Is Temu safe? Scam, privacy and payment questions answered separately

“Is Temu safe?” usually means one of three things, and the answers differ:

Arkansas, June 25, 2024. Attorney General Tim Griffin sued Temu’s parent companies, PDD Holdings and WhaleCo, under the Arkansas Deceptive Trade Practices Act and Personal Information Protection Act. The suit calls the app “functionally malware and spyware” and alleges it can override device privacy settings and collect data without authorization (Arkansas AG). Temu rejected the claims as unfounded.

Nebraska, June 12, 2025. Attorney General Mike Hilgers sued Temu and its affiliates, alleging that the app secretly installs malware that bypasses device security, that product descriptions and pictures are often wrong, that a made-up “market price” exaggerates discounts, that there is no meaningful return process, that counterfeit listings of Nebraska brands thrive, and that its “local” label really means stored in a US warehouse (Nebraska AG release).

Both are allegations in lawsuits. We have not seen a court rule that Temu’s app is malware, and Temu disputes the claims. Weigh them as serious accusations from state officials, not as proven facts.

On September 5, 2025 the FTC announced that Temu’s operator, Whaleco, would pay a $2 million civil penalty to settle allegations that it violated the INFORM Consumers Act, the law that requires large marketplaces to disclose information about high-volume sellers and give shoppers a way to report suspicious listings. The FTC alleged that Temu offered no phone line for reporting suspicious activity, offered no reporting option on its gamified listings until November 2024, and for a time did not clearly show required seller information (FTC press release). It was the first enforcement action under that law.

Temu’s privacy policy (last updated November 14, 2025 when we read it) lists account details, order and payment information, addresses, support chats, reviews and images you upload, device identifiers including advertising IDs, browsing, search and purchase history, and approximate location from your IP address. It also receives data from data providers, marketing partners and social media services (Temu privacy policy).

The policy says it shares data for targeted advertising. That may count as a “sale” under some state privacy laws. It also says US users’ data is stored with cloud providers in the US, though it may be shared with parties in other countries. None of that is unusual for a large retailer; the lawsuits are about whether the app collects more than the policy says.

1. Consider the website instead of the app. A browser tab gets far less access to your phone than an installed app. If you install the app, deny permissions it does not need, such as contacts, camera and precise location.
2. Pay with a credit card (or a virtual card number). The Fair Credit Billing Act lets you dispute goods not delivered as agreed; see online shopping scams for the 60-day rule.
3. Use a unique password and two-factor authentication on the account, and avoid signing in with Google or Facebook if you want to limit data sharing. A password manager makes unique passwords painless.
4. Opt out of targeted advertising in the app or site settings, and turn on your phone’s tracking limits (iPhone: Settings, Privacy & Security, Tracking).
5. Be careful with children’s products, electrical items and anything you put on your skin, where counterfeit or untested goods carry real risk. Check CPSC recalls for the product type.
6. Skip the games and invite-a-friend rewards if you do not want to share contacts or spend time collecting credits.