Popular online retailer Temu is pushing back against a recently filed lawsuit that accuses it of having unfiltered access to user data. Last week, the online retail giant asked to have a recently filed class action lawsuit moved out of court and into arbitration.

The class action lawsuit was initially filed in November 2023 in the U.S. District Court for the Northern District of Illinois by the Hagens Berman law firm on behalf of seven plaintiffs from California, Illinois, Massachusetts, and Virginia.

First launched in the U.S. in September 2022, the Chinese e-commerce platform exploded in popularity, leading it to be ranked as Apple’s second-highest downloadable free app. With its gamified user interface and the appealing slogan "Shop like a billionaire," the app has over 40 million global registered users.

With this popularity comes the allegations that Temu is seemingly collecting more data than it needs or that users are aware of. The lawsuit accuses Temu of violating customer privacy rights because it collected the information through ​​"deceptive" and "unscrupulous" practices. Among the alleged data collection is access to user photos, texts, biometrics, and other sensitive data.

The lawsuit explains that users are vulnerable when they download and use the app because the​​ "app is purposefully and intentionally loaded with tools to execute virulent and dangerous malware and spyware activities on user devices” and that "Temu misled people about how it uses their data."

Jeannie Evans, one of the attorneys representing the plaintiffs, says that Temu’s actions were intentional. She argues, "We talk about how Temu requests at least 24 permissions for all kinds of information that would not be needed for an online shopping app."

Among the information Evans says is unnecessarily collected is permission to access a user’s Bluetooth and Wi-Fi network data along with access to their biometric data, including their face and fingerprint scans.

The complaint explains the risks that exist if sensitive user data falls into the wrong hands. "This is particularly concerning, given that biometric information such as facial characteristics, voiceprints, and fingerprints are immutable characteristics that can be misused by unscrupulous actors."

This newest lawsuit follows a similar class action suit filed in New York last September on behalf of plaintiff Eric Hu and others. That lawsuit argued that Temu was collecting private user data but not keeping it secure.

"Defendant grossly failed to comply with security standards and allowed its customers' financial information to be compromised, all in an effort to save money by cutting corners on security measures that could have prevented or mitigated the Breach." Hu’s lawsuit maintains.

That lawsuit argues that after users realized their private data, including credit card and banking information, were leaked or sold after they used the app, they reported their concerns to the Better Business Bureau. Some customers alleged that after they used the app to purchase products, they later found suspicious charges made on their accounts.

Other users report that they began receiving emails alerting them they were pre-qualified for accounts they never signed up for. The BBB says that in 14 months of the app’s operation, they received over 900 complaints about it.

Temu has responded to the claims made against it in the lawsuit and argues that they are meritless. "We categorically deny the allegations and intend to vigorously defend ourselves,” the Chinese online giant shared in an official statement. “The truth is that safeguarding privacy is one of Temu's core values. Our privacy practices are in line with industry standards and are transparently disclosed in our Privacy Policy. Temu also has a ‘permissions’ section in the Temu app and website that clearly explains the device features that Temu does and does not access.” The company also vehemently denies selling customer data to third parties.

This recently filed class action lawsuit alleges a slew of consumer privacy violations, including violations of the Computer Fraud and Abuse Act, the Electronic Communications Privacy Act, violations of privacy laws in Massachusetts, California, and Virginia, and other state and federal violations.

The lawsuit is seeking unspecified damages and a trial by jury.