The European Commission on October 26, 2026 accepted Temu's action plan to remedy its breach of the Digital Services Act, five months after fining the marketplace €200 million for failing to properly assess the risk of illegal products reaching European consumers. Temu now has four months to put five corrective measures into effect, including an interim risk assessment covering the six months to November 30, 2026, and the work will be checked by an external auditor.

In Short

In May, the European Union fined the shopping app Temu €200 million because it had not properly studied how likely it was that people in Europe would be sold illegal or unsafe products on it. Temu then sent in a plan to fix that, and on October 26 the European Commission approved it, even though a board of national regulators said the plan was missing detail. Temu now has four months to do the work, and an outside auditor will check whether it was done properly.

Two publications, one decision

The Commission set out the decision in two items on its Shaping Europe's digital future website, both dated October 26: a press release and a longer news article. They describe the same acceptance. The press release places it in a wider policy narrative. "The action plan is another example of how the DSA is enhancing consumer protection online and limiting the spread of illegal products in Europe," according to the Commission. The news article carries the substance - the full wording of the five measures, the opinion of the Board for Digital Services, the audit arrangements and the history of the case.

It also opens with a statement of principle. "Every EU citizen should be able to shop online safely and with confidence," according to the Commission. "The approved measures mark an important step towards strengthening consumer protection online, helping to ensure that the risk of illegal products made available on Temu's marketplace is properly assessed."

Neither item quotes a named Commissioner. Neither carries a response from Temu.

Temu submitted the plan in August, according to the Commission. That fits the timetable set in May, when the Commission ordered Temu to deliver an action plan by August 28, 2026 under Article 75 of the DSA. Article 75 governs what the regulation calls enhanced supervision. Once the Commission finds a very large online platform in breach of its obligations, the provider must submit a plan; the Board has one month to give its opinion; and the Commission then has one month to decide whether the measures are sufficient and to set a period for putting them in place.

What the five measures require

The Commission describes the plan's scope narrowly. It "focuses on correcting its infringement related to its risk assessment obligations under the DSA concerning the dissemination of illegal products on its marketplace," the news article states. To "adequately identify, analyse and assess the risks stemming from its service," Temu has committed to five corrective measures.

A risk assessment built for Temu

The first measure underpins the other four. Temu will "conduct a risk assessment tailored to its service, using reliable and up-to-date information to identify specific risks linked to the platform's design, functioning and use." The wording maps directly onto the core finding of May, when the Commission concluded that Temu's 2024 assessment relied on general eCommerce sector information rather than evidence specific to Temu, including available reports and product testing, and underestimated how often EU consumers would encounter illegal items. The press release calls the new exercise "a platform-specific risk analysis."

Metrics for mitigation

Second, Temu will "consider reliable metrics and indicators to evaluate whether and how the mitigation measures put in place are effective in reducing the risk of dissemination of illegal content." The press release is blunter: the company "will also use reliable metrics to evaluate the effectiveness of the mitigation measures put in place." Neither document names the metrics, sets targets or says whether the indicators will be made public.

Limits of content moderation

The third measure is the most detailed. Temu will "assess and explain the possible limitations and shortcomings of its proactive content moderation system and their impact on recommended products." The Commission lists the elements that assessment must take into account: platform policies and moderation rules, automated detection tools, manual review, feedback mechanisms and resource allocation.

What stands out is the link drawn between moderation and recommendation. The measure does not stop at whether illegal listings are taken down; it asks how gaps in moderation carry through into the products the platform puts in front of shoppers. Temu's own transparency reporting offers a glimpse of the system under review. Its first DSA content moderation report, covering February 17 to October 31, 2024, described automated tools combined with human review, with full-time moderators required to hold at least a bachelor's degree and given 10 days of classroom training followed by two weeks of practical experience.

Recommender amplification

Fourth, Temu will "analyse how its recommender and other algorithmic systems may influence and potentially amplify the dissemination of illegal content on its marketplace based on relevant and reliable metrics." The recommender systems that rank and surface products sit at the commercial heart of any marketplace, and the press release frames the task as analysing "whether, and how" those systems "may amplify the spread of illegal goods." The May decision had already found that Temu did not properly examine how recommender systems and influencer-driven promotion could spread illegal products.

Manipulation by traders

The fifth measure turns to deliberate abuse. Temu will "examine the role of intentional manipulation of the service and the potentially rapid and wide dissemination of illegal content, including by analysing how traders and other recipients of the service may exploit Temu's features to disseminate illegal product listings." The press release describes the same point as covering "sellers exploiting Temu's features to spread potentially illegal listings." Which features the Commission has in mind, it does not say.

A plan the Board found thin

The Board for Digital Services, which brings together the national Digital Services Coordinators, was consulted on the measures and delivered its opinion on September 24. The verdict was mixed. The Board "considered the proposed changes partially adequate but it stated that the plan lacked sufficient level of detail to fully assess whether it adequately addresses the infringement," according to the Commission.

The Commission approved the plan regardless. It "has taken the Board's opinion into consideration and has clarified key requirements that Temu must consider in the implementation of the action plan," the news article states. Those requirements are not listed. The Commission also undertakes to "closely supervise Temu's implementation of the action plan, paying particular attention to the issues which the Board considered inadequately explained and in need of additional information" - issues it likewise leaves unnamed. The Board's opinion itself is not attached to either document.

There is a precedent for this sequence. On July 16, 2026, the Commission accepted X's action plan on its advertising repository and researcher access to data, the remedy phase that followed the €120 million fine of December 5, 2025. According to the Commission, the Board had judged X's proposed changes only partly adequate in an opinion of June 15, 2026, and found its audit measures insufficient. The Commission accepted that plan after clarifying points X had to address and gave X six months to implement it, followed by an audit. Temu has been given four months. In both the X and Temu cases, the Commission approved a plan the Board had not fully endorsed, and in both it answered the Board's concerns with clarifications that have not been made public.

Four months, six months and an audit

The timetable is compressed into a few lines, and the two documents phrase it differently. "Temu now has four months to implement its action plan," according to the news article. "Temu must conduct an interim risk assessment that covers a six-month period, until 30 November 2026." The press release attaches the four months to the interim assessment instead: the company "now has four months to conduct an interim risk assessment that covers a six-month period, until 30 November 2026, to ensure the implementation of the measures of the action plan."

Neither gives a calendar end date for the four months. If they run from the October 26 announcement, the period would close around February 26, 2027, by PPC Land's calculation. A six-month window ending November 30 would begin around June 1, 2026, days after the May 28 fine. That window also closes three days after Black Friday, which falls on November 27, 2026, so the period under review takes in the opening of the holiday trading peak. The Commission does not explain the choice of end date.

Then comes the audit. The measures "will be subjected to an external and independent audit, which Temu has committed to perform," according to the Commission. Temu "will submit the audit report to the Commission within four months after implementing the measures set out in its action plan." If the auditor makes recommendations, "Temu will follow up with the Commission within one month to report on their implementation." Article 75 allows exactly this kind of commitment, letting a provider include an independent audit of its remedial measures in the plan it submits.

Chained together, and again assuming the implementation period runs from October 26, the audit report would fall due around late June 2027 and any follow-up on recommendations around late July 2027. That would be close to three years after the Commission opened formal proceedings on October 31, 2024. These dates are PPC Land's calculation; the Commission has published none of them.

What happens if the measures fall short? The October documents are silent. In May, the Commission said failure to comply with its decision could lead to periodic penalty payments, and PPC Land's coverage of the fine noted that DSA fines can reach 6% of total worldwide annual turnover. The €200 million penalty was set below that ceiling.

How the case reached this point

Temu was designated a very large online platform on May 31, 2024, after reporting more than 45 million monthly active users in the EU. Its content moderation report later put average monthly active users at 93.7 million for April 1 to October 31, 2024. The Commission sent formal requests for information on June 28 and October 11, 2024, and Temu submitted its risk assessment in late September 2024. Formal proceedings opened on October 31, 2024. They covered not only illegal products but also addictive design, recommender transparency and researcher access to data.

Article 34 of the DSA obliges very large online platforms to identify, analyse and assess the systemic risks stemming from their services, starting with the dissemination of illegal content. The Commission adopted preliminary findings on July 28, 2025, "indicating a suspicion that Temu was in breach of Article 34 of the Digital Services Act DSA with regards to the assessment of systemic risks related to illegal products being disseminated on its marketplace," according to the news article. A mystery shopping exercise conducted by the Commission had found that a very high percentage of chargers bought on Temu failed basic electrical safety tests, and that a high share of baby toys posed medium to high safety risks.

"In May 2026, these findings were confirmed and the Commission issued a €200 million fine to Temu for failing to meet its risk assessment obligations," the news article continues. The decision was dated May 28. Ten months separated the preliminary findings from the fine. Five more passed before the remedy was approved.

One detail differs from earlier coverage. The October documents describe the breach entirely in terms of risk assessment, citing Article 34 only. PPC Land's report on the May decision described it as a breach of Articles 34 and 35, the second of which concerns mitigation measures. The accepted plan, as the Commission summarises it, deals with mitigation only through the metrics Temu will use to evaluate it.

What the documents leave open

Several questions go unanswered. The clarified requirements the Commission imposed after the Board's opinion are not published. Temu has not commented in either document. Neither says whether the €200 million has been paid or whether Temu has challenged the May decision before the EU courts.

Nor do the documents mention the other strands of the October 2024 proceedings - addictive design, recommender transparency and researcher data access. When the fine was announced, PPC Land noted that those strands could still produce separate findings. The October 26 acceptance closes the remedy phase for the risk assessment breach only.

Why it matters for marketers

Temu is not only a regulatory case. It is also a major advertiser. According to a March 2024 Wall Street Journal report cited in PPC Land's coverage of Temu's withdrawal from US Google Shopping, parent company PDD Holdings spent about $2 billion on Facebook and Instagram ads in 2023, making it Meta's largest advertising client. Temu halted its US Google Shopping campaigns on April 9, 2025, as tariffs on Chinese imports rose. In Europe, Smarter Ecommerce data showed the share of roughly 500 European advertisers facing Temu in Google Shopping auctions falling by about half from March 2026, ahead of the EU's €3 per item customs duty that replaced the €150 exemption on July 1, 2026.

The DSA plan reaches a different layer of the business: the machinery that decides which products shoppers see. Two of the five measures concern recommender systems and the features sellers use to promote listings. Any marketplace that combines organic ranking, sponsored placement and influencer promotion runs on similar mechanics, and the Commission is now asking Temu to measure, with metrics an auditor will check, how those mechanics carry illegal products to consumers. For brands competing with imitations or non-compliant goods on such platforms, and for advertisers whose budgets compete in the same auctions, the outcome bears on how cross-border marketplaces operate in Europe.

Temu is also not alone. The Commission fined AliExpress €550 million on July 20, 2026 over failures to assess and mitigate risks from unsafe and counterfeit products, and set an October 20, 2026 deadline for its own action plan. On the same one-month steps for the Board and the Commission, a decision on that plan would follow roughly two months after Temu's. Shein has faced formal DSA proceedings since February 17, 2026 over illegal products, addictive design and recommender transparency, and on October 21, 2026 the Commission opened proceedings against Booking.com over fake listings, phishing and paid listings not clearly labelled as ads.

Audits now sit at the centre of Temu's obligations on both sides of the Atlantic. Days before the Commission's announcement, Texas reached a settlement with Temu's operators that attaches an $8 million penalty to each annual audit that finds serious violations, with Temu selecting and paying the auditing firms. In Brussels, too, an auditor commissioned by Temu will deliver the verdict on whether its remedies work. The Board has already said it could not tell from the plan alone.

Timeline

Summary

Who: The European Commission, Temu and the Board for Digital Services, the body of national Digital Services Coordinators that reviewed Temu's plan. The decision also bears on sellers, brands and advertisers active on or competing with Temu's EU marketplace.

What: The Commission accepted Temu's action plan to remedy its breach of the DSA's risk assessment obligations. The plan contains five measures: a risk assessment tailored to Temu, metrics to evaluate mitigation, an assessment of content moderation shortcomings, an analysis of recommender amplification and an examination of manipulation by traders. The Board found the plan partially adequate but short on detail, and the Commission clarified requirements it has not published.

When: The Commission announced the acceptance on October 26, 2026. Temu has four months to implement the plan, its interim risk assessment covers the six months to November 30, 2026, and the audit report is due four months after implementation.

Where: The European Union, where Temu reported 93.7 million average monthly active users for April to October 2024 and has been designated a very large online platform since May 31, 2024.

Why: In May 2026, the Commission fined Temu €200 million for failing to assess the risk that illegal products are disseminated on its marketplace. Article 75 of the DSA requires a provider found in breach to submit an action plan, which the Commission must approve or reject after consulting the Board.