The shopping app Temu is a well-known case study in privacy risk. What does it reveal about "automatic data collection" and the limits of claimed anonymization?

Temu's privacy policy describes broad "automatic" data collection without explicit consent, and it claims to anonymize the data, but experts warn that de-identified data can still be re-identified, so the anonymization claim offers little real protection.

The automatic-collection problem. Temu's policy lists a striking amount of information it gathers automatically, without asking the user first: operating system type and version, device manufacturer and model, browser type, screen resolution, RAM and disk size, CPU load, device type, IP address, unique identifiers (including advertising IDs), and general location. None of this requires you to fill in a form, it is collected in the background simply by using the app.

The anonymization claim. Temu states it may use the collected data broadly (for research, development, and "improving our service and business") and claims to anonymize it, but provides no concrete detail on how. The source quotes Calli Schroeder, a privacy lawyer at EPIC (the Electronic Privacy Information Center): de-identified data removes explicit identifiers like names, but it often still contains several personal data elements that can be linked back to a person through a number instead of a name.

Why it matters. Studies show that location and purchase data alone are frequently enough to re-identify individuals. This is the same re-identification risk that PETs are designed to counter, and it shows why "we anonymize your data" is not a guarantee of privacy. The case study's real lesson: read privacy policies critically and understand what apps actually collect and how they use it.