apple App Store and Google Play Store.
The settlement resolves the lawsuit Paxton filed February 19 against PDD Holdings Inc. and Whaleco Inc., which operates Temu. The Dallas Express previously reported that Texas accused the platform of deceptive trade practices, improper data collection, misleading promotions and pricing, and inadequate disclosures about how consumer information could be used or shared.
Lead, PFAS, And Other Chemicals Face Annual Testing
The injunction also imposes product-safety requirements.
Temu must monitor U.S. and Texas recall and safety alerts and remove recalled, prohibited, or noncompliant products from its platform within two business days after an alert is published.
An independent firm must annually test a cross-section of products commonly purchased by Texas consumers for harmful materials, including lead, PFAS compounds, phthalates, formaldehyde, and heavy metals. A product becomes a “Confirmed Harmful Product” under the judgment if the final audit report finds a harmful material above an applicable federal safety standard.
When that occurs, Temu must remove the listing within two business days, terminate the seller and affiliated stores owned by the same underlying merchant within five business days, notify Texas customers who bought the product, and issue full refunds. Failure to terminate the seller on time is a separate violation carrying a $600,000 civil penalty, absent a demonstrated identification error.
Before certain regulated products may be listed for sale to Texas consumers, sellers must also submit product-compliance certificates, manufacturer or private-labeler identification, testing information, and shipment information.
Texas Had Already Put Temu On State Technology Ban List
The settlement follows a broader Texas crackdown on technology tied to China. The Texas Department of Information Resources currently lists PDD Holdings, including Temu and Pinduoduo, among prohibited software, applications, and developers barred from state-owned devices and networks, subject to limited exceptions.
Gov. Greg Abbott expanded that list in January, adding Temu and other Chinese technology companies and platforms. The Dallas Express reported at the time that the move broadened state restrictions aimed at cybersecurity and data-security risks.
Temu had more than 82.4 million active U.S. users as of September 2023, according to Paxton’s office. The new judgment applies specifically to Texas consumers and gives the Collin County court continuing authority to enforce its terms.
“This is a historic victory for data privacy, consumer protection, and Texans who deserve to know that the products they purchase are safe,” Paxton said in Friday’s announcement.
Provided by Dallas Express
