Texas’s agreed judgment with Temu requires Texans’ personal data to sit on U.S. servers owned and controlled by an American company, and limits access to it by people and entities based in China. The 27-page judgment behind the announcement ties Temu’s largest penalties not to each year a violation occurs, as the release said, but to annual audits by a firm Temu hires.
Attorney General Ken Paxton announced the settlement on Oct. 16 with PDD Holdings Inc. and Whaleco Inc., the PDD subsidiary that operates the Temu shopping platform, resolving a deceptive trade practices suit Texas filed Feb. 19. The companies will pay $3 million. “This is a historic victory for data privacy, consumer protection, and Texans who deserve to know that the products they purchase are safe,” Paxton said in the release. In the judgment, the companies deny each allegation of wrongdoing and admit no liability. Temu said in a statement reported by Reuters that it “has come to an agreement to resolve this matter as we continue to focus on serving consumers and supporting businesses across Texas.” Reuters also reported that Texas is the first of the states suing Temu to resolve its claims.
Two phrases from the release are missing from the judgment
The release summarized two terms in language the judgment does not use. It said Temu must restrict access to Texans’ data by people and entities based in China “subject to essential business functions,” and that a breach of various data security provisions would bring an “$8,000,000 penalty each year a violation occurs.” A full-text search of the Agreed Final Judgment and Permanent Injunction that the office posted with the release finds neither phrase. The judgment is the document a court enforces, so its wording controls.
The judgment instead sets a two-tier access rule in Paragraph 29(b). No “Prohibited Person” may reach Texans’ identifiable personal data in unencrypted or decryptable form. For sensitive categories, the only exception is the consumer’s specific consent to that access for commercially reasonable purposes, and each consent covers a single instance of access. Those categories come from two definitions, Texas’s “Sensitive Data” under its Data Privacy and Security Act and the federal “Sensitive Personal Data” under the Justice Department’s Data Security Program. Ordinary personal data carries a second exception for access that “is reasonably necessary and proportionate to commercially reasonable purposes,” a list that includes fulfilling orders, fighting fraud, troubleshooting or improving the platform, and complying with U.S. law or legal process. Reuters, summarizing the term, pointed to transaction data such as shipping addresses. On the text, the exception is wider than that for ordinary data and, on its face, offers sensitive data no business-function route at all.
What actually triggers the $8 million
The penalty works differently, too. The $8 million figure is a civil penalty “per failed annual audit,” and the judgment ties it expressly to an independent firm’s final report finding what it calls Material Noncompliance. Two audits carry that trigger. The first covers the storage and access paragraphs, and only as to the sensitive categories. There, Material Noncompliance means a finding that a Texas consumer’s data “was accessed, transferred, disclosed, or made available by Temu to any Prohibited Person” in violation of those paragraphs. The second is an annual app-security audit, which looks for malware, spyware and what the judgment calls Unauthorized Data-Collection Code. That term covers collection of data categories materially different from those Temu’s privacy notice describes, and it excludes collection within a device permission the consumer granted, the platform operator’s documented permission framework or other consumer consent.
Lesser findings run on a separate track. When a final report identifies noncompliance short of that standard, Temu has 60 days to cure it, and “no penalty accrues under this Paragraph unless Temu fails to cure.” The judgment does not separately specify the penalty for an uncured lesser finding. Read literally, then, the data track’s express $8 million trigger turns on data reaching a Prohibited Person rather than on a server’s address alone, though an uncured lesser finding could also draw a penalty under the same paragraph.
Breaches outside the audit cycle can fall under the judgment’s general enforcement paragraph, which sets civil penalties of up to $10,000 per violation. For most of the data terms, those penalties begin to accrue on the 31st day after Temu receives written notice from the attorney general’s office. A repeat violation of the same paragraph after an earlier notice gets no new grace period. Against that scale, a single failed audit at $8 million is about 2.7 times the $3 million settlement payment, which itself combines civil penalties, attorney’s fees, investigative fees and costs.
Product safety terms run on a parallel track. Temu must commission annual independent testing of commonly purchased products. When a product is confirmed harmful, Temu must pull the listing, cut off the seller and its affiliated storefronts, notify Texas buyers and refund them. A failure to terminate a store within five business days carries a separate $600,000 penalty.
A China test that differs from the federal rule
Who counts as a Prohibited Person decides how far the data-track penalty reaches. The judgment defines one as an entity or individual organized under the laws of the People’s Republic of China, having its principal place of business there, or primarily resident there. Those tests parallel parts of the Justice Department’s “covered person” definition in its Data Security Program rule, 28 C.F.R. § 202.211. The judgment omits that definition’s 50 percent ownership tests, its prong reaching employees and contractors of covered entities, and designation by the U.S. attorney general.
The difference does not run in one direction, however. The federal categories that apply automatically reach only foreign persons, and the federal rule treats a U.S. citizen as a U.S. person regardless of location. The judgment’s test carries no such limit, so a U.S. citizen primarily resident in China would meet it without becoming a federal covered person on that basis alone.
The two regimes are written to coexist. The judgment frames its data-protection paragraph as consistent with standards Temu must meet under U.S. law, naming both the federal program and the Texas Data Privacy and Security Act. It also states that nothing in it relieves Temu of other legal obligations.
The storage clause has an open term of its own. Paragraph 29(a) requires commercial servers in the United States “owned and controlled by an American company,” and the judgment’s definitions section, which defines its other key terms, does not define “American company.” The posted text does not say whether a U.S. subsidiary of a foreign parent would qualify.
Temu retains the auditor whose findings set the penalty
The annual audit of those storage and access terms, like the app-security audit, runs through a Qualified Independent Firm that Temu retains and pays. The firm must be accredited or nationally recognized for the assessment and independent of Temu, with no other engagements for Temu or its affiliates in the prior three years, during the engagement or for two years after it. Temu’s retention of a firm counts as its certification that the firm qualifies, and the attorney general’s office need not choose, approve or check it. An audit by an unqualified firm does not satisfy the obligation, though its adverse findings stand until a qualified firm reports. Data Security Program work for Temu or its affiliates, past, present or future, does not disqualify a firm, and one firm may audit in consecutive years.
Reports go to Temu first, and the office receives a copy within 30 days after a report becomes final. Temu gets a single objection to each report, and a timely objection pauses its duty to cure the challenged noncompliance and the accrual of penalties attributable to it. The firm’s ruling on that objection is final for purposes of the judgment. Temu may then seek court review, limited to the record before the firm.
Where discovery and governance teams meet the order
For practitioners, timing turns on the court. The Collin County docket records an order for permanent injunction on Oct. 16 and lists the case as closed, and the judgment’s effective date is the date the court signs it. Neither the public case view nor the attorney general’s posted copy, which carries the parties’ Oct. 15 signatures and a blank line for the judge, provides the signed order, so this article could not confirm that the entered text matches the posted one. If Oct. 16 is the effective date, the storage and access obligations become enforceable April 14, 2027, and the first annual audit reports are due Sept. 1, 2027. The judgment’s general term runs four years, to Oct. 16, 2030, on that reading, while specified provisions survive indefinitely, including the confidentiality of audit materials and the bar on using the judgment as evidence.
Over those four years, the data terms also shape what a litigant can later collect and from where. At least quarterly, Temu must identify Texas accounts inactive for 24 consecutive months and delete the associated personal data. The exception covers retention that remains reasonably necessary, including preserving data under a legal hold in connection with “actual or reasonably anticipated litigation, investigation, or legal proceeding.” As a practical step that the judgment itself does not require, counsel expecting to need Texas user records may want to send a preservation demand that names the inactive-account deletion cycle rather than relying on a generic hold letter.
The legal-process exception is also narrow. It covers only ordinary personal data and only compulsory process “issued by a U.S. court or governmental authority.” On the face of the text, sensitive data has no legal-process exception to the Prohibited Person bar, only single-instance consent for commercially reasonable purposes. Any review workflow that would route decryptable sensitive data to personnel residing in China needs to be planned around that language.
The audit findings will be hard for outsiders to reach. Audit materials are presumptively confidential, and the office must shield them from public-records requests as far as the Texas Public Information Act permits. Unless law prohibits it, the office must also give Temu at least 30 business days’ notice before disclosing them under legal process. Outside a proceeding to enforce it, the judgment cannot serve as evidence or precedent, and it preserves the claims of private parties and other agencies.
Residency is measured by proxy. A user counts as a Texas consumer when the transaction’s IP address geolocates to Texas or the account’s default delivery address is in Texas, and Temu need not verify residency further. Information governance teams mapping which records fall under the order will be working from those two fields.
Better terms elsewhere flow back to Texas
Other states have also sued Temu over how it handles their residents’ data. Arkansas, Nebraska and Kentucky filed suits between June 2024 and July 2025, according to the consumer group U.S. PIRG, and Arizona’s attorney general announced a suit on Dec. 2, 2025. A December 2025 Associated Press report published by Fortune named all four. The current status of those cases was not reviewed for this article.
The Texas judgment anticipates suits like these. Its most-favored protection clause covers qualifying negotiated resolutions, such as settlements and consent judgments, that Temu executes with other states within three years of the effective date and that give consumers greater protection for substantially the same conduct. Injunctive provisions that are materially more favorable, taken as a whole, become self-executing in Texas unless the office notifies Temu within 90 days that it declines them. A separate monetary term requires Temu to pay Texas the difference if another state’s net payment exceeds Texas’s by over 5 percent. Judgments won in contested litigation, settlements reached after a dispositive ruling against Temu, and resolutions with federal agencies, foreign or local governments and private parties are excluded.
That structure lets Texas collect the gains of later negotiated settlements; it does not bind other states to Texas’s terms. Whether it shapes their negotiations is a prediction rather than anything the clause requires. Either way, the judgment adds a state attorney general to the Justice Department as a source of rules on where data sits and who may reach it. The enforcement models differ: the federal program is a regulation, while this is a negotiated judgment whose largest penalties depend on findings by an auditor the company chooses.
If server ownership becomes a standard settlement term, will litigants start asking who certified the servers before they ask what is on them?
News sources
- Agreed Final Judgment and Permanent Injunction, State of Texas v. PDD Holdings Inc. and Whaleco Inc. d/b/a Temu (Office of the Texas Attorney General)
- Case History, 471-01114-2026, The State of Texas v. PDD Holdings Inc., and Whaleco Inc. d/b/a Temu (Collin County Judicial Online Search)
- Attorney General Paxton Secures First-of-Its-Kind Settlement with Temu to Protect Texans’ Data from the CCP and to Protect Consumers from Toxic Products from China (Office of the Texas Attorney General)
- Attorney General Ken Paxton Files Fourth Anti-CCP Lawsuit in Three Days by Suing Temu for Deceptive Marketing and Illegal Data Harvesting (Office of the Texas Attorney General)
- 28 CFR 202.211: Covered person (Electronic Code of Federal Regulations)
- 28 CFR 202.256: United States person or U.S. person (Electronic Code of Federal Regulations)
- Chinese online retailer Temu agrees to data privacy curbs to settle Texas lawsuit (Reuters via KELO-FM)
- Chinese online retailer Temu agrees to data privacy restrictions to settle Texas lawsuit, documents say (Reuters via WSAU, earlier version)
- Attorney General Mayes Sues Online Shopping Platform Temu for Stealing Arizonans’ Data and Misleading Consumers (Arizona Attorney General)
- Arizona becomes latest state to sue Temu over claims that its stealing customer data (Fortune and The Associated Press)
- Does Temu misuse your personal data? More state attorneys general say yes (U.S. PIRG)
- The Data Sovereignty Vise: Two Governments, One Compliance Trap, No Safe Harbor (ComplexDiscovery)
Assisted by GAI and LLM Technologies
Source: HaystackID published with permission of ComplexDiscovery OÜ
Advisor’s Note: HaystackID’s Corporate Monitorship Advisory Services help organizations navigate these complex requirements through a combination of legal, technical, compliance, investigative, and advisory expertise. By supporting compliance assessments, remediation oversight, program validation, and ongoing monitoring activities, HaystackID enables organizations to demonstrate accountability while creating defensible evidence of compliance.
As enforcement expectations continue to evolve, organizations that embrace independent oversight and continuous compliance monitoring may be better positioned to manage risk, satisfy regulatory obligations, and protect enterprise value. Learn more at Corporate Monitorship Advisory Services | HaystackID
