Arkansas AG Sues Temu for Data Theft and Privacy Violations

On 25 June 25, 2024, Arkansas Attorney General Tim Griffin announced a lawsuit against Temu’s parent companies, PPD Holdings Inc. and WhaleCo Inc., for violating the Arkansas Deceptive Trade Practices Act (ADTPA) and the Arkansas Personal Information Protection Act (PIPA). Griffin claims Temu operates as a data-theft business, collecting unauthorized user data by overriding device privacy settings.

Background

Temu, launched in the U.S. in 2022, is linked to a precursor app, Pinduoduo. Both apps faced suspension from Apple and Google Play stores due to misrepresentations about data access and usage, raising significant security and privacy concerns.

Allegations by the AG

Griffin’s lawsuit outlines several claims:

• Temu excessively collects sensitive personal information without user knowledge.
• The company’s privacy policy contains false representations.
• User data may be misappropriated by Chinese authorities.
• Arkansans’ privacy rights are violated, with their data exposed to unauthorized access.
• Temu misleads about product quality to maximize user sign-ups and data collection.
• The company collects personal information from minors, including those under 13.

Outcomes Sought Filed in Cleburne County Circuit Court, the lawsuit seeks:

• An order to stop Temu’s deceptive practices and privacy violations.
• The imposition of civil penalties.
• Monetary and equitable relief for the state and affected individuals.

Statements and Responses

Griffin emphasized the security risks posed by Temu, noting its leadership by former Chinese Communist Party officials. He pledged to fight Temu’s deceptive practices aggressively. Temu, however, denied the allegations, attributing them to misinformation from a short-seller. The company expressed disappointment over the lawsuit and vowed to defend itself.

👉 Read the press release and the lawsuit here.