Temu is an e-commerce marketplace operated by Whaleco Inc., a Delaware subsidiary of PDD Holdings Inc. — a Cayman Islands-incorporated, Dublin-headquartered, SEC-reporting holding company that also runs Pinduoduo in China via a VIE structure. Temu's privacy policy (updated Nov 14, 2025) describes collection of contact, demographic, device, usage, and approximate IP-based location data, and permits sharing with third-party advertising, marketing, and analytics companies; its U.S. addendum states some disclosures may constitute a "sale" or "sharing" under state privacy laws and provides opt-outs. The EU designated Temu a Very Large Online Platform (May 2024), opened formal DSA proceedings (Oct 2024), and fined it €200 million (May 2026) over systemic-risk assessment failures. A pending Arkansas AG suit (June 2024) alleges unauthorized data access. Temu runs a public HackerOne bug bounty.
TRACK RECORD
2 ENFORCEMENT ACTIONS
[2026-05-28]
On May 28, 2026, the European Commission fined Temu €200 million under the Digital Services Act, finding that Temu failed to diligently identify, analyse, and assess the systemic risks of illegal products offered on its platform, including how its recommender systems and influencer product-promotion programmes could amplify dissemination risks.
On June 25, 2024, Arkansas Attorney General Tim Griffin announced a lawsuit filed in Cleburne County Circuit Court against PDD Holdings Inc. and Whaleco Inc., alleging violations of the Arkansas Deceptive Trade Practices Act and the Personal Information Protection Act; the complaint alleges the Temu app is designed to gain unauthorized access to users' phone data. These are allegations in pending litigation, not established findings.
Temu's Privacy & Cookie Policy (Whaleco Inc., last updated November 14, 2025) states that Temu collects device data — including device model, operating system, internet service provider, language settings, and unique identifiers (including advertising identifiers where permitted by law) — along with contact and demographic data, service-usage data, and approximate location derived from technical information such as IP address.
On May 31, 2024, the European Commission formally designated Temu as a Very Large Online Platform under the Digital Services Act based on Temu's self-reported figure of more than 45 million average monthly EU users, subjecting Temu to the DSA's most stringent transparency and risk-mitigation obligations within four months of notification.
PDD Holdings Inc.'s Annual Report on Form 20-F for fiscal year 2025 (filed with the SEC on April 29, 2026) discloses that PDD Holdings — the parent of Temu operator Whaleco Inc. — is incorporated in the Cayman Islands with principal executive offices in Dublin, Ireland, and that it conducts certain Chinese mainland operations through a variable interest entity (VIE) in which it holds no equity ownership.
Temu's Privacy & Cookie Policy (last updated November 14, 2025) states that Temu may share personal information with third-party advertising, marketing, and analytics companies for interest-based advertising and analytics purposes, while also stating that Temu does not "sell" personal information in the traditional sense.
Temu's Privacy Policy Addendum for U.S. Residents (last updated November 14, 2025) discloses that sharing identifiers such as hashed email addresses and telephone numbers with advertising, analytics, and marketing partners may constitute the "sale" or "sharing" of personal information under U.S. state privacy laws, and it provides residents rights to opt out of sale/sharing, targeted advertising, and profiling.
In March 2023, Google suspended Pinduoduo — Temu's sister app, also owned by parent company PDD Holdings — from the Google Play Store after versions of the app distributed outside the Play Store were found to contain malware; this action concerned the Pinduoduo app, not Temu itself.
On June 25, 2024, Arkansas Attorney General Tim Griffin announced a lawsuit filed in Cleburne County Circuit Court against PDD Holdings Inc. and Whaleco Inc., alleging violations of the Arkansas Deceptive Trade Practices Act and the Personal Information Protection Act; the complaint alleges the Temu app is designed to gain unauthorized access to users' phone data. These are allegations in pending litigation, not established findings.
On May 28, 2026, the European Commission fined Temu €200 million under the Digital Services Act, finding that Temu failed to diligently identify, analyse, and assess the systemic risks of illegal products offered on its platform, including how its recommender systems and influencer product-promotion programmes could amplify dissemination risks.
On October 31, 2024, the European Commission opened formal proceedings to assess whether Temu breached the Digital Services Act, including Temu's compliance with the requirement to disclose the main parameters used in its recommender systems, to provide users an option not based on profiling, and concerns about the potentially addictive design of the service; the opening of proceedings assesses possible infringements and does not prejudge the outcome.
Temu's Privacy & Cookie Policy (last updated November 14, 2025) states that Temu collects information via cookies and similar technologies stored on the user's device, including attribution information used to determine the origin of traffic and data on which advertisements a user clicked.