Reviewed Jun 2026 · some cells re-verified 9 Aug 2026 · policies are checked weekly for changes · stated — every cell is read from Temu's published policy; none has been tested (run by us) yet.
1Portabilitystated
Policy acknowledges the right to data in a "structured, commonly used and machine-readable format," but there is no widely-advertised official structured-export product (scored conservatively pending verification).
Temu Privacy & Cookie Policy · accessed Jun 2026 ↗
1Frictionstated
Request-based rather than instant: Temu's US addendum sets out the CCPA rights (access, delete, correct, opt out of sale or sharing) through a request flow that "may need to collect information from you to verify your identity before providing a substantive response," plus an authorized-agent route and an appeal path. No response timeline is stated in the addendum.
Temu — Privacy Policy Addendum for U.S. Residents · accessed 9 Aug 2026 ↗
1Deletionstated
Self-serve: Temu's privacy policy states "You could delete your account in the 'settings' section of the app." Retention is stated only in general terms — personal information is kept "as long as necessary to fulfill the purposes for which we collected it" — with no post-deletion purge timeline, which caps this at Moderate.
Temu — Privacy & Cookie Policy · accessed 9 Aug 2026 ↗
1Sells / sharesstated
Temu shares personal data with affiliates and third-party advertising partners (may count as a "sale"/"sharing" under US state law) but states it honors a browser GPC signal as a universal opt-out and offers personalization toggles.
Temu — US Residents Privacy Addendum · accessed Jun 2026 ↗
1Trains AIstated
Temu's standard policy does not explicitly state it trains its own AI models on personal data, but it does not publish a clear default opt-out either (scored conservatively as unverified).
Temu Privacy & Cookie Policy · accessed Jun 2026 ↗
0API access — feeds Agent Readiness, not the /12stated
Temu offers no consumer data API; account data is obtained through a web-based data-subject-request form for access, download or deletion, processed manually.
Temu — Privacy & Cookie Policy · accessed Jun 2026 ↗
Temu has faced regulatory scrutiny over data practices; it offers request-based access/deletion and states it honors GPC, but lacks a prominent one-click export portal and several cells rest on secondary sources because the primary policy pages are JS-rendered and resisted direct fetch — scored conservatively. Source-verified Jun 2026; all cells stated (read from published policy/support docs), none yet tested via live export.
Events
Breaches, policy changes, and export-format changes we’ve recorded at Temu — other parties’ actions, alongside the enforcement record above. An event never changes a grade by itself. All events →
No events on record for Temu.
Grade history
Every change to this company’s grade since it was first published, and why. All grade changes →
9 Aug 2026Deletionsource
Score unchanged. The previous note's “~7 business days” and “180 days backup” figures appear nowhere in Temu's own documents and came from a third-party how-to. Temu states retention only as “as long as necessary,” and a missing post-deletion timeline is what caps this at Moderate.
Temu — Privacy & Cookie Policy ↗Previously: Temu delete-account guide (third party)
9 Aug 2026Friction & speedsource
Score unchanged. The previous note's “consumer reports indicate … up to ~45 days” was sourced to a competitor's marketing page. Temu's own US addendum documents the rights flow, identity verification and an appeal path, and states no response timeline.
Temu — Privacy Policy Addendum for U.S. Residents ↗Previously: Temu privacy guide (third party)