• Temu is being sued in the American state of Arkansas, with allegations that it spies on user activity.
• The lawsuit suggests that Temu was built on the Pinduoduo app, which was removed from the Google Play Store after it was found to exhibit malware-like behaviour.
• These include collecting data on user activity, read private messages, check notifications and even prevent itself from being uninstalled.

In a few months, shopping app Temu quickly exploded in popularity worldwide over its affordable product market, but this popularity has also garnered widespread scrutiny. The app and by extension the company, is facing legal issues in Europe over the origin of its many products, and now a US Attorney General is seeking to take Temu to court.

According to a report from Ars Technica, citing a lawsuit filed on Tuesday this week, the Attorney General of Arkansas Tim Griffin is alleging that Temu, the mobile app, is a “dangerous malware” that can “gain unrestricted access to a user’s phone operating system, including, but not limited to, a user’s camera, specific location, contacts, text messages, documents, and other applications.”

Griffin in the lawsuit runs through a gamut of reports that he believes provide evidence to these claims.

In the lawsuit, Griffin alleges that Temu’s owner PDD (Pinduoduo) Holdings was founded by a former Google Employee, Colin Huang, who after founding the platform in China, relocated the businesses to Ireland in the hopes of “obscuring its connections to China” following “a growing chorus of geopolitical and privacy concerns.”

Before the platform became Temu, the first version of the shopping app was called Pinduoduo, which Griffin says was removed from the Google Play Store “after malware issues were found on the app.”

He writes that independent researchers found that the Pinduoduo source code was designed to bypass a user’s cell phone security in order to monitor activity on other apps, check notifications, read private messages and change settings, all without asking for permission from the user.

Moreover, once the app was installed, it could run itself in the background and prevent itself from truly being uninstalled. Talk about a real boogeyman app, but the claim was also covered by CNN in a 2023 report.

Pinduoduo then became Temu, when the company built the Temu marketplace on the Pinduoduo platform, the lawsuit claims. A majority of the research covered in the lawsuit emerges from US-based Grizzly Research, and specifically another 2023 report.

“TEMU app software has the full array of characteristics of the most aggressive forms of malware /spyware,” the researchers allege.

“The app has hidden functions that allow for extensive data exfiltration unbeknown to users, potentially giving bad actors full access to almost all data on customers’ mobile devices,” they add.

“The allegations in the lawsuit are based on misinformation circulated online, primarily from a short-seller, and are totally unfounded,” Temu’s spokesperson told Ars Technica in a statement.

“We categorically deny the allegations and will vigorously defend ourselves,” they add.

“We understand that as a new company with an innovative supply chain model, some may misunderstand us at first glance and not welcome us,” Temu’s spokesperson explained.

“We are committed to the long-term and believe that scrutiny will ultimately benefit our development. We are confident that our actions and contributions to the community will speak for themselves over time.”

Notably, the Arkansas lawsuit makes note of the state of Montana’s banning of other apps found by “foreign adversaries” such as TikTok, WeChat and Telegram (representing China and Russia). US lawmakers have a history of legally attacking Chinese apps out of fears of being spied on by the Chinese government.

One of these efforts is culminating in the banning of TikTok in the US, which is being done without a shred of concrete evidence that the app is foreign spyware or a psy-op to mind control American teens.