Texas entered an agreed final judgment and permanent injunction with PDD Holdings Inc. and WhaleCo Inc., doing business as Temu, resolving state consumer-protection claims. Temu agreed to pay $3 million and implement data-security and product-safety measures, while denying wrongdoing.
The judgment is notable because it uses state consumer-protection authority to impose controls resembling data-sovereignty and national-security safeguards. Among other requirements, covered Texas consumer data must be stored on U.S.-based servers owned and controlled by U.S. entities, and access by specified China-based personnel must be restricted except for defined business purposes and subject to controls. Certain obligations phase in over 30, 90, and 180 days, and the judgment requires independent testing and reporting.
What Businesses Should Take Away
Companies with cross-border engineering, customer-support, analytics, or administrative operations should evaluate both where U.S. consumer data is stored and who can access it. Effective controls should address access purpose, least privilege, logging, approvals, vendor access, periodic testing, and auditable separation of restricted personnel and systems.
The CommLaw Group Can Help
The CommLaw Group advises businesses on privacy, cross-border data access, cybersecurity, data localization, and state consumer-protection enforcement. For assistance evaluating these developments or strengthening compliance programs, please contact:
Brian Alexander | bal@commlawgroup.com
Diana James | daj@commlawgroup.com
Primary source: Texas agreed final judgment and permanent injunction