On October 16 the Texas Attorney General published an Agreed Final Judgment settling the state’s suit against Temu (PDD Holdings and Whaleco): $3 million, Texas consumers’ personal data kept on US servers, limits on readable access from China, and an $8,000,000.00 penalty per failed annual audit. Three yardsticks do the work: Temu’s own Privacy Notice sets the baseline for what counts as unauthorized code, an IP lookup or a delivery address decides who counts as a Texas consumer, and the data audit covers sensitive data only. One caveat first. The copy the attorney general released has a blank court signature line, and we could not confirm from the court’s records as of October 18 whether it has been signed.
What does the Temu settlement require?
Temu must pay $3 million, store the personal data of Texas consumers on commercial servers in the United States that are owned and controlled by an American company, and restrict readable access to that data by people and entities based in China. It must also pay for annual independent testing of its app and of a cross-section of products. Temu did not admit wrongdoing: in ¶5 the defendants “deny each allegation of wrongdoing”.
The app audit’s test for “unauthorized” code
Under ¶21 a qualified independent firm tests the current Temu app from Google Play and the App Store “to detect behavior consistent with the presence of Malware, Spyware, or Unauthorized Data-Collection Code”. ¶9(r) defines the third term against the company’s own document:
“code that causes the collection from a consumer’s device of a category of consumer data that is not encompassed by and materially different from the categories of data described in Temu’s Privacy Notice in effect at the time of collection.”
Collection is not “unauthorized” if the category appears in the notice, falls within a device permission the user granted or one available through the platform operator’s documented permission framework, or is within consent obtained from the consumer. In the app audit, finding Unauthorized Data-Collection Code that collects personal data counts as “Material Noncompliance” (¶9(j)), as does finding Malware or Spyware; ¶22 attaches $8,000,000.00 per failed annual audit to it and separately requires a cure within 60 days. “Malware” and “Spyware” share a separate definition (¶9(i)): code “designed to and does” specific things. The judgment names no SDKs, ad networks or analytics vendors. We read a state decree against its press release the same way in September; for what a shopping site’s scripts collect in practice, see the AliExpress WebAudio fingerprint analysis.
Texas status comes from an IP address or a delivery address
¶9(q) treats a person as a Texas Consumer for a given transaction if, “based on information reasonably available to Temu in its ordinary course records”, either the IP address “geolocates to Texas” or the account’s default delivery address is in Texas. It adds that Temu “shall not be required to collect, derive, or infer additional information for the purpose of determining residency”.
Access from China is limited, not banned
¶29(b) covers access by a “Prohibited Person” (¶9(l): PRC-organized, PRC-based or PRC-resident) to identifiable data “in an unencrypted or decryptable form”. Any data may be accessed with the consumer’s specific consent for commercially reasonable purposes, “with each consent limited to the single instance of access”. For personal data that is not sensitive, access is allowed when “reasonably necessary and proportionate”, and the judgment lists four purposes: to process, fulfill, deliver or service an order; to detect, prevent or respond to fraud; to “troubleshoot, maintain, or improve the functionality, performance, or security of the Temu platform”; and to comply with federal or Texas law or legal process.
Wire and broadcast coverage put it more narrowly: Reuters wrote that Temu agreed to “restrict access to US data necessary to fulfill a transaction, such as shipping addresses, to China”, and Fox Local wrote of “only information necessary to fulfill a transaction”. Fulfillment is only the first of four listed purposes.
The $8 million and the auditor Temu pays
The press release says “Failure to abide by various data security provisions would result in an $8,000,000 penalty each year a violation occurs.” That is the attorney general’s wording. The judgment’s is narrower: $8,000,000.00 “per failed annual audit”, after a Final Report finds Material Noncompliance (¶22, ¶29(h)). The ¶29(g) data audit assesses ¶29(a) and (b) “as to Sensitive Data and Sensitive Personal Data” only.
- Temu retains and pays the firm, and may reuse it in consecutive years (¶9(m)).
- “Temu’s retention of a firm is its certification that the firm meets the criteria” (¶34).
- A timely objection “suspends the accrual of any civil penalty attributable to that noncompliance” (¶38).
- Audit materials “are presumptively confidential” (¶42).
- A breach of a ¶29 duty other than the audit itself, such as the storage rule, carries up to $10,000.00 per violation (¶48), and for a first violation those penalties accrue only from the 31st day after Temu receives written notice from the attorney general’s office (¶49).
The compliance clock starts at the court’s signature
¶9(g) defines the Effective Date as “the date this Judgment is signed by the Court”. The parties signed on October 15, but the court’s line reads “SIGNED this ______ day of ____________________, 2026.” Storage and access duties must be in place within 180 days after the Effective Date (¶20), and first audit reports on the first September 1 that is at least six months after it. We give no calendar dates, because the starting date is not in the published copy.
What the judgment measures and what it leaves out
- Measures: app behavior against the Privacy Notice in force at collection time, plus OS permissions and consent.
- Measures: Texas status by IP geolocation or delivery address, and readable access by Prohibited Persons, with consent and purpose exceptions.
- Does not say: which SDKs or vendors are in scope, which audit firm, or that results will be public.
- Does not say: that Temu’s app contains the defined code. Allegations are denied (¶5).
¶56 says the judgment “shall not be used as evidence or precedent in any action or proceeding other than an action to enforce it”. ¶47 gives Texas three years of parity if Temu settles with another state on substantially the same conduct for a net payment more than 5% higher or for materially more favorable injunctive terms. PPC Land, whose October 17 analysis covers much of the same ground, pointed out that the pricing, promotion and review allegations in ¶4 fall within the judgment’s release of claims (¶54) but get no injunctive term of their own.