Temu Must Keep Texans’ Data on American-Owned Servers Under Paxton Settlement

The online retailer Temu has agreed to store Texans’ personal data on servers in the United States owned and controlled by an American company and to keep it out of reach of people in China, under a settlement with Attorney General Ken Paxton announced Friday. The company will also pay Texas $3 million.

The deal is an agreed final judgment in the State of Texas v. PDD Holdings Inc. and WhaleCo Inc., the Temu companies, in the 471st District Court of Collin County. The copy the attorney general’s office posted was signed by the state on October 15 and awaits the judge’s signature. Temu denies any wrongdoing, and the judgment says nothing in it is an admission of liability.

What Texas alleged

Paxton sued on February 19, 2026. The state alleged that Temu misled consumers about the data its app collects and failed to disclose that personal data from Texas consumers “may be furnished to the government of the People’s Republic of China or to other third parties.” PDD Holdings is incorporated in the Cayman Islands and based in Dublin, Ireland, according to the judgment.

What Temu agreed to

Under the judgment, Temu must store the personal data of Texas consumers “on commercial servers located in the United States that are owned and controlled by an American company.” It must keep that data, in readable form, away from any person or company organized in China, based there or living there, with limited exceptions, and must name a compliance officer based in the United States.

Independent firms will audit the Temu app every year. If an audit finds malware, spyware or unauthorized data-collection code, Temu pays $8 million for that failed audit and must fix the problem within 60 days.

The judgment also requires annual product safety testing. When a product sold to Texans is confirmed harmful, Temu must remove it, cut off the seller within five business days, notify each Texas buyer and give a full refund. Failing to cut off a seller in time carries a separate $600,000 penalty.

“This is a historic victory for data privacy, consumer protection, and Texans who deserve to know that the products they purchase are safe,” Paxton said.

The terms were set by a Texas attorney general, in a Texas court, under Texas consumer law. Texans’ data will now be governed by rules Texas wrote for itself.