Texas Forces Temu to Keep User Data on U.S. Servers and Restrict China Access in First-of-Its-Kind Privacy Settlement
Texas has reached a first-of-its-kind settlement with Chinese-founded online retailer Temu that will force the company to keep Texans’ personal data on U.S.-based, American-owned and controlled servers while sharply limiting access from China. The agreement also requires Temu to pay $3 million to the state, submit to cybersecurity oversight and strengthen product-safety controls. For American consumers, the significance goes far beyond one state lawsuit. The settlement establishes a concrete model for restricting how a China-linked e-commerce platform can handle sensitive U.S. user data after years of concern that information collected from Americans could be exposed to entities operating under Chinese law.
Texas Attorney General Ken Paxton sued Temu and its parent-related entities earlier in 2026, alleging that the company unlawfully harvested Texans’ personal data and exposed that information to risks associated with the Chinese Communist Party. The lawsuit also challenged Temu’s business practices and raised product-safety concerns involving goods sold through the platform. Temu denied wrongdoing, but the settlement imposes operational restrictions that directly address the state’s data-security allegations.
The most important requirement is data localization. Temu must store Texans’ personal information on servers located in the United States that are owned and controlled by American entities. The agreement also limits access to that data by individuals and organizations based in China, except where access is necessary for essential business functions.
That distinction matters because consumer data is now an economic and strategic asset. A shopping platform can collect far more than a customer’s name and mailing address. E-commerce activity can reveal purchasing habits, payment information, device identifiers, location-related information, browsing behavior and patterns about households. At sufficient scale, those datasets can provide valuable insight into American consumers and markets.
Temu’s reach in the United States makes the issue especially important. Texas cited figures showing more than 82 million active U.S. users as of September 2023. A platform operating at that scale does not hold information about a small niche population. It potentially handles data tied to tens of millions of American households.
The settlement therefore represents a meaningful shift in how U.S. authorities are treating China-linked consumer technology companies. Instead of relying only on privacy disclosures or corporate promises, Texas has imposed structural restrictions on where information can be stored and who can access it. That approach recognizes that data security depends on architecture, not simply policy language.
The underlying concern is China’s legal and political environment. Companies with operations, personnel or infrastructure in China can face obligations under Chinese national-security and intelligence laws. For American regulators, the risk is that data stored in or accessible from China may be subject to demands that U.S. consumers cannot meaningfully challenge or even know about.
That is why keeping American user data physically and operationally inside the United States matters. Data localization cannot eliminate every cybersecurity risk, but it can reduce the number of foreign jurisdictions, employees and systems capable of reaching sensitive information. It also gives U.S. courts and regulators clearer authority over how that data is managed.
The Texas agreement goes further by imposing financial consequences. Temu will pay $3 million to the state, and violations of certain data-security requirements can trigger penalties of up to $8 million for each year a violation occurs. That creates an incentive for compliance that is stronger than a voluntary corporate privacy pledge.
Temu will also be required to hire an independent third-party cybersecurity auditor to examine its app code for malware and other security issues. That requirement is particularly important because mobile applications can collect extensive information and interact with device permissions in ways ordinary consumers rarely understand.
Texas previously alleged that Temu’s software used functions inappropriate for a conventional shopping application and characterized the platform as presenting a serious digital-security risk. The settlement does not require accepting every allegation from the original lawsuit as proven fact, but it does force the company into a level of independent technical review that reflects the seriousness of those concerns.
The agreement also adds product-safety obligations. Temu must conduct annual independent testing for dangerous chemicals and materials in products sold through its marketplace. If testing confirms unsafe substances, the company must remove the product, terminate the offending seller and affiliated stores, notify affected Texas customers and issue refunds.
That part of the settlement matters because the risk from ultra-low-cost Chinese e-commerce platforms is not limited to data. The same business model that rapidly connects American consumers with enormous numbers of overseas sellers can also make product oversight difficult. Clothing, household products, children’s items and toys can enter the U.S. market through fragmented seller networks that are much harder to supervise than traditional retail supply chains.
The combination of data and product requirements makes the Texas agreement especially significant. It treats Temu simultaneously as a technology platform and as a retail distribution system. Both dimensions create exposure for American consumers when the company’s operations depend heavily on China-linked infrastructure, sellers or personnel.
For the United States, this case also raises a broader strategic question about the price of convenience. Chinese e-commerce platforms have grown rapidly by offering extremely low prices, aggressive promotions and direct access to overseas sellers. Those advantages helped them build enormous American user bases in a short period.
But cheap products can create hidden costs if the platform also accumulates large amounts of consumer data or introduces products that fail U.S. safety standards. The real transaction may involve more than the price displayed at checkout.
This does not mean every online purchase creates a national-security crisis. It does mean that a foreign platform with tens of millions of American users should face scrutiny proportionate to the scale and sensitivity of the information it collects.
The settlement is also important because Texas is the first U.S. state to resolve this category of privacy claims against Temu. Other states have brought similar lawsuits and raised concerns about whether user data collected by the platform could ultimately become accessible in China. The Texas agreement now provides a regulatory template those states may study.
If similar conditions are adopted elsewhere, Temu could face a broader U.S. data-governance regime requiring American storage, limits on China-based access and regular independent cybersecurity review. That would significantly change how China-linked consumer platforms operate in the United States.
For Beijing’s technology ecosystem, such measures create a barrier between Chinese commercial networks and American personal information. That barrier is increasingly important because data can be used for commercial profiling, artificial-intelligence training, market intelligence and other forms of analysis.
American privacy regulation has often focused on whether companies receive consent before collecting information. The Temu settlement introduces another question that is becoming equally important: after a company collects American data, where does it go and who can reach it?
That is the correct direction for U.S. policy. A checkbox agreeing to a privacy policy offers limited protection if sensitive information can later move across jurisdictions where American users and regulators have little control. Geographic and operational restrictions provide a more enforceable safeguard.
The case should also serve as a warning to other China-linked applications operating in the United States. Companies that want access to the American consumer market should expect regulators to examine not only what data they collect, but also where the data is stored, which employees can access it and whether their corporate structure creates exposure to foreign-government demands.
Texas has already taken similar actions involving other technology companies associated with China, reflecting a wider effort to treat consumer data as a strategic resource rather than ordinary corporate property. That shift is likely to continue as states and federal authorities become more aware of the national-security implications of large foreign-controlled datasets.
The United States does not need to ban every foreign shopping app to protect itself. It does need enforceable rules that prevent millions of Americans’ personal information from flowing into environments where U.S. law cannot reliably protect it.
The Temu settlement is therefore more important than its $3 million payment. The real precedent is the requirement that American user data remain on American-controlled servers and that China-based access be tightly restricted.
For years, U.S. consumers have been encouraged to think about e-commerce mainly in terms of price, speed and convenience. The Temu case shows why a fourth question now belongs alongside them: who controls the data created by the purchase?
Texas has provided one answer. If a China-linked platform wants the benefits of operating at massive scale in the American market, it should also accept American rules designed to keep sensitive U.S. consumer data out of systems that could expose it to China.
