Texas Attorney General Ken Paxton on October 16, 2026 published a settlement with Temu that requires the shopping platform's operators to store Texas consumers' personal data on US servers owned and controlled by an American company, bars access to that data from China in readable form outside a set of listed exceptions, and attaches an $8 million civil penalty to each annual audit that finds material noncompliance. Under the 27-page agreed final judgment, PDD Holdings Inc. and Whaleco Inc. also pay Texas $3 million, accept a four-year permanent injunction, and deny every allegation.

In Short

Texas sued the companies behind Temu, saying the app hid how it collected people's data and that the data could reach China, and both sides have now agreed to settle. Temu has to keep Texans' data on American-owned servers in the US, hire outside firms every year to check its app, its data handling and the products it sells, and pay $8 million each time one of the two data audits finds a serious problem. Temu pays $3 million now, admits nothing, and the rules last four years.

What the court is being asked to sign

The case is The State of Texas v. PDD Holdings Inc. and Whaleco Inc. d/b/a Temu, Cause No. 471-01114-2026, in the 471st Judicial District Court of Collin County. The signature block names Judge Robert "Bryan" Gantt. Attorney Johnathan Stone signed for the Office of the Attorney General on October 15, 2026, as did Qin Sun, president of Whaleco, and Lei Chen, co-chief executive of PDD Holdings.

One detail matters for every deadline in the document. The copy released alongside the press statement leaves the court's signature line blank: "SIGNED this ______ day of ____________________, 2026." The judgment defines its "Effective Date" as "the date this Judgment is signed by the Court," and every compliance clock, from 30 days to four years, runs from that date. The press release calls the agreement "secured" but does not say when, or whether, Judge Gantt entered it.

Texas filed its original petition on February 19, 2026. According to the judgment, the state alleged violations of the Texas Deceptive Trade Practices-Consumer Protection Act in five areas: misrepresenting the nature of the Temu app and the permissions it seeks and data it collects; misrepresenting promotions, credit-back offers, coupons, games, referral rewards, free items and strikethrough reference prices; misrepresenting the quality, safety or authenticity of goods, including through reviews and ratings; failing to safeguard personal information or give required breach notice; and failing to disclose that personal data "may be furnished to the government of the People's Republic of China or to other third parties."

The press release, dated October 16, focuses on two of those five: data exposure to what it calls "the Chinese Communist Party" and harmful chemicals in products. The pricing, promotion and review allegations are covered by the release of claims in the judgment, but receive no specific injunctive terms of their own.

PDD Holdings is incorporated in the Cayman Islands with principal executive offices in Dublin, according to the judgment. Whaleco is a Delaware corporation based at 31 Saint James Avenue in Boston and operates the Temu Platform. PDD owns Whaleco "through intermediate holding entities."

The $3 million and what it covers

Texas recovers $3,000,000 from the two defendants jointly and severally, due within 30 days of the Effective Date. The judgment states that this single sum covers civil penalties under DTPA section 17.47(c), "reasonable attorney's fees, investigative fees, and costs." The press release describes it more simply: "Temu will also pay $3 million to the State of Texas." The judgment does not split the amount between penalty and costs.

The document is explicit that the money is "consideration for, Defendants' agreement to the injunctive terms and covenants." If an installment goes unpaid and is not cured within ten business days of notice, the full balance becomes due with post-judgment interest.

Set against earlier Texas privacy resolutions, the cash figure is small. Paxton finalized a $1.375 billion settlement with Google in late October 2025 over location tracking, Incognito mode and biometric data, and secured $1.4 billion from Meta in July 2025 over facial recognition data. The Temu agreement puts its weight on conduct rules and per-audit penalties rather than an upfront payment.

Where Texans' data must sit, and who may read it

Paragraph 29 carries the data provisions, framed as "consistent with" the Department of Justice Data Security Program at 28 C.F.R. Part 202 and the Texas Data Privacy and Security Act. Four obligations stand out.

Storage. Temu must store the Personal Data, Sensitive Data and Sensitive Personal Data of Texas Consumers "on commercial servers located in the United States that are owned and controlled by an American company." The deadline is 180 days after the Effective Date. The judgment does not name a cloud provider or define "American company."

Access. Temu must prohibit any "Prohibited Person" from accessing, "in an unencrypted or decryptable form," personal data "that is linked or reasonably linkable to an identified or identifiable individual." A Prohibited Person is any entity organized under Chinese law, any entity with its principal place of business in China, or any individual "primarily a resident of the territorial jurisdiction of the People's Republic of China." That last limb reaches employees and contractors, not only companies.

Two exceptions apply. A Texas consumer can consent to access, with "each consent limited to the single instance of access to which it pertains." And for personal data that is not sensitive, access is allowed where "reasonably necessary and proportionate to commercially reasonable purposes," which the judgment lists as order processing and delivery, fraud detection, efforts to "troubleshoot, maintain, or improve the functionality, performance, or security of the Temu platform," and legal compliance. The press release compresses this to restricting access "subject to essential business functions." Improving functionality is a broad category, and the judgment sets no further limit on it.

Disclosure. Temu must state in its US privacy policy which categories of Texas consumers' data may be shared with third parties outside the United States.

Retention. Data may be kept only as long as reasonably necessary for disclosed business purposes or legal obligations. At least quarterly, Temu must identify Texas accounts inactive for 24 consecutive months, meaning "no login, order, or other affirmative interaction," and delete the associated personal data unless a listed purpose still applies. Within 90 days, the privacy policy must carry a "one-click" link for logged-in users to the account deletion page.

The distinction between where data is stored and who can reach it has been central to European enforcement as well. Ireland's Data Protection Commission found that remote access by China-based employees to data held in Singapore and the US counted as a transfer in its €530 million TikTok decision. The Texas judgment draws a similar line, though it limits the prohibition to readable, identifiable data.

Who counts as a Texan

The judgment defines a "Texas Consumer" as a Texas resident acting in an individual or household capacity. For compliance purposes, a person is treated as one if "the IP address associated with the transaction or interaction geolocates to Texas" or the account's default delivery address is in Texas. Temu "shall not be required to collect, derive, or infer additional information" to determine residency.

In practice, then, the obligations attach to records flagged through IP geolocation or a shipping address. A Texan using a VPN with a delivery address elsewhere would fall outside the measurement. The press release goes further than this definition. Paxton's statement says Temu "cannot harvest Americans' sensitive data"; the judgment covers only Texas Consumers.

The two $8 million audits

The press release says that "failure to abide by various data security provisions would result in an $8,000,000 penalty each year a violation occurs." The judgment is narrower. Two specific annual assessments, not the data provisions generally, can trigger the $8 million figure.

The first is a mobile application security test under Paragraph 21. A Qualified Independent Firm examines the current Temu app on the Google Play Store and Apple App Store each year "to detect behavior consistent with the presence of Malware, Spyware, or Unauthorized Data-Collection Code." The second, under Paragraph 29(g), assesses compliance with the storage and access rules, but only "as to Sensitive Data and Sensitive Personal Data." Ordinary personal data is not part of that audit.

Each test produces a penalty only on a finding of "Material Noncompliance." For the app test, that means the app contains malware or spyware, or contains Unauthorized Data-Collection Code that collects personal data. For the data audit, it means personal or sensitive data was made available to a Prohibited Person in violation of the storage or access rules. Either finding costs $8,000,000 "per failed annual audit," with 60 days to cure. Lesser findings must also be cured within 60 days, but carry no penalty unless the cure fails.

Narrow definitions

The definitions are tight. Malware and spyware mean code "designed to and does" exploit a security vulnerability to gain permissions that would otherwise be denied, collect data while "materially misrepresenting" its function to conceal that collection, or damage the device. Unauthorized Data-Collection Code means collection of a category of data "not encompassed by and materially different from" the categories in Temu's privacy notice. Collection is expressly not unauthorized if it falls within a category in the notice, within any device permission the user granted or that the operating system's permission framework makes available, or within any other consent.

Those definitions matter because the original allegations in Texas, as in other states, centered on the app itself. Kentucky's lawsuit, filed in July 2025, alleged undisclosed collection of geolocation, installed app lists and Wi-Fi network information. Under the Texas definitions, collection of a category that appears in the privacy notice, or that falls within a granted permission, would not register as a failure.

Temu picks the auditor, and can object

Temu selects and pays each Qualified Independent Firm. The judgment requires the firm to be accredited or nationally recognized, at arm's length, and not engaged by Temu or its affiliates for any other service in the prior three years, with a two-year bar afterward. There is a carve-out: work for Temu on DOJ Data Security Program compliance does not disqualify a firm, and Temu may hire the same firm year after year. "The OAG has no obligation to select, approve, or vet any third party," the judgment states. Retaining a firm counts as Temu's certification that it qualifies. If it later turns out not to qualify, the audit must be redone, and any adverse finding stands until the new report arrives.

The process after a finding runs through the firm, not the attorney general. Temu has 30 days to file one objection with the auditor, extendable once by 60 days. A timely objection suspends the duty to cure, suspends penalty accrual and tolls related deadlines. The firm then has 60 days to "affirm, modify, or withdraw" the finding, and its decision becomes the Final Report. Temu may then seek judicial review in the Collin County court within 30 days, limited to the record before the firm. If Temu loses that review, it pays the state's legal costs.

Penalties accrue "automatically and without further process" and fall due 30 days later unless Temu seeks review. The first reports are due on the first September 1 that falls at least six months after the Effective Date. If the court signed in October 2026, that would be September 1, 2027.

Audit results stay confidential

All reports, working papers and correspondence with auditors are "presumptively confidential." The attorney general's office must treat them as exempt from disclosure under the Texas Public Information Act "to the fullest extent permitted," including the exemption for trade secret and confidential commercial information. Before disclosing them to another agency, under legal process, or in an enforcement filing, the office must give Temu at least 30 business days' notice, and if Temu objects in writing, it cannot disclose until a court allows it. The confidentiality clause survives the judgment "in perpetuity."

The public is therefore unlikely to see whether the app passes. Temu must, within 30 days of each Final Report, send the attorney general a notice identifying the firm, the period covered and any noncompliance found, plus a copy of the report itself.

Product safety obligations

The second half of the press release concerns toxic products. The judgment converts that into four mechanisms.

First, Temu must monitor US and Texas recall and safety alerts and remove any recalled, prohibited or noncompliant product within two business days of publication. This applies from the Effective Date.

Second, a Qualified Independent Firm must each year test "a cross-section of products commonly purchased by Texas Consumers" for harmful materials "including lead, PFAS compounds, phthalates, formaldehyde, and heavy metals." A product becomes a "Confirmed Harmful Product" only if it tests positive "in an amount exceeding an applicable federal safety standard." Where no federal standard applies to a substance in a given product, the judgment provides no threshold.

Third, once a product is confirmed, Temu must remove the listing within two business days, terminate the store and "all affiliated stores owned by the same underlying third-party merchant" within five business days, notify each Texas buyer directly and give each a full refund. Missing the five-day termination deadline is a separate violation carrying a $600,000 penalty, with cure available "only upon a demonstrated error in identification."

Fourth, within 90 days, sellers of "Covered Products" must submit product-compliance certificates, manufacturer or private-labeler identification, testing information and shipment information before listing. Certificates and test results must come from a testing agency accepted by the US Consumer Product Safety Commission or accredited to ISO/IEC 17025. A Covered Product is one imported by Temu, offered to Texans and subject to a mandatory CPSC or Texas safety rule.

The press release says that "Temu must conduct annual independent product safety testing to identify products containing dangerous chemicals." Paxton's quoted statement adds that "Texans can now rest assured that Temu cannot sell products containing toxic and dangerous chemicals." The judgment does not contain an outright ban. It requires annual testing of a sample, recall monitoring and pre-listing paperwork for regulated categories, with removal triggered by test results that exceed a federal standard.

Product safety has been the basis for Temu's largest penalty so far. The European Commission fined Temu €200 million under the Digital Services Act on May 28, 2026, after mystery shopping tests found chargers that failed electrical safety checks and baby toys with chemicals above legal limits, and gave the company until August 28, 2026 to submit a remediation plan.

Smaller obligations and the 30-day list

Several requirements arrive within 30 days of the Effective Date. Temu must add a clearly identified reference to applicable Texas law, including the Texas Data Privacy and Security Act, to the privacy notice that Texas consumers see. It must designate a US-based compliance officer responsible for the judgment and name that person to the attorney general in writing. And it must post a notice on the Temu Platform informing Texas consumers of the settlement.

Separately, Temu must maintain a dedicated team as a point of contact for Texas businesses and intellectual property owners, plus an email address through which Texas rights holders can report allegedly infringing listings. Each defendant must also file an annual certification, signed by an officer with personal knowledge, stating whether it complied with every paragraph and listing any lapses and corrective action.

Penalties, cure periods and duration

Outside the audit and store-termination penalties, a breach of the injunction is a violation of a DTPA section 17.47 injunction carrying civil penalties of up to $10,000 per violation. Where one act breaches several provisions, it counts once.

Most obligations come with a cure window. For the privacy notice, recall removal, store-related, pre-listing, data handling, settlement notice and intellectual property provisions, penalties begin to accrue only on the 31st day after Temu receives written notice from the attorney general "identifying the violation with reasonable specificity." Reporting and documentation failures accrue penalties only if uncured 30 days after Temu "knew or should have known" of them. No cure period applies to a failed audit, a missed store termination, or a repeat violation of the same paragraph after earlier notice.

The judgment runs for four years from the Effective Date and expires automatically. Several clauses, including the release of claims and confidentiality, survive permanently.

The document contains a few drafting inconsistencies. Paragraph 39 refers to a civil penalty "imposed by Paragraphs 22, 27, or 29(g)," although the data-audit penalty sits in Paragraph 29(h). The parity section refers to "this Consent Order," while the rest of the text uses "Judgment." Neither appears to change the substance.

A most-favored-state clause

Section IX contains an unusual provision. For three years, if Temu settles "substantially the same conduct" with another state on better terms, Texas receives the benefit. Within 30 days of any such "Comparable Resolution," Temu must send the attorney general an unredacted copy and its calculation of the "Net Payment."

If another state's net payment exceeds Texas's by more than 5%, Temu pays Texas the difference within 60 days. If another state obtains injunctive, compliance, reporting or monitoring terms that are "materially more favorable," those terms apply in Texas automatically unless the attorney general objects within 90 days.

The exclusions are wide. The clause does not apply to judgments after contested litigation or trial, settlements reached after an adverse dispositive ruling against Temu, agreements with federal agencies, foreign regulators, local governments or private parties, class actions, or resolutions signed before the Effective Date. The covenants are enforceable as contract obligations, but not by contempt.

The clause has practical relevance because Texas is not alone. Kentucky sued Temu in July 2025, and Nebraska also sued in 2025, according to PPC Land's coverage of a federal lawsuit naming Temu as a recipient of Google bidstream data, which also notes that 21 state attorneys general warned about Temu's data practices in August 2024. Any of those states that settle on better terms during the parity period would raise the Texas floor.

No admission, broad release

PDD and Whaleco "deny each allegation of wrongdoing." The judgment states that it is not an admission of any fact or liability and "shall not be used as evidence or precedent in any action or proceeding other than an action to enforce it." Changes Temu makes to comply are also inadmissible as admissions. Both sides waived appeal.

On payment, Texas releases the defendants and their parents, affiliates, officers and employees from all claims relating to the Covered Conduct before the Effective Date, "whether arising under the DTPA, the TDPSA, any other statute," and whether brought in the state's own capacity, as parens patriae or in any representative capacity. That release extends beyond the DTPA claims actually pleaded. It excludes criminal liability, antitrust, securities and tax claims, conduct after the Effective Date, and claims by private parties or other government agencies.

If Temu sells the platform, the buyer must agree in writing to be bound before the transfer closes.

Where the press release and the judgment differ

The press release describes the agreement as "first-of-its-kind," "landmark" and "groundbreaking." The judgment itself makes no such claim, and the release offers no comparison to support it. Several specific characterizations go further than the text:

  • The release says an $8 million penalty applies "each year a violation occurs" of "various data security provisions." The judgment ties it to a Material Noncompliance finding in one of two annual audits, after objection and reconsideration, with the data audit limited to sensitive data.
  • Paxton's quote says Temu "cannot harvest Americans' sensitive data." The judgment covers Texas Consumers, identified by IP geolocation or delivery address.
  • Paxton's quote says Temu "cannot sell products containing toxic and dangerous chemicals." The judgment requires sample testing, recall monitoring and certificates, with removal when a result exceeds a federal standard.
  • The release refers to restricted access "subject to essential business functions." The judgment's listed exceptions for non-sensitive data include improving the platform's functionality.
  • The release cites 82.4 million active US users "as of September 2023," a figure three years old that does not appear in the judgment.
  • The release presents the injunction as secured. The copy of the judgment provided carries no court signature date.

Why this matters for marketers and platforms

For marketers, the most direct effect is on Temu as an advertiser and an app. The platform pulled all of its US Google Shopping campaigns on April 9, 2025 as tariffs on Chinese imports rose, and its App Store ranking fell from the top five to 58th within days. Its US data practices now sit under a state court injunction for four years, with annual app testing aimed at undisclosed data collection. Advertising SDKs and measurement code within the app are not mentioned, but any code that collects a category of data outside the privacy notice and outside granted permissions would fall within the definition the auditor tests against.

The agreement also continues a run of Texas actions with a China data dimension. Texas sued Hisense in December 2025 over automatic content recognition on smart TVs and undisclosed transfers to China, and sued TP-Link on February 17, 2026, according to PPC Land's report on Florida's parallel case, which notes Florida set up a unit in February 2026 to pursue foreign data exposure under its own deceptive practices law. Texas also sued Netflix in May 2026 in the same Collin County courts under the DTPA, seeking limits on targeted advertising and clean room collaboration.

The Temu judgment shows what a resolved case of this kind looks like. Rather than a large cash payment, Texas obtained a template: US-owned storage, a China-access prohibition built on the federal DOJ rule, auditor-driven penalties, a narrow residency test and a parity clause. A company facing a similar petition now has a concrete example of the terms the attorney general accepted, and of the procedural protections, such as auditor objection rights and confidentiality, that the defendant obtained in exchange.

The federal backdrop is uncertain. House Republicans introduced the SECURE Data Act on April 21, 2026, which would preempt state privacy laws entirely. The Texas judgment relies on both state law and the federal DOJ program for its data standards, and its modification clause allows either party to seek changes "if changes in technology, law, or other circumstances justify modification."

The remaining question is whether the audits produce findings. The structure gives Temu control over auditor selection, a full objection and reconsideration cycle, judicial review on a closed record and confidentiality over the results. Whether the $8 million penalties ever accrue will depend on what the firms Temu hires choose to report, and on whether any of that becomes public.

Timeline

Summary

Who: The State of Texas, through Attorney General Ken Paxton, and PDD Holdings Inc. and Whaleco Inc., which operate the Temu shopping platform. Judge Robert "Bryan" Gantt of the 471st District Court in Collin County is named to sign the judgment.

What: An agreed final judgment and permanent injunction resolving Texas's February 2026 deceptive trade practices suit. Temu pays $3 million, must store Texas consumers' data on US servers owned by an American company, must bar readable access to identifiable data by China-based persons outside listed exceptions, and faces $8 million per failed annual app security or sensitive data audit, $600,000 per missed store termination, and up to $10,000 per other violation. It also takes on annual product testing, recall removal, seller certification, deletion and disclosure duties. The defendants deny wrongdoing.

When: The parties signed on October 15, 2026, and the attorney general's office published the settlement on October 16, 2026. Deadlines run from the court's signature, which the released copy does not show, and the judgment lasts four years.

Where: Collin County, Texas, Cause No. 471-01114-2026. The obligations apply to consumers identified as Texans by IP geolocation or delivery address.

Why: Texas alleged that Temu misrepresented its app's data collection, pricing and product safety and failed to disclose that data could reach the Chinese government. The settlement sets a template for state-level China data cases that relies on independent audits, US-owned storage and a parity clause rather than a large cash payment.