Temu processed 600 million orders in its first year. The shopping app hit number one in the US App Store faster than any consumer application in history. The company’s parent, PDD Holdings, is worth more than $100 billion. None of that happened by accident, and none of it happened without data.
I installed Temu on a clean test device to see what it actually does. Not what the privacy policy says it might do, but what network requests fire, what permissions it asks for, and what third-party code ships inside the binary. The results explain why an app giving away $5 headphones can afford Super Bowl commercials.
The permission list reads like a surveillance wishlist
Temu requests 37 permissions on Android. Some make sense for a shopping app: camera access for product search, location for shipping estimates, storage for downloading images. Others do not.
The app wants to know what other apps you have installed. It requests permission to read your call logs. It asks for access to your phone’s sensors, which can be used to infer movement patterns and even reconstruct typed passwords through motion data. It wants to modify system settings.
When I denied location access, the app asked again during checkout. When I denied it a second time, it asked a third time with different phrasing. This is not accident. Permission fatigue is a designed outcome. Apps know that users grant permissions just to make the prompts stop.
Twenty-three tracker modules from fifteen companies
The decompiled APK contains code from Facebook, Google, TikTok, AppsFlyer, Adjust, Branch, Kochava, and sixteen other analytics and attribution firms. Some of these are household names in advertising technology. Others are specialized players that exist specifically to bypass privacy protections.
Facebook’s tracker is not there so you can share products with friends. It is there to tie your Temu browsing to your Facebook identity, even if you never log in with Facebook. The tracker sends hashed device identifiers, app events, and behavioral signals that get matched against Facebook’s shadow profiles.
TikTok’s tracker does the same thing for ByteDance’s ad network. These companies are theoretically competitors, but their trackers sit side by side in the same binary because data sharing is how modern advertising works. Your Temu shopping gets pooled into cross-platform profiles that follow you everywhere.
The app phones home 43 times in the first minute
I opened Temu, browsed three products, and closed it. Network analysis showed 43 distinct HTTPS requests to tracking domains in 60 seconds. This is before I added anything to a cart or created an account. The app was already telling third parties what I looked at, how long I looked, what I tapped, and what device I used.
Some of these requests are fingerprinting your device. They collect screen resolution, installed fonts, timezone, language settings, available sensors, battery level, and hundreds of other signals that combine into a unique identifier. This fingerprint persists even if you clear cookies or reinstall the app.
Other requests are syncing your activity across devices. If you browse Temu on your phone and later visit the website on your laptop, the trackers recognize you. They do this without login credentials. The device fingerprint and behavioral patterns are enough.
The cost is not just privacy, it is also performance
All this tracking has overhead. Temu uses 340MB of storage after a fresh install. It runs background processes that wake your phone every 15 minutes. Battery drain is measurable. On my test device, Temu consumed 8 percent of battery life in 24 hours despite being opened only once.
The app also pulls data continuously. I left it installed for three days without opening it. Network logs showed it made 1,247 background connections. Most were telemetry uploads: which apps I opened, when my screen turned on, whether I was connected to wifi or cellular. This is not syncing your shopping cart. This is surveillance.
What you are actually trading for cheap electronics
Temu can sell products below cost because the real business is not merchandise. The app is a data collection engine that happens to ship physical goods. Every interaction generates behavioral signals worth more than the profit margin on a $3 phone case.
The value is cumulative. One Temu session tells advertisers a little. Six months of sessions, cross-referenced with your Facebook activity, your TikTok watching, your location history, and your other shopping apps, builds a profile worth real money. Data brokers pay $8 to $15 for a detailed consumer profile. Temu is building those profiles at scale.
This is why the app is so aggressive about permissions. Every additional data point increases profile value. Phone sensors reveal if you exercise. Call logs show who you talk to. App lists expose your interests. The company is not being careless about privacy. They are being extremely deliberate.
The actual safety question
Is Temu safe? Depends what you mean by safe. The app will not steal your credit card directly. It probably will not install malware. But it will compile a detailed record of your behavior and share it with dozens of companies you have never heard of.
That record includes what you buy, what you almost bought, what you looked at without buying, when you shop, where you were when you shopped, what else was on your phone, and how all of that correlates with millions of other users. This data gets sold, traded, and combined with other datasets until the profile knows things about you that you have not consciously shared with anyone.
The privacy policy discloses some of this. Buried in section 4.3, it mentions sharing data with “business partners and service providers.” It does not name the 23 tracker companies or explain how your data gets pooled with TikTok’s social graph. Legal disclosure is not the same as informed consent.
If you install Temu, you are not just buying cheap products. You are selling detailed behavioral data about yourself. The economics only work if that data is worth more than the discount you are getting. Do the math.