We may earn commissions from products we recommend. Learn more.
Is Temu safe? What the app actually collects in 2026
Is Temu safe? What the app actually collects in 2026
Temu is a legitimate online marketplace, but that does not mean it is private. Based on Temu’s privacy statements, app store labels, regulatory findings, lawsuits, congressional investigations, and the 2024 CSIS security analysis, we do not consider Temu a low-risk shopping app for privacy. The company clearly states it collects a wide range of account, transaction, device, browsing, search, location, advertising, and diagnostic data. Meanwhile, several U.S. attorneys general claim the app collects even more than it admits.
It is important to separate proven facts from allegations. South Korea’s privacy regulator has penalized Temu for breaking rules about handling personal data and verifying identities. In contrast, claims that the Temu app secretly behaves like malware, accesses microphones and cameras without permission, or collects data from other apps remain allegations in U.S. lawsuits. These have not been proven in court. At the same time, a 2024 CSIS report says Temu poses serious privacy and national security risks, and more state attorneys general are questioning the company’s practices.
Our top-rated VPN4.5/5 in our review. Our top pick of the year: almost no slowdown in our speed tests, and it unblocked Netflix, BBC iPlayer and Disney+ without trouble.
Table of Contents:
- Introduction
- What is Temu?
- Is Temu safe?
- What data can Temu collect about you?
- Can Temu steal your sensitive data?
- Risks to consider when shopping on Temu
- Customer protection measures and tips for shopping safely on Temu
- Conclusion
- Frequently asked questions (FAQs)
What is Temu?
Temu is an online shopping platform that started in the United States in 2022 and quickly became known for its low prices. The company is run by Whaleco Inc., based in Delaware. Temu is part of PDD Holdings, which began in China and later moved its main offices to Dublin, though it still has major operations in China.
Temu links shoppers to a large network of sellers, especially those offering affordable clothing, electronics, household items, accessories, toys, and more. Temu acts as a marketplace that connects buyers and sellers and uses warehouses to manage products before shipping.
Temu's success in the U.S. was partly due to direct shipments that qualified for the "de minimis" exemption. This rule let packages under $800 enter the country with fewer customs checks and no regular duties. In 2023, a House Select Committee found that Temu and Shein made up over 30% of all U.S. packages using this rule and almost half of such shipments from China.
This system has changed. In May 2025, the U.S. stopped duty-free de minimis treatment for packages from China and Hong Kong, and later ended it for all countries. A February 2026 executive order kept this suspension in place, so low-value imports are no longer automatically exempt if they are under $800.
Is Temu safe?
Temu is a legitimate shopping site, but how safe it is depends on the type of risk you are concerned about.
For basic account security, Temu says it uses technical and organizational controls, adheres to Payment Card Industry standards for card data, and can send security codes via email or text. Google Play reports that the Android app encrypts data in transit, lets users request data deletion, and has passed an independent security review. These are good protections, but Google's safety details come from the developer and may vary by region, age, or the features you use.
Privacy is a bigger concern. Temu's policy allows extensive tracking and sharing for advertising. Apple says the app may collect and link purchases, financial details, location, contact info, user content, search history, identifiers, usage data, and diagnostics for users. Temu also shares some information for targeted ads, which may legally be considered a "sale" under some U.S. state privacy laws.
This regulatory history shows why these disclosures matter. In May 2025, South Korea's Personal Information Protection Commission fined Temu KRW 1.369 billion and issued a KRW 17.6 million penalty for breaking rules on cross-border data processing, managing overseas partners, identity checks, and other privacy requirements. The regulator found that Temu allowed companies in Korea, China, Singapore, and Japan to handle personal data without providing the required notice or properly supervising them.
The Korean investigation also found that Temu collected ID documents, facial video data, and Korean resident registration numbers during seller verification without a legal reason. During the investigation, Temu deleted the related seller data and made some voluntary changes, such as improving cross-border data transfer disclosures and making it easier to close accounts.
Product safety is another major concern, separate from app security. In May 2026, the European Commission fined Temu EUR 200 million for not properly checking for illegal products, as required by the Digital Services Act. The Commission's investigation found that many chargers failed basic safety tests, and many baby toys had medium to high risks due to too many chemicals or small parts that could cause suffocation.
We are not saying that everyone who installs Temu will have their phone compromised. However, there is sufficient evidence from privacy, regulatory, marketplace, and product-safety issues to suggest that people should be more careful with Temu than with a typical shopping app.
What data can Temu collect about you?
Temu’s U.S. privacy policy covers a lot of ground, and it collects more information than many shoppers might expect.
If you sign up for an account, Temu can collect your phone number, email, user ID, country or region, profile details, account settings, and preferences. If you log in with Google or Facebook, Temu may also get your username, profile photo, and email from those services.
When you buy something, Temu collects details like transaction IDs, your purchase history, product codes, payment info, billing and shipping addresses, recipient name and phone number, and sometimes product sizing. The policy also says you need to provide a payment card number or other payment details to complete a purchase.
Temu also tracks your activity on its platform. According to its policy, it automatically collects information such as:
Device information, such as your device model, operating system, internet service provider, language settings, and advertising or other unique identifiers.
Browsing and shopping activity, including pages viewed, browsing history within the service, searches, purchases, products placed in your cart, referral source, and interactions with Temu emails.
Technical diagnostics, including crash reports, service logs, and performance information.
Location information, including approximate location inferred from technical information such as your IP address.
Apple’s App Store disclosure adds another detail. Temu tells Apple that its iOS app might collect both precise and general location data linked to your identity for the app to work. This doesn’t mean every user is always sending GPS data to Temu. Apple notes that privacy practices can vary based on features, age, and how you use the app. Still, it confirms that precise location is one type of data the app may collect.
If you reach out to customer support, Temu may get even more sensitive information. Support messages can include text, photos, videos, audio, and documents. If you report an injury or health issue, you might share health details, treatment info, test results, reports, medications, and photos or other medical evidence.
Temu also gets information from other companies. Its policy mentions logistics providers, mapping services, social media, payment processors, advertising partners, and more. For example, mapping services might give Temu location coordinates linked to an address to help find the right collection point.
Advertising is an important area to look at. Temu says it may share your information with advertising, marketing, and analytics companies for interest-based ads. It also admits that some of this sharing could constitute a "sharing" or a "sale" of personal information under U.S. privacy laws, even though Temu claims it does not sell information in the traditional sense.
Temu says it stores U.S. user data on cloud servers in the United States. However, its privacy policy also says information may be shared with affiliates and service providers, some of whom may be in other countries.
Circumvention of U.S. law
Another part of the Temu controversy involves claims that the company is getting around U.S. law.
The old de minimis exemption was a legal customs rule, not an illegal practice. Still, a bipartisan House Select Committee found in 2023 that Temu’s business model depended on this exemption, which meant direct shipments faced less customs scrutiny. The committee also noted that Temu lacked an auditing system to verify compliance with the Uyghur Forced Labor Prevention Act, aside from requiring suppliers to agree to terms prohibiting forced labor.
The committee also said Temu did not ban third-party sellers based on whether their goods came from Xinjiang, and warned there was an "extremely high risk" of forced labor in the supply chain. These findings came from a congressional investigation, not a criminal conviction, but they matter when considering whether very cheap goods might have hidden risks.
A 2024 CSIS report raised more concerns about Temu. It focused on three main issues: navigating U.S. regulations, collecting large amounts of user data, and Temu’s ties to a company founded in China. CSIS said the app’s possible access to user information should get more attention from federal authorities.
Temu, user privacy, and data collection
The best way to look at Temu is to separate the data it openly collects from the data that lawsuits claim it collects without users knowing.
Temu already collects a lot of information, including account details, purchases, payment info, addresses, browsing and search activity, advertising IDs, device details, approximate location, customer service messages, and diagnostic data, according to its U.S. policy. Apple also says the iOS app may collect your exact location in some cases.
The main dispute is over claims that Temu has accessed even more data without users really knowing or agreeing. These claims are now the focus of several state lawsuits.
Can Temu steal your sensitive data?
It’s important to be clear here. There is no proof that Temu has secretly stolen all the sensitive information claimed by U.S. attorneys general. Lawsuits make serious accusations, but these are not the same as facts proven in court.
Some complaints describe actions that would be very worrying if proven. For example, Arizona’s attorney general says Temu can get your exact location, access your phone’s microphone and camera, and monitor what you do in other apps without real consent. Arizona also claims its investigation found code and behavior similar to malware or spyware, including features that make security checks harder. Temu denies these allegations.
Nebraska’s June 2025 case also accuses the app of using malware-like methods to circumvent security measures and collect phone data. Oklahoma’s May 2026 lawsuit makes similar claims about access to location, microphones, cameras, and other app activity. Again, these are government accusations still being argued in court, not proven facts.
CSIS also gave strong warnings about Temu in 2024, saying its possible device access and large-scale data collection could be a national security issue and need government action. This report shows the concern is serious, but CSIS is a policy group, not a court or regulator, and has not ruled that every Temu app acts like malware.
The most significant privacy enforcement we found was in South Korea. That case confirmed violations related to cross-border data handling and seller identity checks, but it did not prove all the malware claims now seen in U.S. complaints.
If you have Temu installed and worry your device might have malware, adware, or other unwanted programs, it's better to run a full security scan than to guess based on battery drain or pop-ups. We suggest using Combo Cleaner, which our tests showed can detect many types of threats like trojans, information stealers, ransomware, and adware. While a clean scan won't confirm or deny Temu's data collection, it can help you find other malicious software on your device.
Made by RCS LT, the company behind PCrisk- Detect malware already on the device
- Block phishing pages once you open them
- Remove adware or browser hijackers
- Scans for free and shows what it finds
- Removes it with a licence, 7-day free trial
- Blocks scam and phishing sites in the browser (Windows)
Why is Kentucky suing Temu?
On July 17, 2025, Kentucky Attorney General Russell Coleman sued Temu and related companies. The state claims they collected data unlawfully, violated privacy, acted deceptively, and sold counterfeit goods. The lawsuit also raises concerns about malware in the Temu app and possible exposure of users' personal information through the company's business ties.
This lawsuit matters because it shifted the conversation from a theoretical security issue to a real consumer protection concern for the state. Kentucky was not the only state to take action.
Which other states are suing Temu?
By October 2, 2026, at least seven states had filed consumer protection lawsuits against Temu or related companies: Arkansas, Nebraska, Kentucky, Arizona, Texas, Oklahoma, and Iowa. While the details vary, most cases focus on data collection, consumer deception, product claims, intellectual property, and concerns about data security linked to China.
In August 2024, 21 state attorneys general, led by Montana, asked Temu for information about its data practices, possible ties to the Chinese Communist Party, and forced-labor concerns.
PIRG later pointed out that state enforcement grew when Kentucky joined the lawsuit in July 2025. After that, Arizona, Texas, Oklahoma, and Iowa also filed cases.
There has also been federal action not related to the malware claims. In September 2025, Temu agreed to pay a $2 million fine to settle Justice Department and Federal Trade Commission claims that it broke the INFORM Consumers Act. The agencies said Temu did not clearly show information about some high-volume sellers and did not always provide ways for consumers to report suspicious activity. The settlement also required Temu to follow new compliance rules.
Risks to consider when shopping on Temu
Privacy is only one part of the risk calculation.
The first thing to watch out for is behavioral profiling. Temu can compile your account details, searches, product views, shopping cart activity, purchases, email interactions, device IDs, and advertising data. While each piece of data might seem normal for online shopping, combining them gives Temu a very detailed view of what you like and how you shop. Temu uses this information for things like personalization, marketing, analytics, and targeted ads.
The next concern is what the mobile app can access. According to Apple, Temu may collect precise and general location, payment data, user content, search history, usage details, and diagnostics tied to your identity. Some U.S. states have claimed Temu accesses even more than this, but those claims are still being debated.
The third issue is product safety and quality. In 2026, the European Commission fined Temu EUR 200 million under the Digital Services Act because Temu did not properly check for illegal products. The investigation found safety problems with some chargers and baby products. So, shoppers should be extra careful with items that could pose a safety risk, like chargers, electrical devices, children's products, protective gear, and health-related goods.
The fourth concern is about seller transparency and fake or misleading products. State attorneys general have accused some sellers of selling counterfeits, providing inaccurate descriptions, using deceptive promotions, and misrepresenting prices. In 2025, a federal case under the INFORM Consumers Act focused on ensuring that high-volume sellers provide accurate information and that consumers have ways to report problems.
Finally, there is a risk in the supply chain. A House Select Committee investigation found that Temu did not have a good system to check for forced labor in its supply chain. This does not mean every Temu product was made with forced labor, but it does give shoppers a real reason to wonder about the source of very cheap products.
Customer protection measures and tips for shopping safely on Temu
Temu does offer some standard consumer protections. In the U.S., you can usually return eligible items within 90 days of buying them, though some electronics have shorter return windows depending on the seller. The first return for each order is usually free, unless there are exceptions. Temu also says its Purchase Protection program gives refunds for orders that do not arrive or get lost.
For privacy and security, Temu says it uses technical and organizational controls, adheres to PCI DSS requirements for handling card information, stores U.S. user data on U.S. cloud servers, and offers privacy options to eligible users. Google Play also says users can request that their collected data be deleted.
These protections help, but they do not remove all the risks mentioned earlier. Here are five precautions we suggest.
1. Try using the website instead of downloading the app. The website can still collect your account activity, location based on your IP address, cookies, searches, purchases, and other browsing data, but using a browser limits the app’s access to your phone’s permissions.
2. Only allow permissions you really need. Do not give a shopping app ongoing access to your exact location, photos, camera, or microphone unless you know why it needs them. Apple’s disclosure shows that the iOS app may process your location and user content.
3. Share as little personal information as possible. Do not upload medical records, ID documents, photos, or other sensitive items unless it is truly necessary. Temu’s policy notes that customer service messages may include highly sensitive health and medical information.
4. Use a separate email just for shopping and do not reuse passwords. It is also safer to use a credit card or a virtual payment method instead of your main debit card. Temu says it collects the payment details required for purchases and adheres to PCI DSS standards for credit card data.
5. Remember, a VPN does not stop Temu from tracking you on its own platform. A VPN can help protect your network privacy, especially on public Wi-Fi, but it cannot block Temu from recording your searches, purchases, account details, or anything you enter on the site. According to PCrisk’s 2026 tests, NordVPN is ranked first and Surfshark VPN second. A VPN is just an extra privacy tool, not a fix for app permissions or data collection by Temu.
Conclusion
So, is Temu safe in 2026? If you only shop there occasionally, you can use Temu without worrying that just installing it will harm your phone. However, we do not see it as a privacy-friendly platform, and you should pay attention to its regulatory and legal history.
It is important to separate concerns from proven facts. Temu admits it collects a wide range of information, including account, payment, transaction, search, browsing, device, advertising, location, customer support, and diagnostic data. Apple’s privacy disclosure also says the iOS app may collect precise location. South Korea’s privacy regulator has already fined Temu for breaking privacy laws. These are all documented facts.
Some claims go further, such as saying Temu acts like malware or secretly uses microphones, cameras, GPS, or other app data. Several U.S. states have made these accusations. We think these claims are serious and could affect the choices of privacy-focused users, but they are still just allegations until a court or independent authority confirms them.
Privacy is not the only thing to worry about. The European Commission’s 2026 action shows that Temu’s product safety controls have also been lacking. Earlier U.S. congressional reports also raised big questions about customs checks and forced-labor compliance.
If you want to keep shopping on Temu for the low prices, we suggest a simple approach. Use the browser when possible, share as little personal information as you can, block any permissions you don't need, and use a unique password and a separate email just for shopping. Don't save payment details you don't need, and be extra careful with products that affect your safety. If you decide to stop using Temu, it's better to request account and data deletion instead of just uninstalling the app.
So, Temu isn't just a simple "scam," but we also don't recommend giving it full access to your smartphone. In 2026, the best approach is to use Temu carefully and share as little data as possible.
Our top pick of the year: almost no slowdown in our speed tests, and it unblocked Netflix, BBC iPlayer and Disney+ without trouble. $3.39/mo on the 2-year plan or $4.99/mo on the 1-year plan, 30-day money-back guarantee. Compare all three
Frequently asked questions (FAQs)
Why are the prices on Temu so low?
Temu connects shoppers with many sellers and uses centralized logistics and warehouses for some of its operations. In the U.S., Temu used to benefit greatly from direct, low-value shipments that qualified for the de minimis exemption, which reduced duties and customs processing costs. Congressional investigators pointed out that this exemption was a key part of Temu's earlier cost structure.
A low price doesn't always mean a product is fake or unsafe. Still, the European Commission's 2026 findings and some state consumer-protection cases show that we should look more closely at very cheap products that are important for safety.
Is Temu affected by tariffs?
Yes, Temu has been affected by changes to U.S. import rules. The U.S. first removed duty-free de minimis treatment for shipments from China and Hong Kong, then later suspended this exemption for low-value shipments from all countries. An executive order in February 2026 kept this suspension in place.
Tariff policy is still changing. By late September 2026, the U.S. and China had agreed to lower tariffs on about $60 billion in goods. This includes some Chinese toys, children's products, small appliances, and other items. They also extended their trade truce until January 10, 2027, so Temu product prices may continue to change.
Is it safe to use my credit card on Temu?
Temu says it complies with PCI DSS standards when handling credit card information. Its privacy policy explains the steps it takes to protect your personal data. Temu also uses payment processors for transactions, disputes, and refunds.
Still, it's best to limit your financial risk on any marketplace. Try to use a credit card, a virtual card number, or another payment method that keeps your main debit account safe instead of saving extra payment details. Make sure to turn on transaction alerts and check your statements after you shop.
Is the Temu app malware or spyware?
Right now, there is not enough solid evidence to say for sure that the official Temu app is malware or spyware. Some state attorneys general, like those in Arizona, Nebraska, Kentucky, and Oklahoma, have filed complaints about possible malware or hidden data collection. Arizona says its investigators did a forensic review to back up its claims. CSIS has also issued strong warnings about how much data the app might access.
These cases are still just allegations until a court or regulator makes a final decision. What we do know is that Temu collects a lot of personal and behavioral data according to its own privacy policy. Also, South Korea has already fined Temu for breaking privacy laws in other cases.
Is it safer to use Temu in a browser than the app?
If you want to limit data collection, it's usually better to use the browser. Temu's website still tracks your browsing, searches, orders, device details, cookies, and your general location from your IP address, so you won't be completely anonymous.
The main benefit is that your device is less exposed. Using a browser means the Temu app does not get its own space on your phone or ongoing permissions. Since Apple's privacy info says the Temu app might access your exact location and different types of user content, and because there are still open questions about what else the app can access, people who only shop on Temu once in a while have a good reason to avoid installing the app.
Share:
Facebook
X.com
LinkedIn
Copy Link
Rimvydas Iliavicius
Researcher, author
Rimvydas is a researcher with over four years of experience in the cybersecurity industry. He attended Kaunas University of Technology and graduated with a Master's degree in Translation and Localization of Technical texts. His interests in computers and technology led him to become a versatile author in the IT industry. At PCrisk, he's responsible for writing in-depth how-to articles for Microsoft Windows.
▼ Show Discussion