The U.S. state of Missouri filed a lawsuit against Temu on Tuesday (13), accusing the e-commerce platform of collecting personal information from cellphones without users' consent. The lawsuit also points to deceptive business practices and the sale of products that allegedly infringe trademarks in the United States.
The lawsuit, filed by Attorney General Catherine Hanaway, involves parent company PDD Holdings, operator Whaleco and Temu Payments. The state seeks a permanent injunction to stop the challenged practices, in addition to fines and restitution to consumers.
According to the petition, a technical investigation conducted by experts hired by Missouri identified mechanisms capable of obtaining users' location with precision of approximately 3 meters, lists of installed apps, accounts linked to the device and information about Wi-Fi networks.
The document also points to permissions to access the camera and microphone. The existence of these permissions, however, does not by itself prove that the app made recordings without authorization.
App could modify its code after installation
The main technical detail of the accusation involves the ability to change the app's operation without submitting certain updates for review by the official stores.
The investigation identified components called Manwe and ZipPatch, which, according to the state, allow modifying parts of the software after installation, bypassing the conventional verification processes of Google Play and the App Store.
The petition also maintains that Temu uses mechanisms to detect security analysis tools and make it harder to identify its activities. Part of the investigated code reportedly originated in Pinduoduo, another app from the PDD Holdings group that was suspended from Google Play in 2023 after the identification of malware.
Another point presented by investigators concerns location. The accusation states that, even during periods when the app did not declare certain GPS permissions on Android, it continued to obtain information capable of revealing users' location by other means.
These conclusions are part of the state's allegations and do not yet constitute final judicial findings.
The lawsuit also raises concerns about possible access by Chinese authorities to consumer data, due to PDD Holdings' operations in China and obligations under local legislation. The possibility of sharing, however, does not amount to proof that information was actually delivered to the Chinese government.
Missouri seeks a fine of US$ 1,000 per violation
In addition to the privacy-related accusations, the lawsuit challenges allegedly deceptive discounts, information about product quality and advertisements for merchandise without licensing from brands such as Kansas City Chiefs, St. Louis Cardinals, Kansas City Royals and Budweiser.
Based on state consumer protection law, Missouri seeks civil fines of US$ 1,000 per violation, in addition to refunding amounts to harmed consumers and paying the costs of the investigation.
The petition also requests an additional payment to the state equivalent to 10% of the total restitution determined, or another amount deemed appropriate by the court.
The document was filed in the Cole County Court on October 13. The amounts still depend on a court decision, and none of the requested penalties represents a judgment already imposed.
