Temu to pay Texas $3 million and keep Texans' data on US servers in landmark settlement

Temu, the online shopping platform operated by WhaleCo Inc. and its parent PDD Holdings Inc., has grown into one of the most widely used e commerce apps in the United States, reaching more than 82.4 million active American users as of September 2023, according to figures from the office of Texas Attorney General Ken Paxton. That scale has drawn scrutiny from state regulators worried about where consumer data is stored and who can read it. On October 16, 2026, Texas became the first state to resolve those concerns, announcing a settlement that imposes new limits on how Temu handles the personal information of Texans.

The deal follows a lawsuit Texas filed in February 2026, when Paxton accused PDD Holdings and WhaleCo Inc., which does business as Temu, of harvesting the personal information of customers and exposing it to the Chinese Communist Party. The petition also alleged that the company violated Texas law through false pricing schemes, misrepresentations about the quality of its goods, and the covert mining of Texans' data. Temu has denied wrongdoing, and a company spokesperson described the agreement as being in the best interests of all involved.

Several other states have sued Temu in the wake of reports alleging that the company and PDD Holdings used invasive mechanisms in their apps. Texas is the first to reach a resolution, and officials there described the outcome as unprecedented in two specific ways. It is the first time Temu has agreed to keep personal data on US servers and to restrict when it can be sent to China, Texas officials said.

The settlement covers more than data. It also imposes product safety obligations, requiring annual independent testing for dangerous chemicals and materials, including lead, formaldehyde and heavy metals, and requiring the removal of noncompliant products, the termination of responsible sellers, notifications to affected consumers and full refunds. Paxton framed the agreement as a consumer protection measure as much as a privacy one.

Key Facts

Under the settlement, Temu will pay the State of Texas $3 million. Bloomberg Law reported on October 16, 2026, that the resolution requires Temu to store Texans' personal data on American owned and controlled servers in the United States. Texas said violations of data security provisions could trigger an $8 million penalty each year. If an independent audit finds material noncompliance, the company is required to pay the $8 million penalty and must fix the issue within 60 days.

Reuters reported on October 16, 2026, that Temu agreed to send only data necessary to fulfilling a transaction, such as shipping addresses, to China. The company also must hire a third party cybersecurity auditor to examine the app's code for malware and spyware, one of the main concerns that spurred Texas to sue in February. Texas officials said the deal is the first time the company has agreed to keep personal data on US servers and restrict when it can be sent to China.

On product safety, Texas Scorecard reported on October 16, 2026, that Temu must annually test a cross section of products commonly purchased by Texas consumers for harmful materials, including lead, formaldehyde and heavy metals. If a product tests positive above federal safety standards, Temu must remove the product within two business days, directly notify all Texas consumers who purchased it, and provide a full refund. The settlement also requires the company to terminate the seller and its affiliated stores.

Paxton said the settlement requires Temu 'to implement rigorous new product audits and safety standards to protect consumers from dangerous materials in products, including clothing and children's items.' Fox 26 Houston reported on October 16, 2026, that Paxton called the outcome a 'historic victory for data privacy, consumer protection and Texans who deserve to know that the products they purchase are safe.' Temu denied wrongdoing in the settlement documents. A company spokesperson told Texas Scorecard that the agreement, which involves no admission of wrongdoing, is in the best interests of all involved.

Temu's principal offices are currently located in Ireland, according to Texas Scorecard, though Paxton says the company has maintained significant operational ties to China, where it was originally founded. The company had more than 82.4 million active users in the United States as of September 2023, Paxton's office said. Texas sued in February 2026, and the settlement was announced on October 16, 2026.

Analysis

The settlement is modest in dollars but substantial in structure. What this really means is that a single state attorney general has effectively imposed a data localization requirement on a foreign owned shopping platform without waiting for federal legislation or a final court ruling. Texas did not win an admission of wrongdoing, and Temu did not agree to leave the state or change its ownership. Instead, Texas obtained a set of operating rules that apply specifically to Texans' data and to the products shipped to them, and it attached a recurring financial penalty to the failure of those rules.

Consider the incentives. Temu faces an $8 million penalty for each year an independent audit finds material noncompliance, with a 60 day window to fix problems. That structure turns the audit into a yearly compliance event rather than a one time review. The $3 million payment to the state is small compared with the value of continued access to more than 82.4 million US users, but the $8 million annual exposure and the requirement to hire an outside cybersecurity auditor create costs that grow with the size of the Texas business.

The data provisions are the most consequential part of the deal. Only data necessary to fulfilling a transaction, such as a shipping address, may be sent to China, and Texans' personal data must sit on servers owned and controlled by an American company. A third party cybersecurity auditor will examine the app's code for malware and spyware. Those terms address the specific fear that drove the February lawsuit: that data collected in the United States could be read by people or entities in China. The requirements do not ban all transfers, but they narrow them to a transactional minimum and make the rest auditable.

Product safety enforcement follows a similar logic. Annual testing for lead, formaldehyde and heavy metals, a two business day removal deadline after a failed test, direct notifications to buyers and full refunds give the state a paper trail and give consumers a remedy. The bigger picture here is that state attorneys general are becoming de facto regulators of cross border e commerce platforms at a moment when federal rules for foreign owned apps remain unsettled.

Why It Matters

For Texas consumers, the settlement creates enforceable expectations about where their data lives and what happens when a product fails a safety test. The data must be stored on American owned and controlled servers, access from China is restricted, and only transactional information such as a shipping address can be sent abroad. If a product contains dangerous materials above federal standards, the company must remove it within two business days, notify affected buyers and issue full refunds.

For other states, the agreement is a proof of concept. Several states have sued Temu over similar allegations, and Texas is the first to resolve its claims. The combination of a cash payment, a data localization rule, an independent audit and a recurring penalty gives other attorneys general a menu of terms they can seek. It also gives Temu a reason to consider whether a uniform national approach is cheaper than a state by state patchwork of audits and server requirements.

For the wider debate over foreign owned technology platforms, the settlement shows that data privacy and product safety can be addressed through state consumer protection authority even without new federal law. That matters because the questions at the heart of the case, namely who can read Americans' data and what chemicals are allowed in imported goods, have been raised repeatedly in Washington without a comprehensive legislative answer.

Next Up

The first test will be the initial independent audits. Temu must hire a third party cybersecurity auditor to examine its app code for malware and spyware, and it must run annual product safety tests on a cross section of items commonly bought by Texas consumers. If an audit finds material noncompliance, the company has 60 days to fix the problem or face an $8 million penalty for that year. How quickly those audits are completed and published, and whether they uncover anything, will determine whether the settlement is a paper victory or a durable set of safeguards.

The second test is reach. Texas is the first state to settle with Temu, but it is unlikely to be the last to seek similar terms. Other states that have sued will watch whether Temu extends US server storage and China access limits beyond Texas voluntarily or only when required. Temu's spokesperson said the agreement involves no admission of wrongdoing and is in the best interests of all involved.