In September 2023, short-seller Grizzly Research hired independent security experts to tear apart Temu's code. They found 18 dangerous software functions — every red flag on their checklist — including runtime.exec(), which lets the app inject new code onto your phone after install, completely bypassing app store reviews. The experts unanimously called Temu "very virulent malware/spyware." By February 2026, Texas AG Ken Paxton had filed suit calling it "Chinese Communist spyware disguised as a shopping app." The app can literally rewrite itself on your phone without your knowledge. In March 2023, Google suspended Pinduoduo — Temu's sister app from the same parent company — from the Play Store after discovering it exploited roughly 50 Android vulnerabilities. Security researcher Toshin called it "the most dangerous malware ever found among mainstream apps." PDD Holdings had hired 100 programmers specifically to find exploitable holes in Android. Grizzly Research later found Temu shares the same underlying codebase as the malware-laden Pinduoduo. The company that built that app then built Temu.
What they claim: Temu's privacy policy implies user data is handled responsibly with appropriate safeguards.
What we found: Under China's National Intelligence Law Article 7, Chinese organizations must support and cooperate with intelligence work. CSIS concluded Temu could give the CCP an unprecedented vector for surveillance. Texas AG alleged Temu collects PII to prevent users from knowing it's subject to unfettered use by an adversarial government. Code is deliberately obfuscated to hide these functions.
What they claim: Temu promotes itself as an affordable shopping platform
What we found: Arkansas filed a lawsuit against Temu in 2024 alleging the app is "dangerous malware" that gains access to virtually all data on users' phones. The lawsuit claims Temu can access camera, microphone, GPS, contacts, text messages, and other installed apps — far beyond what a shopping app needs. Temu's parent company PDD Holdings is based in China and subject to China's National Intelligence Law.
What they claim: Temu's privacy policy presents standard data collection for shopping functionality.
What we found: In May 2026, Oklahoma AG filed suit alleging Temu "secretly infiltrates users' devices" to access precise location, microphone, camera, and activity on other apps. Texas AG called it "spyware disguised as a shopping app" in February 2026. Kentucky AG also sued. Four state attorneys general are now actively litigating against Temu.
What they claim: Temu collects data to improve shopping experience and provide services.
What we found: Multiple state AG lawsuits document Temu requesting call logs, contacts, photos, location, microphone, camera, gyroscope, clipboard, and Bluetooth. Nebraska AG found the app scans for other installed apps including WhatsApp, Signal, Telegram, and Discord. The app can auto-install software without consent.
What they claim: Temu's terms state users must be 18 or have parental consent.
What we found: Nebraska AG alleged Temu unlawfully harvests data including from kids. The app uses gamification — spin-the-wheel, countdown timers, daily rewards — designed to be addictive to minors. No meaningful age verification. Kentucky AG's July 2025 lawsuit cited harm to children. Gamification mirrors documented social media addiction techniques.
What they claim: Temu is an e-commerce platform that makes money selling products.
What we found: Grizzly Research found over 80% of 2022 revenues came from selling advertising services, not products. The report argued data sales may be PDD's true business model, selling data in truly massive quantities. Temu routinely sells products below manufacturing cost as loss leaders for data harvesting.
What they claim: Temu's privacy policy states it collects only data necessary to provide the service.
What we found: Grizzly Research's September 2023 report found 18 dangerous software functions including runtime.exec() — the holy grail of malware — allowing code injection at runtime bypassing security scans. Independent experts unanimously called Temu very virulent malware/spyware. Texas AG Ken Paxton described it as Chinese Communist spyware disguised as a shopping app.
What they claim: Temu presents itself as a safe, standard e-commerce application.
What we found: Parent company PDD Holdings had sister app Pinduoduo suspended from Google Play in March 2023 after exploiting approximately 50 Android vulnerabilities including CVE-2023-20963. Researcher Toshin called Pinduoduo the most dangerous malware ever found among mainstream apps. PDD recruited 100 programmers to find Android exploits. Grizzly found Temu shares the same codebase.
What they claim: Temu claims to uphold ethical business practices and comply with applicable laws.
What we found: Kentucky AG accused Temu of using forced labor in its supply chain. The US Uyghur Forced Labor Prevention Act presumes goods from Xinjiang are made with forced labor. Temu exploits the de minimis loophole — packages under $800 bypass customs — to ship millions of packages directly from Chinese factories without supply chain scrutiny.