The facts
On February 19, 2026, the State of Texas, acting through Attorney General Ken Paxton, filed suit against PDD Holdings Inc. and Whaleco Inc., which does business as Temu. Texas alleged the companies engaged in false, misleading, or deceptive acts under the state's Deceptive Trade Practices Act by: misrepresenting the nature of the Temu app and the scope of the permissions it seeks and the data it collects; misrepresenting promotions, credit-back offers, coupons, games, referral rewards, and prices; misrepresenting the quality, standard, grade, authenticity, and safety of goods, including through customer reviews and ratings; failing to safeguard consumers' personal information or give notice of a security breach; and failing to disclose that personal data collected from Texas consumers "may be furnished to the government of the People’s Republic of China or to other third parties."
The defendants deny each allegation of wrongdoing, and the judgment states that nothing in it counts as an admission or concession of any violation.
Under the agreed judgment, Texas recovers $3 million, and Temu must retain an independent firm to security-test its mobile app every year to detect behavior consistent with the presence of "Malware," "Spyware," or "Unauthorized Data-Collection Code." The judgment defines those terms, because this is a shopping app that required a legal definition of spyware: code that exploits a vulnerability to obtain a permission that would otherwise be denied, or that collects and transmits consumer data "while materially misrepresenting to the user or the platform operator the function of the code," or that damages or disables the user's device. A failed annual audit costs Temu a civil penalty of $8 million per failure, with sixty days to cure the noncompliance.
On data, Temu must store the personal data of Texas consumers on commercial servers located in the United States that are owned and controlled by an American company, and must prohibit access by any "Prohibited Person": anyone organized under the laws of the People's Republic of China, with a principal place of business there, or primarily a resident there.
On products, Temu must monitor U.S. and Texas recall alerts and pull any recalled product within two business days, and must pay an independent firm to test a cross-section of products every year for harmful materials including lead, PFAS compounds, phthalates, formaldehyde, and heavy metals. Anything that flunks becomes a "Confirmed Harmful Product": the listing comes down within two business days, the seller and all of its affiliated stores are terminated within five, every Texas buyer gets direct notice, and every one of them gets a full refund.
Our take
Let's get this straight. The great state of Texas had to sit down with a fucking shopping app and write a legal definition of spyware into its punishment. We're not talking about a defense contractor or a telecom. We're talking about the digital dumpster fire where you go to buy a three-dollar phone charger that might also be a listening device. The fact that a court order now exists, specifically defining 'Spyware' for the Temu app, is the single most pathetic indictment of that company's entire fucking existence. It's like having to write a restraining order that defines 'stalking' for a neighbor who just really, really likes looking in your windows.
Temu's official stance is that it did nothing wrong. A classic move from the absolute cunts of commerce. So of course, its brilliant legal strategy was to sign a binding agreement that forces it to hire an independent firm to crawl up its app's digital asshole every year, searching for malware and unauthorized data-collection code. If it fails this annual colonoscopy, it's an eight-million-dollar penalty per fuck-up. This is the corporate equivalent of screaming 'I'm not drunk!' while happily blowing into a breathalyzer you're required to carry at all times. The sheer, staggering hypocrisy of denying guilt while submitting to a regime of proof is the kind of bullshit only a true grifter could pull with a straight face.
And the merchandise! Oh, the beautiful, toxic merchandise. Texas didn't stop at the data. No, sir. Now Temu has to pay a lab to test its random Chinese factory output for lead, PFAS, phthalates, formaldehyde, and heavy metals. Anything that fails is branded a 'Confirmed Harmful Product.' Finally, some truth in advertising! That 'mystery jewelry' isn't a fashion risk; it's a confirmed fucking biohazard. The listing gets yanked, the seller gets atomized, and every Texan who bought that radioactive bracelet gets a refund. The bargain bin now comes with the same regulatory oversight as a Superfund site. It's glorious.
The data rules are the real dick-slap, though. Texans' personal info has to live on American servers owned by an American company. And the judgment explicitly bars any 'Prohibited Person' - defined as anyone from the PRC - from touching it. The state of Texas essentially built a little digital gated community inside Temu's servers and posted a sign saying 'NO CHINESE GOVERNMENT ALLOWED.' The three-million-dollar payout is a rounding error for these pricks. The real leash is that eight-million-dollar fine hanging over every failed spyware audit. Every year, Temu gets to sweat while some nerds poke its code, and every year, we get to laugh at the spectacle of a spyware-suspected shopping app getting its homework graded by the Texas Attorney General's office. What a time to be alive, and to not have your data siphoned to Beijing by a company selling lead-lined children's toys.
