The Maze: Texas has announced a settlement that would change how Temu, the online shopping marketplace, handles Texans’ data and unsafe products. Its US$3 million payment is only part of the deal. The released judgment leaves the judge’s signature blank, so the compliance timetable’s start remains unverified.
The Details:
US storage comes with access rules. The agreement gives Temu 180 days after the court signs to put Texas consumers’ personal data on US servers owned and controlled by an American company. It also restricts readable access by China-based people and entities. Those are separate requirements: a server’s address does not determine who can open its records. Exceptions allow a consumer to consent to one instance of access. Necessary business uses, including processing orders, preventing fraud and improving the platform, also remain possible for non-sensitive data. For compliance, Texas consumers are identified through an internet address located in Texas or an account’s default Texas delivery address.
The US$8 million figure has a specific trigger. Annual outside checks cover the mobile app’s security and the storage and access controls for sensitive data. A final finding of serious failure under either test can trigger US$8 million per failed annual audit. That is not a fee due every year regardless of performance. Temu hires and pays the firms, which must meet independence and qualification rules. It can object to findings, suspending related penalties and deadlines while the auditor reconsiders them. Court review is also available. The US$3 million payment, which includes penalties and legal costs, falls due 30 days after effectiveness. Neither its calendar deadline nor payment has been verified.
Product tests reach sellers’ whole store networks. An independent firm must annually test a sample of products commonly bought by Texans. A product becomes a confirmed harmful product when the final report finds harmful material above an applicable federal safety standard. Temu then has two business days to remove the listing and five to terminate the seller’s store and affiliated stores. Affected Texas buyers must receive notice and full refunds. Separately, recalled or prohibited products must be removed within two business days of a published alert. This is a testing and response system, rather than proof that every product has passed a safety check.
MarketMaze Take: The payment is the headline; the continuing work is the commercial substance. Temu would have to manage where data sits, who can read it and what happens after unsafe goods are identified. For operators elsewhere, those are distinct controls worth examining, although this agreement creates no equivalent worldwide rights.
A seller’s risk extends beyond one listing. The affiliated-store requirement makes a confirmed harmful product a merchant-level problem. The agreement also attaches US$600,000 to a missed store termination. That changes the consequence of a failed product test without establishing that a failure has already occurred.
Enforcement still needs evidence. Company-selected auditors have formal independence requirements, so their selection alone proves neither weakness nor success. Reports are presumptively confidential, limiting public visibility. PDD Holdings and Whaleco, Temu’s operators, deny wrongdoing and admit no liability. The unsigned public copy also prevents treating the announced agreement as proof that its deadlines are running.
Sources: Texas Attorney General, Agreed judgment
