Temu says you must be 18 to use it. Meanwhile, Nebraska AG Michael Hilgers found the app "unlawfully harvests data, including from kids" with zero meaningful age verification. The app uses spin-the-wheel games, countdown timers, and daily rewards — addiction mechanics designed to hook young users. Kentucky AG Russell Coleman followed in July 2025 with similar allegations. The app that claims to be adults-only was designed with the dopamine-hijacking playbook of a casino slot machine, and children are pulling the lever while their data flows to servers subject to Chinese intelligence law. Oklahoma's Attorney General hired forensic experts to take Temu's app apart. What they found: it was secretly accessing your microphone, your camera, and watching what you do in other apps — none of which you agreed to. Texas sued too. The shopping app was a surveillance tool.
What they claim: Temu's terms state users must be 18 or have parental consent.
What we found: Nebraska AG alleged Temu unlawfully harvests data including from kids. The app uses gamification — spin-the-wheel, countdown timers, daily rewards — designed to be addictive to minors. No meaningful age verification. Kentucky AG's July 2025 lawsuit cited harm to children. Gamification mirrors documented social media addiction techniques.
What they claim: Temu claims its app complies with US privacy law and collects only standard e-commerce data
What we found: Oklahoma AG filed suit in May 2026 after independent forensic experts reverse-engineered the Temu app and found it secretly harvested sensitive user data without consent, including microphone and camera access and activity monitoring of other apps on the device. The Texas AG filed a parallel lawsuit in February 2026 alleging deceptive practices.
What they claim: Temu's privacy policy implies user data is handled responsibly with appropriate safeguards.
What we found: Under China's National Intelligence Law Article 7, Chinese organizations must support and cooperate with intelligence work. CSIS concluded Temu could give the CCP an unprecedented vector for surveillance. Texas AG alleged Temu collects PII to prevent users from knowing it's subject to unfettered use by an adversarial government. Code is deliberately obfuscated to hide these functions.
What they claim: Temu collects data to improve shopping experience and provide services.
What we found: Multiple state AG lawsuits document Temu requesting call logs, contacts, photos, location, microphone, camera, gyroscope, clipboard, and Bluetooth. Nebraska AG found the app scans for other installed apps including WhatsApp, Signal, Telegram, and Discord. The app can auto-install software without consent.
What they claim: Temu promotes itself as an affordable shopping platform
What we found: Arkansas filed a lawsuit against Temu in 2024 alleging the app is "dangerous malware" that gains access to virtually all data on users' phones. The lawsuit claims Temu can access camera, microphone, GPS, contacts, text messages, and other installed apps — far beyond what a shopping app needs. Temu's parent company PDD Holdings is based in China and subject to China's National Intelligence Law.
What they claim: Temu's privacy policy presents standard data collection for shopping functionality.
What we found: In May 2026, Oklahoma AG filed suit alleging Temu "secretly infiltrates users' devices" to access precise location, microphone, camera, and activity on other apps. Texas AG called it "spyware disguised as a shopping app" in February 2026. Kentucky AG also sued. Four state attorneys general are now actively litigating against Temu.
What they claim: Temu is an e-commerce platform that makes money selling products.
What we found: Grizzly Research found over 80% of 2022 revenues came from selling advertising services, not products. The report argued data sales may be PDD's true business model, selling data in truly massive quantities. Temu routinely sells products below manufacturing cost as loss leaders for data harvesting.
What they claim: Temu maintains its app complies with US privacy law and all data collection is properly disclosed
What we found: FTC reached $2M settlement with Temu — first enforcement under INFORM Consumers Act. Nebraska AG sued alleging Temu's app "operates as malware designed to gain unauthorized access to users' data." Arkansas AG sued citing national security risks from data transmission to China. Texas AG active investigation. Illinois privacy case in discovery with class certification expected 2026. CFIUS reportedly examining PDD Holdings operations.
What they claim: Temu's privacy policy states it collects only data necessary to provide the service.
What we found: Grizzly Research's September 2023 report found 18 dangerous software functions including runtime.exec() — the holy grail of malware — allowing code injection at runtime bypassing security scans. Independent experts unanimously called Temu very virulent malware/spyware. Texas AG Ken Paxton described it as Chinese Communist spyware disguised as a shopping app.
What they claim: Temu presents itself as a safe, standard e-commerce application.
What we found: Parent company PDD Holdings had sister app Pinduoduo suspended from Google Play in March 2023 after exploiting approximately 50 Android vulnerabilities including CVE-2023-20963. Researcher Toshin called Pinduoduo the most dangerous malware ever found among mainstream apps. PDD recruited 100 programmers to find Android exploits. Grizzly found Temu shares the same codebase.
What they claim: Temu claims to uphold ethical business practices and comply with applicable laws.
What we found: Kentucky AG accused Temu of using forced labor in its supply chain. The US Uyghur Forced Labor Prevention Act presumes goods from Xinjiang are made with forced labor. Temu exploits the de minimis loophole — packages under $800 bypass customs — to ship millions of packages directly from Chinese factories without supply chain scrutiny.
What they claim: Temu's app store listing and marketing materials present it as a standard e-commerce shopping app.
What we found: Texas Attorney General filed a petition in February 2026 characterising the Temu app as "spyware designed to collect user data in excess of the application's requirements." The petition alleges Temu collects data far beyond what a shopping app needs, including detailed device information and behavioural patterns.
What they claim: Temu claims to uphold ethical business practices and comply with applicable laws
What we found: On May 28, 2026, the European Commission fined Temu EUR200 million ($232M) — the largest penalty ever under the Digital Services Act. Mystery shopping found baby toys with chemicals above EU limits, small detachable parts posing suffocation hazards, and phone chargers failing basic electrical safety. Temu's risk assessment was found to be "inaccurate" and lacking specificity.