Temu agrees to restrict transfer of US shopper data to China

AUSTIN, Texas: Chinese online retailer Temu has agreed, for the first time, to keep U.S. shoppers' personal data on American servers and limit when it can be sent to China as part of a settlement with Texas over data privacy claims. Texas is the first U.S. state to resolve such claims against Temu, which faces several lawsuits from states concerned that it unlawfully harvests U.S. user data that could be accessed by the Chinese government. Under the settlement made public on October 16, Temu agreed to send to China only data necessary to fulfill a transaction, such as shipping addresses. The company will also be required to hire a third-party cybersecurity auditor to examine its app's code for malware and spyware, one of the main concerns that prompted Texas to sue in February. Temu denied wrongdoing in the settlement documents and did not immediately respond to a request for comment. Texas Attorney General Ken Paxton said the agreement would prevent Temu from collecting and using Americans' data. Temu will pay $3 million to Texas as part of the settlement. Failure to comply with various data security provisions could result in a potential $8 million penalty for each year a violation occurs. The company also agreed to conduct annual independent product safety testing to identify products containing dangerous chemicals and materials. Temu must remove products found to contain dangerous materials, terminate the seller and its affiliated stores, notify affected Texas consumers, and issue full refunds. Paxton said the settlement requires Temu "to implement rigorous new product audits and safety standards to protect consumers from dangerous materials in products, including clothing and children's items." Temu had more than 82.4 million active users in the United States as of September 2023, according to Paxton's office. Several states sued Temu following reports alleging that the company and its parent, PDD Holdings, used invasive mechanisms in their apps. Texas alleged that Temu used code allowing an inappropriate level of access to users' devices. Temu has denied the allegations.