Online retailer Temu has agreed to new requirements governing Texas consumers’ data, mobile-app security, product testing, recalls and refunds under a court-approved settlement announced by Attorney General Ken Paxton, according to the Dallas Express. Temu must pay Texas $3 million and submit to independent annual audits.
The judgment resolves a lawsuit Texas filed in February against PDD Holdings and Temu operator Whaleco. The companies denied wrongdoing and did not admit liability. The agreement ended the case without a trial or adjudication of the state’s allegations, an important distinction from a finding that Temu violated the law.
The $3 million payment covers civil penalties, attorney fees, investigative fees and costs. The agreement also creates larger potential penalties for future noncompliance. A materially failed annual app-security audit or sensitive-data audit can trigger an $8 million penalty, followed by a 60-day correction period.
For Texas users, the settlement generally requires personal data to be stored on U.S.-located commercial servers owned and controlled by an American company. Access from China to personally identifiable data in unencrypted or decryptable form is restricted, subject to specified exceptions for activities such as order fulfillment, fraud prevention, platform security, legal compliance and consent. Temu must designate a U.S.-based compliance officer and disclose categories of Texans’ information that may be shared outside the country.
The company must also identify inactive Texas accounts at least quarterly. Information associated with an account inactive for 24 consecutive months generally must be deleted unless continued retention is reasonably necessary for a permitted legal or business purpose. Logged-in users must receive a direct account-deletion link through the U.S. privacy policy.
Product-safety provisions require independent annual testing of a cross-section of commonly purchased goods for substances including lead, PFAS compounds, phthalates, formaldehyde and heavy metals. Listings for products confirmed above applicable federal safety standards must be removed within two business days. Temu must then terminate the responsible seller and affiliated stores within five business days, notify Texas purchasers and provide full refunds. Missing the seller-termination deadline can carry a separate $600,000 penalty unless an identification error is demonstrated.
The injunction generally lasts four years, and the Collin County district court retains enforcement authority. The settlement is significant because it turns Texas consumer-protection claims into continuing compliance duties rather than a one-time payment. Its effectiveness will depend on the independent audits, Temu’s implementation and the state’s willingness to enforce any future violations.