Is China's Temu a data security threat for shoppers?

Do billionaires buy dresses for $9.99 (€9.25)? Or smartwatches for $15?

When Temu made its Super Bowl ad debut in early 2023, many American Football fans may have wondered since the shopping app promised "shopping like a billionaire."

At the time, nearly 11 million Americans already knew what Temu was and had downloaded the app. Many had already used the online marketplace to buy discounted clothing or household goods from China-based vendors that ship directly from the manufacturers.

Available in the US since September 2022, the e-commerce platform has made quick strides. In its first month online, Temu had 4.5 million monthly active users in America. By July, it racked up 77.3 million monthly active users, more than double the number it had at the start of the year, according to consulting firm GWS Magnify. 

What's more, the app is reveling in significant engagement. "Users [in America] are currently spending nearly 10 minutes longer on the Temu app each day than Amazon and Shein," said GWS Magnify CEO Paul Carter. That may not seem like a lot, but added together such engagement levels show the company's potential to become a serious competitor.

Prices too good to be true?

In the past few months, Temu has launched in a number of other places besides the US. Today it is available in 39 countries around the globe — from Europe to Japan and Australia.

The platform lures shoppers with rock-bottom prices since it cuts out the middlemen with a factory-to-consumer business model. Temu is a new option just as consumers are being hit with post-pandemic inflation and other higher costs, says Bruce Winder, a Toronto-based retail analyst and author.

"Temu offers new low price points that are traditionally not found in Western retail and access to an enormous assortment," Winder told DW. "It offers a factory direct model and on the surface screams value at a time when significant inflation on food, housing and gas take much of what consumers earn." 

Still, the app depends heavily on timed sales, discounts and giveaways to push impulse purchases. Since launching they also invested in online advertising and encouraging influencers to post "haul videos" that show what they bought and make recommendations.

Lots of packages and CO2

Temu's success has led to criticism from environmental activists because of a flood of cheap goods and wasteful fast fashion. Shipping individual packages around the world adds to global CO2 emissions.

Lax American regulations, in particular, make this possible. Most packages sent to the US with a value under $800 are not subject to tariffs. That means if a company bought a box with 10,000 shirts it would pay an import tax. If all those 10,000 shirts were sent separately, no tax would be due. Other countries are not nearly as generous with duty-free packages.

US customs data shows that more than 10% of Chinese imports by value are now sent directly to customers, up from under 1% a decade ago.

In 2021, the Federal Reserve Bank of New York estimated that the US loses as much as $10 billion a year in tariffs this way, according to a report issued in April by the US-China Economic and Security Review Commission.

The report highlighted other concerns with Temu like copyright infringement accusations and poor quality.

Chinese influence and national security

But it is not mini prices, environmental concerns or counterfeits that worry government hawks the most. It is cybersecurity and user data.

US-China relations are at a low point and American officials are unhappy about consumer data being hoovered up by companies like Temu, Shein and TikTok. Over the past year, there have been numerous calls to ban or restrict TikTok over national security concerns. And Chinese technology has been blocked from many infrastructure projects in the West like 5G networks.

Temu is owned by PDD Holdings, which also owns Pinduoduo, a Chinese online retailer. In its 2022 "Notorious Markets for Counterfeiting and Piracy" report, the Office of the United States Trade Representative gave Pinduoduo its own section. In March, the Pinduoduo app was removed from the Google Play Store because of suspected malware.

This scrutiny has led Temu to distance itself from its parent company and from China. For US customers, it moved operations to Boston. For the rest of the world, it registered in Ireland. Whether this really keeps user data out of China is not clear.

It's nearly impossible to guarantee data won't end up in China, says Lindsay Gorman, head of the German Marshall Fund's technology and geopolitics team. For her, the key question is what kind of data.

"All technology platforms to one extent or another recognize data as a strategic asset," she told DW. "Chinese platforms have just been more brazen about snooping on users."

When price rivals privacy

Though Temu's website notes that "all data will be encrypted," experts like Gorman call for more transparency, particularly when it comes to the way it tracks users.

"The Chinese Communist Party's quest for global technology leadership is fueled by data and cyber-enabled espionage. E-commerce platforms are no exception," said the Washington, D.C.-based expert who recently served as a senior adviser in the White House. 

Though Gorman sees purchasing patterns on Temu as less sensitive than videos or messages on TikTok, the biggest data security risk here is mission creep. "Why does an e-commerce platform need access to Bluetooth and Wi-Fi network information? That is the real privacy concern," she said.

Yet as countries worry about reliance on Chinese technology, customers are flocking to it. In most cases abstract ideas of privacy, poor labor standards and environmental protection are overruled by low prices, says Bruce Winder.

"I think many consumers are willing to take a chance on privacy risk and turn a blind eye to other potential societal risks because they are desperate financially."

Edited by: Uwe Hessler