Arizona Becomes 4th State to Sue Temu Over “Malware” App That “Steals” User Data – What You Need to Know

BREAKING (December 2, 2025): Arizona Attorney General Kris Mayes filed a major consumer fraud lawsuit against Temu on December 2, 2025, accusing the Chinese shopping app of operating as “malware and spyware” that secretly harvests sensitive user data without consent. Arizona joins Arkansas, Kentucky, and Nebraska in suing Temu over privacy violations. The lawsuit also alleges Temu sells counterfeit versions of Arizona brands including the Arizona Cardinals, ASU, U of A, NAU, Ping golf clubs, and Taser stun guns.

Temu faces multiple active lawsuits across the country as of December 2025, including four state attorney general cases, federal class action lawsuits over data privacy, and a September 2025 settlement with the Department of Justice requiring $2 million in penalties for violating federal consumer protection laws. Temu denies all allegations and says it will defend itself vigorously.

This guide covers all current Temu lawsuits, what users need to know, Arizona AG’s urgent warning to delete the app immediately, and what happens next.

What Is the Temu Lawsuit About?

Temu faces multiple lawsuits alleging the shopping app operates as spyware that illegally collects massive amounts of user data far beyond what’s needed for online shopping.

The Core Allegations Across All Lawsuits:

• Temu’s app secretly infiltrates users’ devices with malware and spyware
• The app bypasses device security settings to access sensitive information
• Temu collects data including GPS location, camera, microphone, contacts, and activity on other apps
• Data collection happens without users’ knowledge or consent
• The app can modify its own code after download to hide data collection
• Temu shares user data with its China-based parent company PDD Holdings
• Chinese law requires companies to hand over data to the government
• Temu engages in deceptive trade practices and false advertising
• The company sells counterfeit products and uses fake reviews

Latest Update: Arizona Files Fourth State Lawsuit (December 2, 2025)

Arizona Attorney General Kris Mayes announced the lawsuit at a press conference on December 2, 2025, calling Temu a “data-theft business that sells goods online as a means to an end.”

What Arizona’s Lawsuit Claims:

Illegal Data Collection:

The lawsuit alleges Temu “secretly infiltrates users’ devices to access and harvest sensitive information,” including:

• Precise physical location (accurate to within a couple of feet)
• Phone microphone and camera access
• Private activity on other apps installed on the phone
• User contacts and communications
• Personally identifiable information far beyond shopping needs

Malware Functionality:

According to Arizona’s forensic investigation, the Temu app:

• Hides how it collects private information from users and researchers
• Edits its own code after download to exploit user data
• Potentially controls the user’s device “in unknown and unknowable ways”
• Tracks location on a granular level
• Steals personal information even from computer users on Temu’s website

Deceptive Trade Practices:

The lawsuit also alleges Temu:

• Advertises items that look nothing like what arrives
• Uses “false reference pricing” by inflating “full prices” to make discounts look better
• Charges for goods not ordered or not delivered
• Refuses refunds on defective items
• Uses bait-and-switch schemes promising prizes that never arrive
• Creates fake customer reviews

Counterfeit Products:

Arizona’s lawsuit specifically cites counterfeit versions of:

• Arizona Cardinals merchandise
• Arizona State University apparel
• University of Arizona clothing
• Northern Arizona University gear
• Ping golf clubs (Arizona-based)
• Taser stun guns
• Fender Guitars

Forced Labor:

The lawsuit mentions U.S. government concerns and Los Angeles Times reports that merchandise on Temu is produced by forced labor of China’s Uyghur minority in labor camps.

Case Details:

• Filed: December 2, 2025
• Court: Maricopa County Superior Court, Arizona
• Plaintiff: Arizona Attorney General Kris Mayes
• Defendants: Temu (WhaleCo Inc.) and PDD Holdings Inc.
• Violations alleged: Arizona Consumer Fraud Act
• Status: Active litigation, just filed

Mayes’ Urgent Warning to Arizonans:

“Arizonans should be aware that behind Temu’s low prices and shiny advertising, there is real danger. The Temu app can infect users’ devices with malware to steal their private data while carefully hiding its tracks.”

Mayes urged Arizonans to:

1. Delete their Temu accounts
2. Uninstall the app immediately
3. Scan devices for malware
4. Consider resetting phones (deleting the app alone may not stop tracking)

Arkansas: First State to Sue (June 25, 2024)

Arkansas Attorney General Tim Griffin filed the first state lawsuit against Temu on June 25, 2024, calling it a “first-of-its-kind state lawsuit.”

Griffin’s Statement:

“Temu is not an online marketplace like Amazon or Walmart. It is a data-theft business that sells goods online as a means to an end. Though it is known as an e-commerce platform, Temu is functionally malware and spyware.”

Key Claims:

• Violations of Arkansas Deceptive Trade Practices Act (ADTPA)
• Violations of Arkansas Personal Information Protection Act (PIPA)
• Purposefully designed to gain unrestricted access to phone operating systems
• Overrides data privacy settings on users’ devices
• Monetizes unauthorized data collection

National Security Concerns:

Griffin noted that “Temu is led by a cadre of former Chinese Communist Party officials, which raises significant security risks to our country and our citizens.”

Court: Cleburne County Circuit Court, Arkansas Status: Active litigation pending

Nebraska: Second State Lawsuit (June 11, 2025)

Nebraska Attorney General Michael Hilgers filed suit on June 11, 2025, after conducting a state investigation into Temu’s software.

What Makes Nebraska’s Case Unique:

Unlike Arkansas, Nebraska conducted its own independent forensic investigation of Temu’s software before filing suit.

Claims:

• Violations of Consumer Protection Act (CPA)
• Violations of Uniform Deceptive Trade Practices Act (UDTPA)
• Silently collects users’ sensitive information
• Manufactures products that infringe on intellectual property of Nebraska companies
• National security threat due to Chinese government access to data

Status: Active litigation pending

Kentucky: Third State Lawsuit (July 17, 2025)

Kentucky Attorney General Russell Coleman became the third state attorney general to sue Temu on July 17, 2025.

Claims: Similar to Arkansas and Nebraska cases, alleging data privacy violations, malware, deceptive practices, and collecting sensitive data from minors.

Status: Active litigation pending

Federal DOJ Settlement: $2 Million Penalty (September 2025)

The U.S. Department of Justice and Federal Trade Commission announced on September 8, 2025, that Temu agreed to pay $2 million in civil penalties to settle violations of the INFORM Consumers Act.

What Is the INFORM Consumers Act?

The law requires online marketplaces to:

• Clearly disclose identifying information about high-volume sellers
• Provide mechanisms for consumers to report suspicious activity electronically and by phone

What Temu Did Wrong:

According to the federal complaint filed in U.S. District Court for the District of Massachusetts:

• Failed to disclose seller addresses and other required information
• Did not provide required reporting mechanisms on gamified product listings
• Failed to offer telephonic reporting mechanisms on non-gamified listings
• Made disclosures difficult to find when they were provided
• Violated requirements for both mobile app and website

The Settlement:

• $2 million civil penalty
• Must provide telephonic mechanism for reporting suspicious activity
• Must make all required disclosures going forward
• Ongoing compliance monitoring

Significance: This was the first enforcement case filed under the INFORM Consumers Act.

Federal Class Action Lawsuits: Data Privacy

Multiple class action lawsuits remain active in federal courts alleging Temu violates user privacy through massive data collection.

New York Federal Lawsuit (Filed September 20, 2023)

Case: Eric Hu v. WhaleCo, Inc. d/b/a Temu Court: U.S. District Court for the Eastern District of New York Status: Ongoing litigation

Claims:

• Temu compromises phones as soon as users install the app
• Bypasses data privacy settings
• Nullifies user control over data
• Infiltrates virtually every aspect of users’ phones

Illinois Federal Lawsuit (Filed 2023, Amended February 2024)

Original Filing: Filed in 2023 with initial privacy claims

Amended Complaint (February 2024): Added 12 additional plaintiffs and expanded to 131 pages

Claims:

• Violates Illinois and other state consumer protection laws
• Violates state privacy laws
• Collects data through “deceptive” and “unscrupulous” practices
• App “purposefully and intentionally loaded with tools to execute virulent and dangerous malware and spyware”
• Secretly shares “vast quantities of private and personally identifiable user data” with China-based parent company PDD Holdings
• Data collection goes “beyond what is necessary for an online shopping app”
• Gives Temu access to “literally everything on your phone”

Current Status: Temu filed a motion to compel arbitration, arguing users agreed to arbitration in the app’s terms and conditions.

Florida Federal Lawsuit (Dismissed 2024)

A Florida federal court dismissed a class action lawsuit against Temu after finding the arbitration provision in the user agreement was valid and users were bound by it.

This precedent strengthens Temu’s defense in other cases where it seeks to force arbitration instead of court proceedings.

Spam Text Message Lawsuits

Temu has faced multiple class action lawsuits alleging it sent unsolicited marketing texts to consumers on the National Do Not Call Registry.

July 2024 TCPA Lawsuit (Voluntarily Dismissed)

Filed: July 2024 Claims: Violations of Telephone Consumer Protection Act (TCPA) Status: Voluntarily dismissed by plaintiffs in August 2024

March 2025 TCPA Lawsuit (Voluntarily Dismissed)

Filed: Date unknown, dismissed March 10, 2025 Court: Federal court (specific district not disclosed) Claims: Two consumers alleged receiving unsolicited texts despite being on National Do Not Call Registry since 2010 Status: Plaintiffs notified court in December 2024 they reached settlement; formally dismissed March 10, 2025

October 2024 TCPA Lawsuit (Active)

Filed: October 3, 2024 Court: U.S. District Court for the District of Massachusetts Plaintiffs: New Jersey and Michigan residents

Claims:

• Temu sent promotional texts “at all hours of the day”
• No authorization or consent obtained
• Plaintiffs’ numbers on National Do Not Call Registry since August 2010
• Violations of TCPA automated calling provisions

Seeks to Represent: Anyone in the U.S. who received more than one promotional Temu text within 12 months, more than 30 days after registering on National Do Not Call Registry (past four years)

Status: Active litigation; plaintiffs requested jury trial

What Temu Says: Company’s Response

Temu has consistently and vigorously denied all allegations across all lawsuits.

Official Statement (December 2025):

“Temu denies the allegations in the lawsuit and will defend itself vigorously. We help consumers and families access quality products at affordable prices. We work to keep costs down and maintain reliable supply so people can meet their needs without stretching their budgets. We also create growth opportunities for businesses by offering a low-cost alternative to traditional gatekeepers. By providing another route to market, we return power and choice to local players, small and medium-sized businesses, and consumers.”

Earlier Statement (March 2024):

Temu issued a statement denying allegations and recognizing “the need for greater transparency” in its practices.

Regarding Privacy Lawsuit Claims:

A Temu spokesperson called the lawsuits “meritless” and stated: “The complaints parrot a report put out by a short-seller, calling itself Grizzly Research, which has an obvious incentive to try to drive down Temu’s stock price through misinformation.”

Legal Defense Strategy: Forcing Arbitration

Temu’s primary legal defense strategy involves forcing plaintiffs into arbitration instead of court proceedings.

How Arbitration Works:

When users sign up for Temu, they agree to terms and conditions requiring disputes be resolved through private arbitration rather than public courts.

Benefits to Temu:

• No public court filings
• Faster resolution than courts
• No class action proceedings
• Less media coverage
• Lower legal costs

Success in Florida:

A Florida federal court already found Temu’s arbitration clause valid and dismissed a class action lawsuit, setting precedent for other cases.

Current Arbitration Motions:

Temu has filed motions to compel arbitration in the Illinois federal lawsuit and potentially other cases.

What This Means for Temu Users

If you’ve downloaded the Temu app or made purchases on Temu’s website, here’s what you need to know:

Immediate Actions Recommended by Arizona AG:

1. Delete your Temu account
2. Uninstall the app immediately
3. Scan your device for malware
4. Consider resetting your phone (deleting the app alone may not stop tracking)

Why These Steps Matter:

According to state investigations, Temu’s app can:

• Continue collecting data even after typical app deletion
• Have embedded its code into your device’s operating system
• Track your location, access camera and microphone
• Monitor activity on other apps
• Harvest contacts, messages, and sensitive information

Data Already Collected:

If you’ve used Temu, the company may already have:

• Your precise GPS location history
• Access logs to your camera and microphone
• Your contacts list
• Your activity on other apps
• Your personally identifiable information
• Your financial information from purchases

Chinese Government Access:

Multiple state attorneys general warn that:

• Temu is owned by China-based PDD Holdings
• Chinese law requires companies to hand over data when requested by the government
• Your data could be accessed by Chinese intelligence apparatus
• This creates national security risks

National Security Concerns

Congressional and federal officials have raised serious national security concerns about Temu.

Congressional Action:

Florida Congressman Brian Mast called on the Federal Trade Commission to investigate Temu’s ties with the Chinese Communist Party in April 2024.

U.S.-China Economic and Security Review Commission:

Released a brief on April 14, 2024, outlining numerous concerns about Temu and recommending Congress take immediate action.

Apple’s Response:

Apple suspended Temu from its digital app store in 2023, prompting multiple investigations into the company’s practices.

Ongoing Federal Investigations:

The U.S. government continues investigating Temu’s data collection practices and national security implications.

Can You Join a Class Action Lawsuit?

Multiple class action lawsuits are currently seeking members.

You May Qualify If:

For Data Privacy Lawsuits:

• You downloaded and used the Temu app
• Your personal data may have been collected without consent
• You believe your privacy rights were violated

For Spam Text Lawsuits:

• You received unsolicited promotional texts from Temu
• You never provided consent to receive texts
• Your phone number is/was on National Do Not Call Registry
• You received multiple texts within 12 months

How to Join:

Law firms including Potter Handy, LLP are actively recruiting potential plaintiffs. However, Temu is fighting to force arbitration, which would prevent class action proceedings.

Arbitration Consideration:

If you signed up for Temu, you likely agreed to arbitration in the terms and conditions. This means:

• You may be required to pursue individual arbitration
• Class action participation may not be available
• Courts may enforce the arbitration agreement

What Happens Next?

State Attorney General Cases:

All four state cases (Arizona, Arkansas, Kentucky, Nebraska) are in active litigation. These cases will proceed through:

1. Discovery Phase: Gathering evidence, documents, depositions
2. Motion Practice: Defendants will likely file motions to dismiss
3. Settlement Negotiations: Possible at any stage
4. Trial: If no settlement reached

Timeline: State AG cases typically take 1-3 years to resolve.

Federal Class Actions:

Cases in New York and Illinois federal courts continue, though Temu is fighting to force arbitration.

Possible Outcomes:

• Courts grant Temu’s arbitration motions (cases dismissed from court)
• Courts deny arbitration (cases proceed to discovery and trial)
• Settlement reached before trial

TCPA Spam Text Lawsuit:

The October 2024 Massachusetts case proceeds toward trial unless settled. Plaintiffs requested a jury trial.

Congressional Action:

Federal legislation targeting Chinese-owned apps and data collection practices may emerge, potentially affecting Temu’s operations.

Similar Cases: TikTok and Other Chinese Apps

Temu’s legal battles mirror concerns about other Chinese-owned apps, particularly TikTok.

Similarities:

• Chinese ownership and Communist Party ties
• Massive data collection beyond app functionality
• National security concerns about data access
• State and federal government lawsuits
• Congressional investigations
• Potential bans or forced sales

Arizona AG’s Comparison:

Attorney General Mayes called the allegations against Temu “more egregious than those that have been made against TikTok.”

Legal Framework: What Laws Are Involved?

The Temu lawsuits involve multiple federal and state laws:

Federal Laws:

INFORM Consumers Act:

• Requires online marketplaces disclose seller information
• Mandates reporting mechanisms for suspicious activity
• Enforced by DOJ and FTC
• Temu paid $2 million penalty for violations

Telephone Consumer Protection Act (TCPA):

• Prohibits unsolicited automated calls and texts
• Protects consumers on National Do Not Call Registry
• Violations subject to statutory damages

State Laws:

Consumer Protection Acts:

• Arizona Consumer Fraud Act
• Arkansas Deceptive Trade Practices Act
• Nebraska Consumer Protection Act
• Kentucky Consumer Protection Act

Privacy Laws:

• Arkansas Personal Information Protection Act
• Various state privacy statutes
• State laws protecting minors’ data

Deceptive Trade Practices:

• Uniform Deceptive Trade Practices Acts
• False advertising prohibitions
• Consumer fraud statutes

Expert Legal Analysis

Legal experts note several key issues in the Temu litigation:

Arbitration vs. Class Actions:

Temu’s arbitration defense could be highly effective if courts consistently enforce the user agreement provisions. However, some courts may find the arbitration clauses unenforceable if they’re deemed unconscionable or buried in fine print.

State vs. Federal Authority:

State attorneys general have broad authority to enforce consumer protection laws, and their cases can’t be forced into arbitration like private class actions. This makes the four state AG cases the most serious legal threat to Temu.

Proving Damages:

In privacy cases, plaintiffs must prove actual harm, not just data collection. This can be challenging unless they can show identity theft, financial losses, or other concrete damages.

National Security Arguments:

While national security concerns are politically powerful, they may not provide direct legal grounds for consumer lawsuits. However, they could influence federal regulatory action or Congressional legislation.

What If Temu Loses?

If Temu loses the state attorney general lawsuits or federal class actions, potential consequences include:

Financial Penalties:

• Multi-million dollar fines from each state
• Damages payments to class action members
• Restitution to affected consumers
• Attorney fees and court costs

Operational Changes:

• Required changes to app functionality
• Enhanced data protection measures
• Clear disclosure of data collection
• Consent requirements before data collection
• Independent monitoring and audits

Business Impact:

• Reputational damage affecting user growth
• Decreased app downloads
• Loss of existing users
• Difficulty competing with Amazon and other marketplaces
• Potential app store removal

Worst-Case Scenario:

• Forced sale of U.S. operations
• Ban on operating in the United States
• Criminal investigations for data theft
• Congressional legislation specifically targeting Temu

Protecting Yourself from Data Collection

Beyond deleting Temu, take these steps to protect your privacy:

Immediate Actions:

1. Review app permissions on your phone for all apps
2. Disable location services for apps that don’t need it
3. Turn off microphone and camera access for shopping apps
4. Review and limit ad tracking in phone settings
5. Use privacy-focused browsers and search engines
6. Enable two-factor authentication on important accounts

Ongoing Protection:

1. Read terms and conditions before downloading apps
2. Check privacy policies to understand data collection
3. Limit data sharing in app settings
4. Use VPNs to mask your location
5. Regularly audit installed apps and delete unused ones
6. Monitor financial accounts for suspicious activity
7. Consider identity theft protection services
8. Run malware scans regularly

For Temu Users Specifically:

1. Change passwords on accounts accessed on your device
2. Monitor credit reports for signs of identity theft
3. Watch for phishing attempts using collected data
4. Alert your bank if you made Temu purchases
5. Document any suspicious activity for potential legal claims

Frequently Asked Questions

Q: Should I delete the Temu app immediately? 

Arizona Attorney General Kris Mayes urges all users to delete Temu accounts, uninstall the app, scan for malware, and consider resetting phones. Three other state attorneys general have sued over similar concerns.

Q: What data has Temu collected from my phone? 

According to lawsuits, Temu’s app can access GPS location, camera, microphone, contacts, activity on other apps, and personally identifiable information. The full extent depends on your phone’s permissions and how long you’ve had the app.

Q: Can I join a class action lawsuit against Temu? 

Several class action lawsuits are active, but Temu is fighting to force arbitration based on user agreement terms. Contact class action attorneys to discuss your eligibility, but arbitration clauses may limit your options.

Q: Is it safe to buy from Temu’s website without the app?

Arizona’s lawsuit alleges that even website users can have personal information stolen. Additionally, Temu faces allegations of counterfeit products, fake reviews, and deceptive pricing practices regardless of purchase method.

Q: Will Temu be banned in the United States? 

Unknown. Four states have sued, and Congress is investigating, but no federal ban has been proposed yet. However, national security concerns similar to those facing TikTok could lead to future restrictions.

Q: What happens if I already agreed to arbitration in Temu’s terms? 

Courts may enforce the arbitration clause, requiring you to pursue individual arbitration rather than join class actions. However, state attorney general cases are not affected by arbitration clauses.

Q: Is my data already in Chinese government hands? 

Possibly. Multiple state attorneys general warn that Chinese law requires companies to hand over data when requested by the government. Temu is owned by China-based PDD Holdings.

Q: How do I know if Temu accessed my camera or microphone? 

Check your phone’s permission settings and privacy logs. iOS and Android both show which apps have accessed sensitive permissions. However, according to lawsuits, Temu can bypass these security measures.

Q: Can I get compensation if I’m affected? 

Potentially, if class action lawsuits succeed and you qualify. However, Temu is fighting these cases, and arbitration may limit compensation opportunities. State AG cases may result in restitution funds.

Q: Does deleting the app remove all of Temu’s access to my phone?

According to Arizona AG Mayes, deleting the app alone may not be enough. She recommends scanning for malware and potentially resetting your phone because the app may have embedded code in your operating system.

Q: Are other shopping apps doing the same thing?

Most legitimate shopping apps collect some user data, but experts say Temu’s alleged data collection goes far beyond industry norms. Major retailers like Amazon and Walmart face stricter U.S. regulations and oversight.

Q: What should I do if I’ve already made purchases on Temu?

Monitor your financial accounts for suspicious activity, change passwords, watch your credit reports, and consider identity theft protection. Document any financial losses for potential legal claims.

Key Takeaways

Current Legal Status (December 2025):

• Four state attorneys general have sued Temu (Arizona, Arkansas, Kentucky, Nebraska)
• Multiple federal class action lawsuits remain active
• Temu paid $2 million federal penalty in September 2025
• All state and federal cases are ongoing
• Temu denies all allegations

The Allegations:

• Temu’s app operates as malware and spyware
• Illegally collects massive amounts of user data
• Bypasses device security settings
• Accesses camera, microphone, location, contacts, other apps
• Shares data with China-based parent company
• Chinese government can access the data
• Sells counterfeit products
• Uses deceptive pricing and fake reviews

What Users Should Do:

• Delete Temu account immediately
• Uninstall the app
• Scan device for malware
• Consider resetting phone
• Monitor financial accounts
• Watch for identity theft
• Review all app permissions

What’s Next:

• State AG cases proceed through litigation (1-3 years)
• Federal class actions fight arbitration motions
• Congressional investigations continue
• Potential federal legislation targeting Chinese apps
• Possible app store removal or operational bans

National Security Concerns:

• Chinese ownership raises intelligence risks
• Data accessible to Chinese government
• Former CCP officials lead company
• Congressional investigations ongoing
• Potential TikTok-style restrictions possible

Last Updated: December 6, 2025

Sources: Arizona Attorney General official press release (December 2, 2025), Arkansas Attorney General press release (June 25, 2024), Department of Justice and FTC joint announcement (September 8, 2025), court documents from federal class action cases in New York, Illinois, and Massachusetts, verified reporting from Dark Reading, Detroit News, ABC15 Phoenix, Axios Phoenix, Fashion Dive, PIRG, ClassAction.org, and Arizona Capitol Times through December 3, 2025.

About the Author

Sarah Klein, JD, is a licensed attorney and legal content strategist with over 12 years of experience across civil, criminal, family, and regulatory law. At All About Lawyer, she covers a wide range of legal topics — from high-profile lawsuits and courtroom stories to state traffic laws and everyday legal questions — all with a focus on accuracy, clarity, and public understanding.
Her writing blends real legal insight with plain-English explanations, helping readers stay informed and legally aware.
Read more about Sarah