Under a settlement resolving a state lawsuit, Temu faces obligations to pay Texas $3 million, overhaul its data-handling practices for state residents, route personal information through servers held by American-owned entities, and open its product-safety operations to independent third-party audits on an annual basis across a four-year window.

Under the agreement announced by Texas Attorney General Ken Paxton, the e-commerce platform — founded in China — would be required to bar individuals and organisations with ties to China from accessing unencrypted personal data belonging to Texas residents. Paxton described the settlement as the first of its kind, according to a news outlet's reporting.

Paxton described the settlement as a noteworthy outcome for data privacy protections and consumer rights, adding that Texans are entitled to confidence in product safety. The resolution flows from a February 19, 2026, lawsuit he brought against PDD Holdings Inc. and Whaleco Inc., the corporate entity behind Temu, over allegations that included deceptive trade practices, unauthorised data collection, misleading promotions and pricing structures, and insufficient disclosure of how personal consumer information is handled or distributed.

A 30-day window follows the order taking effect, during which Temu is required to remit the full $3 million sum — an amount that accounts for civil penalties alongside attorney fees, investigative fees, and associated costs.

Among the obligations placed on the firm: appointing a compliance officer based within the United States, publishing a breakdown of the categories of Texans' personal data that may be transferred abroad, and embedding a single-click pathway inside its U.S. privacy policy through which logged-in users can navigate directly to account deletion.

Enforcement provisions attached to the measures carry monetary consequences. Under the settlement terms, an $8 million civil penalty attaches to Temu for each yearly app-security or data-access audit that turns up material failures, with any such noncompliance requiring correction within a 60-day window. An additional $8 million fine attaches whenever the annual audit of sensitive-data protections uncovers material noncompliance, and the company faces a yearly obligation to retain an outside firm tasked with examining both the Apple App Store and Google Play Store versions of its mobile app — the editions available to Texas consumers — for code that collects data without authorisation, behaves like spyware, or otherwise mimics malware.

Under the settlement's data-retention provisions, Temu faces a requirement to audit its Texas user base for dormant accounts on at least a quarterly basis, removing stored personal information tied to any account that has gone 24 straight months without a login, a purchase, or any other form of active engagement. A four-year enforcement window governs the injunction attached to that ruling, with the Collin County court that presided over the matter holding ongoing power to compel compliance.

Temu and PDD Holdings each maintained they had done nothing unlawful, with the settlement reached without a trial or formal adjudication of the allegations. The agreement carries no finding of fault against either party.

The agreement's reach extends past data-handling provisions, folding in a set of product-safety requirements as well. Under the terms of the arrangement, Temu is required to track recall and safety notices issued by both U.S. federal and Texas authorities, pulling any flagged, banned, or out-of-compliance items from its platform no later than two business days after each notice goes live.

Each year, a third-party firm is required to pull a representative sample of goods routinely bought by Texas shoppers and run them through testing for lead, PFAS, phthalates, formaldehyde, and heavy metals. Where testing confirms a product contains a regulated harmful substance at levels exceeding the applicable federal threshold, the court order requires Temu to delist the item within two business days, close the seller's account along with any other storefronts tied to that same merchant within five business days, contact Texas-based customers who purchased the product, and provide complete refunds.

Where a seller's removal falls outside the required timeframe — and no proof of a mistaken identification exists — a civil penalty of $600,000 can be imposed. Prior to listing certain regulated products in Texas, those doing the selling are required to file product-compliance certificates, identification details for the manufacturer or private labeler, and documentation covering both testing and shipment.

A lawsuit filed by Arkansas Attorney General Tim Griffin in Cleburne County Circuit Court in June 2024 contended that the Temu platform operates as data-harvesting software that collects and monetizes personal user information without disclosure, according to the Office of the Arkansas Attorney General. In September 2024, Consumer Product Safety Commission members Peter Feldman and Douglas Dziak jointly called for a structured federal investigation into whether Temu and Shein satisfy the obligations set out under the Consumer Product Safety Act, a step that brought both online retailers under a new layer of regulatory scrutiny.

Data compiled by the Consumer Federation of America shows that roughly 92 percent of goods manufactured in China that drew federal recalls or safety alerts through mid-September 2025 were traced back to purchases made through Temu, Shein, Amazon, or Walmart. Temu was handed a €200 million penalty — equivalent to around $232 million — by EU regulators in May 2026 under the Digital Services Act, following a determination that the platform had not done enough to shield consumers from products deemed unsafe or prohibited under applicable rules.

Under the Texas Data Privacy and Security Act, which entered into force on July 1, 2024, residents gained defined legal rights to view, remove, and opt out of the sale or handling of their personal information, with the state Attorney General holding sole authority to pursue violations. During that same period, Paxton established a dedicated unit within the Consumer Protection Division focused on data privacy and security enforcement — a team the American Bar Association characterised as ranking among the largest of its kind at the state level anywhere in the country.

Two financial resolutions stand among the largest privacy-related payouts ever extracted from a single state's legal actions: Meta agreed to pay $1.4 billion in July 2024 to resolve claims over biometric data gathered without user consent, while Google followed in May 2025 with a $1.375 billion agreement addressing the tracking of user locations and search activity.

PDD Holdings, Temu, and Pinduoduo appear on the restricted software and developer roster maintained by the Texas Department of Information Resources, covering applications and platforms barred from use on state-owned equipment and networks. That roster was broadened in January 2026 when Governor Greg Abbott moved to place Temu alongside additional technology companies and platforms of Chinese origin under the same prohibition.

Figures drawn from court filings by Paxton's office put Temu's active U.S. user base at roughly 82.4 million people as of September 2023. PDD Holdings stock edged down 1.24 percent on Wall Street following the announcement, according to one news outlet, with the deal marking the first time Temu has formally committed to routing personal data belonging to Texas residents through servers located in the United States and operated by American companies, rather than allowing that information to flow toward China.

Established in 2015 under Colin Huang's direction, PDD Holdings shifted its registered corporate address from Shanghai to Dublin, Ireland, eight years later, though day-to-day executive functions and operations have remained anchored within China throughout that period. Temu's import costs climbed after the long-standing $800 de minimis exemption — which had shielded low-value parcels from tariff collection — was stripped away for Chinese-origin shipments on 2 May 2025, with U.S. Customs and Border Protection extending that removal to every mode of transport by June 2026.