Temu: EU Investigation into Digital Security, Consumer Rights, and Privacy

The European Commission has recently announced the initiation of a formal proceedings aimed at ascertaining potential violations by Temu of the Digital Services regulations. The investigation focuses on several critical areas that raise compliance and security issues and could impact the European digital single market.

Read the full press release

The survey will analyse the mechanisms employed by Temu to limit, where carried out, the marketing of potentially non-compliant goods within the European Union. In particular, it will examine the effectiveness of systems designed to prevent the reappearance of rogue sellers who have already been identified and suspended for marketing non-compliant products. These systems should ensure adequate surveillance to prevent the reintroduction of goods that do not comply with European regulations, thus protecting consumers and the European market from possible risks.

Furthermore, another aspect of great importance concerns Temu's service design that could be addictive, especially through the use of programmes based on ludic reward mechanisms. The aim of the investigation is to establish whether Temu has implemented effective measures to mitigate the risks associated with such practices, considering the possible negative repercussions on the well-being, mainly psychological, of users. The relevant European legislation requires digital service providers to carefully consider the psychological impacts of their platforms and to take concrete actions to protect their rights.

We have a special prize for you! Your chosen item is now 90% off!

A further area of concern is compliance with the obligations under the digital services regulation concerning the recommendation systems used by Temu to suggest content and products to users. European legislation requires Temu to disclose in a transparent manner the main parameters governing such recommender systems. Furthermore, there is an obligation to provide at least one recommendation option that is not based on user profiling, making these options easily accessible to all users of the platform. This practice would fall within the scope of user profiling, which consists of the automated analysis of personal data to assess personal aspects, such as preferences or interests, in order to predict future behaviour. In Italy, profiling is regulated by the General Data Protection Regulation (EU Regulation 2016/679 or GDPR), and by the Personal Data Protection Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018), which set out the requirements for the lawful processing of personal data and for the protection of the rights of data subjects. More specifically, the Guidelines of the Italian Data Protection Authority on the processing of personal data for online profiling of 19 March 2015 would also be applicable in the Italian legal system.

The Authority recalled, on that occasion, that ‘the processing operations aimed at profiling the user, carried out also through the cross-referencing of data collected in relation to different functionalities, do not fall within any of the cases of exemption from the obligation to obtain consent under Article 24 of the Code, and can only be carried out after the user has expressly expressed his willingness to do so’.

Security and consumer rights. But not only that!

From the point of view of personal data protection and by virtue of Regulation (EU) 2016/679, we carried out a detailed analysis of Temu's terms and conditions, as well as the platform's privacy policy and cookie policy, which states ‘29 April 2024’ as the effective date. The analysis revealed that, at present, the cookie policy does not offer users the possibility to reject, either from the introductory banner or from the ‘Settings’ of the App, the potential profiling choice made by Whaleco Technology Limited. The text of the privacy policy contains a rebus sic stantibus clause that would seem to encapsulate the need to further inform users and allow them to choose:

"We will use other data that you provide as described in this Privacy Policy or for any other purpose disclosed to you at the time we collect your information".

In conclusion, the purpose of the investigation launched by the Commission is to ensure that Temu fully complies with European directives, protecting consumer rights and the security of the single European digital market. In addition, there is a need for a careful verification of Temu's compliance with existing data protection provisions applicable in the European context. This verification is essential to ensure a higher level of security for users, in compliance with the principles enshrined in European legislation, with particular reference to the GDPR, in order to preserve the confidentiality and integrity of personal information processed by the APP.