EU Accepts Temu's DSA Plan After €200m Fine

The European Commission has accepted Temu’s plan to fix how the online marketplace assesses the risk of illegal products being sold to Europeans. It is the next step after the Commission found in May that Temu had broken the Digital Services Act (DSA) and fined it €200 million.

The plan has five measures and gives Temu four months to act, the Commission said on Monday 26 October. The company must carry out an interim risk assessment covering a six-month period up to 30 November 2026. An external, independent audit will then check the work.

In brief

The Commission has accepted Temu’s five-measure plan to remedy its DSA breach, after a €200m fine in May for failing to assess the risk of illegal products.
The EU’s board of digital services regulators called the plan “partially adequate” and said it lacked detail; the Commission says it has clarified key requirements.
Temu has four months to implement the plan, followed by an independent audit and a report to the Commission.

Five measures, all about how Temu measures risk

The DSA requires the largest platforms to identify the “systemic risks” their services create and to reduce them. In May, the Commission found that Temu’s 2024 risk assessment fell short. Its decision said the assessment relied on general information about e-commerce rather than evidence about Temu itself, “seriously underestimated” how often EU shoppers were likely to meet illegal items, and did not properly consider how recommendations and influencer promotions could spread them. A mystery shopping exercise for the Commission found that “a very high percentage” of selected chargers failed basic safety tests, and that “a high percentage” of tested baby toys posed medium-to-high safety risks.

Temu submitted its plan in August. According to the Commission, it commits Temu to:

a risk assessment tailored to its own service, using reliable and up-to-date information;
reliable metrics to judge whether its safeguards actually reduce the spread of illegal content;
an assessment and explanation of the “limitations and shortcomings” of its content moderation, including automated detection, manual review and resources;
analysis of how its recommender and other algorithmic systems may amplify illegal listings;
a look at how traders and others may deliberately manipulate Temu’s features to spread illegal product listings.

When it issued the fine, Henna Virkkunen, the Commission’s executive vice-president for tech sovereignty, said: “Risk assessments are not box-ticking exercises – they are the backbone of the DSA.” Temu said at the time that it would “continue to engage with regulators in good faith”, while reviewing the decision and “considering all available options”, Reuters reported. TSN found no Temu statement on Monday’s acceptance.

Acceptance came with a warning from the regulators’ board

The Commission did not wave the plan through cleanly. The European Board for Digital Services, which groups national regulators, gave its opinion on 24 September. It found the changes “partially adequate” but said the plan “lacked sufficient level of detail to fully assess whether it adequately addresses the infringement”. The Commission says it has “clarified key requirements” for Temu, but it has not published them. It also says it will pay “particular attention” to the points the Board found inadequately explained.

That leaves the public with a plan whose details are partly private, and a long wait for proof. On the Commission’s timetable, Temu has until about late February 2027 to implement the measures, then four more months to hand in the audit report. Independent evidence that the fix works may not arrive until mid-2027. If Temu falls short, the May decision allows periodic penalty payments.

The case is a template for other marketplaces

The measures are not really about Temu’s products; they are about whether a platform can show, with numbers, that its own systems are not pushing unsafe goods. That is the same duty the Commission is now testing in its new DSA case against Booking.com over scams and fake listings. In Britain, which is outside the DSA, regulators are using different tools, from Ofcom’s Online Safety Act fines, nine of 11 of which remain unpaid, to the CMA’s proposal to force Apple to open iPhone contactless. Individual EU states are also moving on their own, as Greece did with its under-15 social media ban.

The Temu case is not closed either. Reuters reported in May that Virkkunen said investigations continue into whether Temu’s design is addictive and into researchers’ access to data. The audit, due next year, is the first point at which anyone outside Temu and Brussels will see whether five promises became fewer unsafe chargers in European homes.