By Shen Lu

When China-owned bargain site Temu last week entered into a data-storage deal with Oracle, the move echoed TikTok's travails in trying to address U.S. data-privacy concerns.

Temu, owned by Chinese e-commerce giant PDD Holdings, has in the last several years gained huge popularity among U.S. consumers with its ultracheap wares shipped from China. But it has also landed in the crosshairs of lawmakers who claim it inadequately protects U.S. consumers' data.

Temu provided few details of its deal with Oracle but said that it is part of its efforts to localize more of its U.S. operations and that it would build on its existing efforts to store data on American consumers on servers in the U.S.

The deal comes as Temu faces allegations in several U.S. states that it could turn over data on U.S. users to Beijing. Hours before Temu confirmed the Oracle agreement, Nebraska Attorney General Mike Hilgers filed a lawsuit accusing Temu of using malware to siphon off Nebraskans' personal data which he said might end up in the hands of the Chinese Communist Party. That followed a similar lawsuit in Arkansas filed last summer.

"Temu claims its app is safe for American consumers, including teens," Hilgers wrote in a statement accompanying the lawsuit. "But Temu is deceiving Nebraska consumers and harming Nebraska brands, businesses, and creators."

A Temu representative called the allegations without merit and a rehash of what it termed misinformation originating in a short-seller report.

Both the Nebraska and Arkansas lawsuits against Temu reference a 2023 report by short seller Grizzly Research, which said the Temu app had secret features that let it extract personal information from users' phones. Temu has denounced the claims as false and lacking in credibility.

The allegations against Temu partly mirror those made against TikTok, whose China-based ownership U.S. officials say potentially gives Beijing a way to access data on Americans. TikTok executives have repeatedly said that the company doesn't share any user data with the Chinese government and that it would decline to do so if asked.

In 2023, in an attempt to convince U.S. lawmakers that TikTok was safe and prevent a forced sale of the app, the company enlisted Oracle as a partner in its $1.5 billion project to wall off American user data.

Temu users in the U.S. have complained that Temu collects more information from them than it discloses, the subject of two class-action lawsuits. Temu has denied the allegations and said it strives to safeguard privacy and maintain transparency.

Temu, which is based in Boston, didn't answer questions about whether its Oracle deal was part of a response to the growing scrutiny over data privacy in the U.S. A person familiar with the Oracle agreement described it as a standard cloud-hosting contract. Oracle Chairman Larry Ellison on an earnings call described the deal as a "gigantic contract" with Temu "basically moving their infrastructure to the Oracle Cloud."

The U.S., which in the past had adopted a more laissez-faire approach to data transfer, has in recent years started giving greater weight to national security in regulating cross-border data flows, experts say.

The Justice Department in April started restricting or preventing the transfer of sensitive U.S. data, including government-related data and Americans' personal information, to "foreign adversaries" -- a group that includes China -- citing national-security concerns. Even before that move, some smaller U.S.-based companies with Chinese owners said they had opted to localize user data to avoid facing the kind of scrutiny that has dogged TikTok.

"I think that everyone kind of knew when TikTok was in the crosshairs that it was just the first," said Samm Sacks, a senior fellow at the Washington-based New America think tank who studies Chinese technology policy.

In state capitals around the U.S., legislative efforts have targeted Chinese companies that legislators have described as potential participants in Beijing's efforts to infiltrate the U.S. States have often moved faster than Congress to challenge perceived China threats. By the time a bill that could force TikTok parent ByteDance to sell the app reached former President Joe Biden's desk, more than 30 states had passed regulations targeting the short-video app.

In 2023, when Montana Gov. Greg Gianforte signed a blanket ban of TikTok in the state, he also barred state employees from installing other Chinese apps on their government-issued devices. One of them was Temu. A federal judge blocked Montana's TikTok ban, saying it likely violated free-speech protections.

Last year, Montana Attorney General Austin Knudsen led a coalition of Republican attorneys general to demand information from Temu parent PDD regarding data collection and sharing practices and its ties with the Communist Party. Temu didn't respond to a question about whether PDD complied with the investigation.

The Oracle deal, and similar agreements for data storage Temu has made with Google and Microsoft, is a necessary step, experts say. "If Temu hopes to continue to operate in the U.S., it has to localize its data," said Qiheng Chen, a fellow at Asia Society's Center for China Analysis researching China's tech laws and policies. "At least they would have some judicial recourse."

But experts also say such measures will only go so far in countering data-privacy and national-security allegations based on TikTok's experience. Sacks, of the New America think tank, said Chinese companies have had little success convincing U.S. lawmakers and regulators that their data isn't easily accessible to Chinese authorities.

"What American officials are saying is the hypothetical risk," said Sacks. "Lawmakers are going forward assuming that that's true. Whenever companies push back on that narrative, it's sort of lost. It doesn't work."

TikTok's efforts to wall off U.S. user data and store it on servers owned by Oracle has done little to convince American officials that its Chinese ownership isn't a threat to the U.S.

The Supreme Court in January upheld the law that would force the sale of TikTok. However, on Tuesday, the White House said President Trump, who led the charge against the app during his first term but who has come to see it as a crucial tool to reach younger voters, will sign an executive order staving off enforcement of the law for another 90 days, the third extension since Trump assumed his second term.

Write to Shen Lu at shen.lu@wsj.com

(END) Dow Jones Newswires

June 18, 2025 08:00 ET (12:00 GMT)

Copyright (c) 2025 Dow Jones & Company, Inc.