Texas Put Temu on an Annual Audit Leash

Texas announced an agreed settlement with Temu and published a 27-page agreed final judgment and permanent injunction that turns a broad privacy and product-safety case into a surprisingly detailed operating manual. The posted document's judicial signature and date fields are blank; an entered or effective date was not independently verified.^[1][2]

The settlement terms call for Temu to pay Texas $3 million within 30 days of the effective date. More important, it must submit its mobile app to annual independent security testing for malware, spyware, and unauthorized data collection. A material failure can carry an $8 million penalty for that audit cycle, plus a deadline to fix the problem.^[1]

The data rules are equally concrete. Personal data belonging to Texas consumers must be stored on U.S. servers owned and controlled by an American company. Access from China is restricted, subject to defined exceptions for things such as order fulfilment, fraud prevention, platform security, specific consumer consent, and valid legal process. Temu also has to provide a one-click account-deletion route, disclose categories of data that may be shared outside the United States, and periodically delete data tied to long-inactive accounts unless it still has a stated lawful reason to keep it.^[1]

The data-storage and access provisions have a 180-day implementation period from the effective date. The first annual report falls on September 1 at least six months after that date. The injunction specifies a four-year term with stated surviving obligations. Those are compliance deadlines, not evidence that the changes are already implemented or an audit has passed.^[1]

An independent firm must test commonly purchased products for lead, PFAS, phthalates, formaldehyde, heavy metals and other regulated hazards. When a final audit identifies a product exceeding an applicable federal safety standard, the terms require removal, seller and affiliated-storefront termination, notification of affected Texas buyers and refunds.^[1]

Texas alleged that Temu misrepresented its data practices, failed to safeguard personal information, exposed data to China, sought inappropriate device access, and sold unsafe goods. Those are allegations, not findings. Temu denied every allegation, admitted no liability, and settled without a trial or factual adjudication.^[1]

That distinction matters. So does the machinery Texas obtained anyway. The headline payment is only one part of the machinery. Annual outside audits, mandatory remediation, consumer notification, and penalties for failed compliance are the expensive part. Apparently the state found a way to make the endless-scroll bargain store keep receipts of its own.

Which term is most likely to change how Temu actually operates: the U.S.-server rule, the independent code audit, or the product-testing and refund regime?

Artwork created with AI for Information Overload.