Temu settles Texas data privacy case: what changes and what to do
Temu will pay $3 million, keep Texans' data on US servers and add a one-click route to account deletion. It denies wrongdoing.
Texas has settled its data privacy lawsuit against Temu, the shopping app. The Texas Attorney General announced the deal on October 16, 2026. Temu pays $3 million, must change where and how it keeps Texans' data, and must make deleting your account easier to find. Temu denies wrongdoing. If you have a Temu account you no longer use, this is a good week to decide whether to keep it.
What happened
Texas sued PDD Holdings and Whaleco, the companies behind Temu, on February 19, 2026, under the state's consumer protection law. According to the agreed final judgment, the state alleged that Temu misrepresented the app's permissions and the data it collects, uses and shares. The suit also covered claims about promotions, pricing and product quality.
The two sides agreed to settle rather than go to trial. In the judgment, the companies "deny each allegation of wrongdoing," and the document says it is not an admission of any violation. The Attorney General's office says Temu had more than 82.4 million active users in the United States as of September 2023.
FOX 4 reported that the $3 million covers civil penalties, attorney fees and investigative costs, which matches the judgment's wording. The settlement also includes product safety testing, but this post sticks to the data side.
What the settlement requires
These are the terms in the judgment as published. The copy the state released has a blank line where the judge signs, and most deadlines count from that signing date. PPC Land noted the same gap, so treat the exact start dates as unconfirmed.
- Where data lives. Within 180 days, Temu must store Texas customers' personal data on servers in the United States owned and controlled by an American company. Access from people and entities covered by the judgment's restrictions is limited to listed exceptions, such as filling an order or fighting fraud.
- Old accounts get cleaned out. At least every quarter, Temu must find Texas accounts with no login, order or other activity for 24 months in a row and delete the personal data tied to them, unless the law or another listed reason requires keeping it.
- A clearer way out. Within 90 days, Temu's US privacy policy must include a "one-click" link, for logged-in users, to its "How to delete your Temu account" page.
- Audits with a price tag. An independent firm must check the data rules each year. If a final audit report finds material noncompliance, Temu pays $8 million per failed audit and has 60 days to fix the problem.
The judgment runs for four years once it takes effect.
What it means for you
The protections in this judgment are written for Texas consumers. If you live elsewhere, the server and deletion rules do not directly cover your account, though Temu may choose to apply some changes more widely. Nothing announced so far says it will.
The quarterly cleanup only reaches accounts that have sat untouched for two full years. An account you opened for one cheap order last spring keeps your name, address, email and order history until then, or until you delete it yourself. Waiting for a rule to do it means waiting a long time.
The one-click deletion link is useful, but it only helps people who know to look for it.
What to do now
- Decide if you still use Temu. If not, log in and look for the account deletion page in the app's settings or its privacy policy. Follow the steps Temu gives there.
- Check your device permissions. Whatever you decide, review what the app can reach on your phone, such as location, contacts and photos, and turn off anything it does not need.
- Look for other shopping accounts you forgot about. Most people have more than they think. Promotional emails are the easiest trail to follow.
Nothing here is legal advice. Your rights to delete data depend on the state you live in.
Where Ghostifier fits
That third step is the slow one, and it is what Ghostifier is built for. It reads who emails you and the subject lines, never the contents, to show which companies have your address. From there it can unsubscribe you, opt you out and send deletion requests on your behalf, including to data brokers on paid plans. You can start with a free scan.