A server’s address can tell us where information lives. It cannot, by itself, tell us whether that information is being treated responsibly.
That distinction matters as Texas announces a settlement with online retailer Temu. On October 16, Attorney General Ken Paxton’s office said the agreement requires Texans’ personal data to be stored on American-owned and controlled servers in the United States, with restrictions on access from China. The settlement also includes a $3 million payment to the state and product-safety requirements. [1]
Reuters independently reported the agreement and noted that Temu denied wrongdoing in the settlement documents. That denial matters: resolving allegations through a settlement does not establish that every allegation was proved. [2]
The published agreement deserves closer attention than the announcement alone. It permits certain access with specific consent and allows access to non-sensitive personal data for purposes including order fulfillment, fraud prevention and platform maintenance or improvement, subject to necessity and proportionality conditions. It also provides for annual independent app-security testing and assessments of specified sensitive-data protections. These are qualified restrictions, not a blanket prohibition on overseas access. [3]
Our position is that these controls are worth taking seriously—and that geography should be the beginning of the privacy discussion.
There are legitimate reasons to care about where data is stored and who can reach it. Different jurisdictions create different enforcement problems. An organization should be able to identify who controls its infrastructure and answer for the access it grants.
But an American server can still hold an unnecessarily detailed record of someone’s life. Domestic storage does not settle whether a business should have collected that information, whether employees need it, or whether keeping it serves the customer.
A privacy policy built around foreign access alone leaves those questions unresolved.
Consider an ordinary purchase. A seller needs enough information to take payment, deliver an item and handle a return. That practical need should shape the system. It should not become an open-ended justification for retaining every available observation about the shopper.
The appropriate test is purpose: what information is required to complete this task, who requires it, and when does that need end?
This is where exceptions become decisive. Businesses need workable rules. Fraud teams must investigate suspicious transactions, and engineers must diagnose failures. An absolute ban on operational access could obstruct legitimate work without delivering proportionate benefits.
Yet an exception for improving a platform can become expansive unless someone demands a concrete explanation. Improving delivery reliability is a different purpose from developing richer advertising profiles. Regulators should require businesses to distinguish them, identify the data each activity needs and explain why less intrusive alternatives are insufficient.
That is our recommendation for enforcement, not an allegation that Temu has already abused the agreement’s exceptions.
The settlement’s retention language also merits attention. It provides for quarterly identification of accounts inactive for 24 months and deletion of associated personal data, while allowing continued retention for specified purposes. It separately limits retention to reasonably necessary disclosed business purposes and other listed grounds. The exceptions mean inactivity does not guarantee that every record disappears. [3]
The public should be able to understand how such qualifications work in practice. If records remain after an account becomes inactive, there should be an accountable reason, a defined review process and an eventual endpoint where possible. Otherwise, a deletion promise can become difficult to evaluate from outside the company.
Independent assessments can help, but their value depends on the questions they ask. Checking whether prohibited code is present addresses one concern. Evaluating whether ordinary, disclosed collection is excessive addresses another. A system can faithfully follow its written policy while that policy still permits more collection than customers reasonably expect.
We would like to see privacy enforcement produce understandable public results: what categories of access were examined, what shortcomings were found, whether they were corrected, and which obligations remain unfinished. Sensitive technical details can stay protected without making the entire accountability process invisible.
None of this requires dismissing the Texas agreement. Specific restrictions, outside scrutiny and enforceable consequences are more useful than vague assurances. Their success, however, must be demonstrated through implementation. The announcement cannot establish future compliance.
The larger standard should apply to every retailer, regardless of where its parent company is based. Collect information for a defined purpose. Limit access to people who need it. Keep it only as long as justified. Make those commitments independently testable.
Questioning power means looking beyond the reassuring headline. Building better means designing a shopping system that needs less of our private lives in the first place.