Texas settles with Temu: $3M and strict limits on China-based data access

Texas has settled its consumer protection lawsuit against Temu. Temu and its parent, PDD Holdings, will pay $3 million. Texans' personal data must be kept on U.S. servers owned and controlled by an American company, and people and companies based in China get only limited access. Attorney General Ken Paxton announced the deal on Oct. 16. The companies deny wrongdoing and admit no liability.

What the deal requires

The court judgment sorts data into two groups. For sensitive data, people and companies based in China cannot see it in readable form unless the customer gives specific consent. Each consent covers one instance of access. For ordinary data, access is allowed when it is reasonably necessary for things like filling orders, fighting fraud, fixing the app, or following U.S. law.

Temu must also test commonly bought products each year through independent testing. If a product is confirmed harmful, Temu must pull the listing, cut off the seller and its related stores, tell Texas buyers and refund them.

Where the money is

The biggest penalty is not the $3 million payment. A failed annual audit by an independent firm that Temu hires carries an $8 million penalty. That is about 2.7 times the settlement. Failing to shut down a harmful seller's store within five business days costs $600,000.

The press release and the judgment do not match exactly. The release described an $8 million penalty for each year a violation occurs. The judgment ties it to a failed audit. It also does not use the release's phrase about essential business functions.

Fine print worth knowing

• Smaller audit problems get 60 days to fix before any penalty applies.
• Other breaches can bring penalties of up to $10,000 per violation.
• For most data terms, those penalties start on the 31st day after written notice.

What happens next

Reuters reported that Texas is the first state suing Temu to resolve its claims. Other states have not settled. For any business that holds customer data or uses overseas vendors, the lesson is practical. Regulators may ask for outside audits and clear limits on who can see that data.