Privacy & Information Security Law Blog

The Kentucky Attorney General (“AG”) recently filed a lawsuit against Temu, an online shopping platform owned by PDD Holdings, a Chinese holding company. In relevant part, the lawsuit alleges that Temu violates the privacy of Kentucky residents under Kentucky’s Consumer Protection Act and common law. The AG’s press release stated that Temu “can infect Kentuckians’ devices with malware, steal their personal data and send it directly to the Chinese government..”

Kentucky’s consumer privacy law, which recently was amended, will go into effect on January 1, 2026. The AG will have exclusive enforcement authority under the law. This action indicates the AG’s focus on consumer privacy and suggests the AG will be active in this space once the Kentucky consumer privacy law goes into effect.