Temu’s €200 Million DSA Fine Leaves Three Files Open

The European Commission fined Temu €200 million ($232 million) on 28 May 2026 after it failed to assess illegal-product risks under the Digital Services Act. The decision closed one file. It did not close the case.

Brussels used a 2024 risk report, a mystery-shopping test, and customs data to show EU shoppers were very likely to meet illegal goods on the app. Temu called the sum disproportionate and said that first report no longer matches how the shop runs. Three other probes from 2024 are still live, and an Article 75 clock started the same day as the fine.

A Fine That Closed Only the Paperwork File

The non-compliance decision sits on Article 34 of the Digital Services Act, the duty on very large platforms to identify, analyse, and assess systemic risks tied to their own service. Henna Virkkunen, the Commission’s executive vice-president for tech sovereignty, security and democracy, treated that paper as the backbone of the law, not a side chore.

Risk assessments are not box ticking exercises. They are the backbone of the DSA. Temu’s risk assessment underestimates concrete risks, lacks specificity, is not grounded in solid evidence, and is not comprehensive. It leaves regulators, users, and the public in the dark about the true scale of potential harm posed by illegal products sold on Temu. Now it is time for Temu to comply with the law.

Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, European Commission press release, 28 May 2026

She posted the same line of attack the morning the fine went out, naming unsafe chargers and baby toys as the goods behind the legal finding.

Illegal products have no place in the European market.

Protecting European consumers from harm is a top priority for the European Commission. That's why, today, we are taking decisive action against Temu and issuing a fine of € 200 million under the Digital Services Act.

— Henna Virkkunen (@HennaVirkkunen) May 28, 2026

The Commission calculated the penalty from the nature of the breach, its gravity for EU users, and how long it lasted. It used Temu’s 2025 turnover of €53 billion. The €200 million bill is 0.38 percent of that figure. The statute allows up to 6 percent of global annual turnover, so the first ticket left a wide gap for later bills if the shop misses the follow-up work.

Temu’s EU unit is Whaleco Technology Limited in Ireland. The Commission’s supervision list, updated on 31 August 2026, still records the service at 75 million average monthly users. That listing, not the size of the cheque, is what keeps Temu inside the strictest DSA band.

Mystery Shoppers Bought Failed Chargers and Hazardous Toys

The legal charge is a weak report. The political charge is what testers actually bought. An independent lab shopped the live catalogue for the Commission and ran the goods through ordinary safety checks. The press release does not publish sample sizes. It does publish the result in plain language.

WHAT THE COMMISSION’S SHOP FOUND

• Chargers: A very high percentage of the selected units failed basic safety tests.
• Baby toys: A high percentage posed medium to high safety risks, with chemicals above legal limits or detachable parts that can choke a child.
• Customs data: EU customs and market surveillance files showed high non-compliance rates in the same product groups.
• Design risk: Recommenders and influencer promotion programmes were not assessed for how they could spread illegal listings.

That mix is why a paperwork case could carry a nine-figure fine. A generic e-commerce memo cannot explain away a charger that fails a bench test or a rattle that sheds small parts. Critics of the DSA like to say Brussels is punishing a document the Commission disliked. The document is the offence of record. The shopping bags are why the offence stuck.

Shoppers still treat the app as a bargain bin, which is the point of the model. The Commission leaned on physical tests because user complaints alone would not have moved a file this size. Virkkunen’s own follow-up posts kept returning to chargers and toys, not to the font size of Temu’s 2024 PDF.

How Temu’s 2024 Risk Assessment Failed the Test

Temu was listed as a very large online platform on 31 May 2024. That listing gave it four months to meet the extra duties, including an annual risk report built on its own service rather than on the sector at large. The first report, filed at the end of September 2024, is the file the fine rests on.

Brussels says the report used general information about e-commerce instead of Temu-specific evidence, including public reports and testing. It “seriously underestimated” how often EU users would meet illegal items. It also skipped a proper look at how the shop is built, including the systems that rank products and the affiliate programmes that pay influencers to push listings.

Temu’s reply was ready the same day. The company said it respects the aims of the Digital Services Act and the need for clear rules. It also said it disagrees with the decision and considers the fine “disproportionate.” In the same statement it argued that “the decision relates to our first DSA assessment in 2024 and does not reflect the current state of our systems,” and that it had already taken further steps on risk assessment, platform governance, and user protection.

That split is now the live fight. Temu wants the 2024 paper treated as a closed historical exhibit. The Commission treated it as a serious breach of a cornerstone duty and kept the rest of the 2024 probe open. A stale-file defence does not, on its own, retire an Article 75 order.

Three Other Investigations Are Still Running

On 31 October 2024 the Commission opened formal proceedings after reading that first risk report, Temu’s replies to information requests of 28 June 2024 and 11 October 2024, and material from national coordinators, including Ireland. The May 2026 decision closes only the illegal-products risk-assessment strand. The other three files were never part of the fine.

THE FOUR FILES OPENED IN 2024

• Illegal products: Closed on 28 May 2026 with the €200 million non-compliance decision and the action-plan order.
• Addictive design: Still open. The probe covers game-like reward programmes and whether Temu has real steps to limit harm to physical and mental well-being.
• Recommenders: Still open. The law requires disclosure of the main ranking parameters and at least one option that is not based on profiling.
• Researcher access: Still open. Very large platforms must give researchers access to publicly available data on the service.

The opening decision also asked how Temu stops suspended rogue traders, and banned goods, from reappearing, sometimes within days of a takedown. That trader-control question sits next to the risk-file finding even though it was not priced into the May fine. BEUC, the European consumer organisation, has already told Brussels to finish the leftover work on addictive design, recommenders, and trader transparency.

If the design strand ends in a second non-compliance decision, it would be the first DSA hit aimed at dark patterns on a shopping app rather than on a social feed. That is the part of the 2024 opening that the €200 million ticket did not buy off.

What the August 28 Deadline Set in Motion

Article 75 of the Digital Services Act does not treat a fine as the last word. Temu had until 28 August 2026 to send an action plan that sets out how it will fix the risk-assessment breach. The European Board for Digital Services then has one month from receipt to give an opinion. The Commission has one further month to adopt a final decision and set a reasonable period for the work itself.

The Commission’s own VLOP supervision page, refreshed on 31 August 2026, still lists the 28 May fine as the last published step. It does not record receipt of a plan. Failure to comply with the non-compliance decision can trigger periodic penalty payments. The Commission also said it “continues to engage with Temu to ensure compliance with the decision and with the DSA more generally.”

THE TEMU DSA CLOCK

1. 16 May 2024: BEUC and national consumer groups file DSA complaints over unsafe listings and manipulative design.
2. 31 May 2024: The Commission designates Temu a very large online platform, with Whaleco Technology Limited in Ireland as the EU establishment.
3. 31 October 2024: Formal proceedings open on illegal products, addictive design, recommenders, and researcher data access.
4. 28 July 2025: Preliminary findings land on the Article 34 risk-assessment breach.
5. 28 May 2026: Non-compliance decision and €200 million fine; Article 75 plan due 28 August 2026.
6. 28 August 2026: Action-plan deadline. Board opinion and Commission follow-up decision then run on one-month steps from receipt.

A separate cost layer arrived in the same summer. The July customs changes on low-value parcels hit the direct-from-China model on the dock, not in a risk PDF. The DSA file and the customs file now run in parallel, and only one of them was priced at €200 million.

A Larger Marketplace Fine Followed in July

On 20 July 2026 the Commission fined AliExpress €550 million for failing to assess and cut the spread of illegal, unsafe, or counterfeit goods. That figure more than doubled Temu’s bill and became the largest DSA penalty to date. Virkkunen said scale is not an excuse and that counterfeit clothing, unsafe toys, and dangerous cosmetics are not an unavoidable cost of shopping online.

DSA FINES ISSUED

The three tickets add up to €870 million. Temu’s fine was the largest on the day it landed and the first aimed at product safety on a marketplace. Two months later it was the middle number in the table. Shein, listed at 108 million average monthly users, is in its own DSA proceeding. AliExpress is listed at 104.3 million. Temu remains the smallest of that trio on the official user count and is no longer the most expensive example.

That sequence is the second-order result of the May decision. Brussels road-tested a mystery-shopping method and a risk-file charge on Temu, then applied a heavier version to a larger catalogue. Inside the European Parliament, even supporters of the Temu ticket called the sum cautious next to the volume of non-compliant imports. The statute’s 6 percent ceiling is the reminder that €200 million was a first instalment, not a maximum.

Consumer Groups Had Already Flagged the Same Goods

BEUC and 17 national members had been on this trail before the designation. Their coordinated complaints filed in May 2024 asked authorities to treat Temu as a de facto very large platform and to police trader traceability, manipulative design, and recommender transparency. The Commission later used that pressure, plus its own tests, to open the 31 October file.

On the day of the fine, BEUC welcomed the penalty and pointed to its own lab work. Tests in France, Denmark, and Germany found that 53 out of 81 products tested in children’s toys, jewellery, and electronics contained dangerous substances or materials. Separate member tests on cheap plastic toys found hormone-disrupting phthalates at up to 240 times the legal limit. Those figures are BEUC’s, not the Commission’s mystery-shop percentages, and they describe a different basket of goods.

After taking the European e-commerce market by storm, it is now time Temu takes its responsibility towards consumers. The fine imposed on Temu for failing to properly assess the real-life impact its platform poses to European consumers is a strong signal.

Agustín Reyna, Director General, BEUC, 28 May 2026

Reyna also asked the Commission to finish the leftover investigation and to stop illegal products and manipulative designs, not only to score the risk report. The consumer-protection cooperation network has a parallel file on suspected breaches of consumer law. BEUC wants that digital-and-consumer double track to hold, with a future Digital Fairness Act sitting beside the DSA.

Temu still has to produce a risk assessment that is specific to its own shop, grounded in tests rather than sector averages, and honest about recommenders and influencer push. Until the Commission publishes a decision on the Article 75 plan, and until the addictive-design, recommender, and data-access files move, the May fine is the start of the supervision, not the end of it.