Texas Temu Settlement Requires US Data Storage, China Limits

Texas has settled its deceptive trade practices suit against Temu's operators. Under an agreed final judgment the parties signed on October 15, 2026, Temu must store Texas consumers' personal data on American-owned servers located in the United States and restrict access to it by people and entities based in China, beginning 180 days after the court signs the judgment.

Information last verified on October 18, 2026. We read the agreed final judgment published by the Texas Attorney General; the copy published carries a blank court signature line, so the judgment's Effective Date is not established by the document itself.

Jurisdiction scope: This article addresses one Texas state court settlement and the Texas statutes behind it. It does not address private claims against Temu, federal enforcement, or other states' actions. For the broader picture on where governments require data to stay inside their borders, see our survey of data localization laws by country.

What Happened

Texas sued Temu's operators on February 19, 2026 and settled with them on October 15, 2026, and the settlement's central term is where Texans' data physically lives.

The State of Texas, acting through Attorney General Ken Paxton, filed Plaintiff's Original Petition and Application for Temporary and Permanent Injunctions against PDD Holdings Inc. and Whaleco Inc. d/b/a Temu in a Collin County district court on February 19, 2026. The agreed final judgment records that filing date at Paragraph 4 and carries Cause No. 471-01114-2026 in the 471st Judicial District Court. Collin County's own courts directory lists Judge Bryan Gantt as the judge of the 471st District Court, and the judgment's signature block names Hon. Robert "Bryan" Gantt.

The petition pleaded a single statutory theory. It alleged violations of sections 17.46(a) and 17.46(b) of the Texas Deceptive Trade Practices Act, and at Paragraph 97 it identified the specific subsections relied on: 17.46(a), 17.46(b)(5), 17.46(b)(7), 17.46(b)(11) and 17.46(b)(24). The State's lead factual allegation was that Temu operates as "spyware disguised as a shopping app" and harvests data "to be stored on servers in China." The petition also alleged, at its opening section and again at Paragraph 110, that Governor Greg Abbott's prohibited technologies list has continued to include PDD Holdings, Temu's corporate owner, as of February 4, 2026, which the State offered as evidence of the public interest in an injunction.

Paragraph 4 of the judgment restates what Texas alleged: misrepresenting the app's data permissions and collection; misrepresenting promotions, coupons and strikethrough prices; misrepresenting the quality, authenticity and safety of goods including through reviews and ratings; failing to safeguard personal information or give breach notice; and failing to disclose that Texans' data "may be furnished to the government of the People's Republic of China."

Whaleco Inc. is a Delaware corporation with its principal place of business in Boston, Massachusetts, and it operates the Temu platform. PDD Holdings Inc. is a Cayman Islands corporation with executive offices in Dublin, Ireland, and it owns Whaleco through intermediate holding entities. Both are bound by the judgment under Paragraph 15.

The money is modest relative to the injunctive terms, and the judgment says so. Paragraph 10 orders Texas to recover $3,000,000 jointly and severally, and adds that the "amount reflects, and is consideration for, Defendants' agreement to the injunctive terms and covenants set forth below in their entirety." Paragraph 11 makes that sum payable as civil penalties under DTPA section 17.47(c) together with reasonable attorney's fees, investigative fees and costs, due within 30 days after the Effective Date. The judgment does not allocate the $3,000,000 among those categories.

Paragraphs 5 and 56 are equally important. The defendants deny every allegation of wrongdoing, the judgment is not an admission of any violation, and it "does not constitute a finding of law or fact by any court or agency that Defendants engaged in any act or practice declared unlawful by any law, rule, or regulation."

What the Judgment Requires on Data Storage and Access

The storage term is one sentence. Paragraph 29(a) provides that Temu "shall store the Personal Data (including Sensitive Data and Sensitive Personal Data) of Texas Consumers on commercial servers located in the United States that are owned and controlled by an American company."

The access term is longer and narrower than the headline suggests. Paragraph 29(b) requires Temu to prohibit access by any Prohibited Person "in an unencrypted or decryptable form" to personal data "that is linked or reasonably linkable to an identified or identifiable individual." Two exceptions follow. The first is specific consumer consent, limited to the single instance of access it covers. The second applies only to personal data that is not sensitive, and permits access that is reasonably necessary and proportionate to commercially reasonable purposes, including order fulfillment, fraud detection, troubleshooting and maintaining the platform, and complying with Texas or federal law or compulsory process from a US court or authority.

Paragraph 9(l) defines a Prohibited Person as any entity or individual that is organized or chartered under the laws of the People's Republic of China, has its principal place of business in the PRC, or is primarily a resident of PRC territory.

Who counts as a protected consumer is also defined mechanically. Under Paragraph 9(q), a Texas Consumer is a Texas resident acting in an individual or household context, and for compliance measurement an individual is treated as one if, on information reasonably available in Temu's ordinary course records, either the IP address for the transaction geolocates to Texas or the account's default delivery address is in Texas. The paragraph expressly declines to require Temu to collect additional information or verify residency.

The rest of Paragraph 29 adds four duties. Temu must disclose in its US privacy policy or US residents addendum the categories of Texas consumers' personal data that may be shared with third parties outside the United States. It must designate a United States based compliance officer and identify that person to the Office of the Attorney General in writing. It must limit retention to disclosed business purposes or legal requirements, and at least quarterly identify Texas accounts inactive for 24 consecutive months and delete the associated personal data unless retention remains necessary. And it must put a one-click link in its US privacy policy, for logged-in users, to the page for deleting a Temu account.

Compliance is audited, not monitored by the State. Paragraph 29(g) requires Temu to retain a Qualified Independent Firm annually to assess compliance with Paragraphs 29(a) and (b) as to Sensitive Data and Sensitive Personal Data, the two defined categories the judgment draws from chapter 541 and the DOJ rule. Paragraph 29(h) sets a civil penalty of $8,000,000 per failed annual audit where the final report finds Material Noncompliance, plus a 60-day cure. Paragraph 39 makes that penalty accrue automatically on the date of the violation and due within 30 days, but two tracks can suspend it. Under Paragraphs 36 through 38 Temu may file one written objection with the firm within 30 days, extendable once by 60 days, and a timely objection suspends both the duty to cure and the accrual of the penalty until the firm affirms, modifies or withdraws the finding; Paragraph 43 then gives Temu 30 days to seek relief from the court on the record that was before the firm. Paragraph 9(j) defines Material Noncompliance in this context as a finding that a Texas consumer's personal or sensitive personal data was accessed, transferred, disclosed or made available to a Prohibited Person in violation of Paragraph 29(a) or (b). Paragraph 21 imposes a parallel annual mobile app security audit for malware, spyware and unauthorized data collection code, and Paragraph 22 attaches the same $8,000,000 figure per failed audit. Paragraph 9(m) requires each auditing firm to be accredited or nationally recognized, independent and at arm's length, and unengaged by Temu for any other service in the three preceding years, but carves two things out of that bar: work for Temu on DOJ Part 202 compliance, and the firm's own assessments under this judgment, so the same firm may perform the required assessment in consecutive years.

The compliance clock runs from the Effective Date, which Paragraph 9(g) defines as the date the judgment is signed by the court. Paragraph 20 phases the duties in: 30 days for the compliance officer, the privacy notice reference to Texas law and the on-platform settlement notice; 90 days for pre-listing product safety certification and the one-click deletion link; and 180 days for the storage requirement, the access prohibition, the outside-the-US sharing disclosure and the retention and deletion duty.

The product safety half of the settlement sits alongside the data terms. Temu must remove recalled, prohibited or noncompliant products within two business days of a recall or alert, and must retain an independent firm to test annually a cross-section of products commonly bought by Texans for lead, PFAS compounds, phthalates, formaldehyde and heavy metals. A product exceeding an applicable federal safety standard becomes a Confirmed Harmful Product, which triggers delisting within two business days, termination of the store and its affiliated stores within five business days, direct notice to each Texas purchaser and a full refund. Paragraph 27 sets a $600,000 civil penalty for missing the five-day store termination deadline.

Two structural terms deserve attention. Paragraph 47 is a most-favored-protection clause: for three years after the Effective Date, if Temu reaches a comparable resolution with another state whose net payment exceeds this one by more than five percent, it owes Texas the difference, and injunctive, compliance, reporting or monitoring provisions that are materially more favorable to that state become self-executing here unless the Office of the Attorney General objects within 90 days. Paragraph 51 ends the judgment four years after the Effective Date, and Paragraph 53 makes that expiration automatic, "without petition, motion, or other proceeding."

Enforcement is calibrated. Paragraph 48 treats a breach of the injunction section as a violation of a DTPA injunction subject to penalties of up to $10,000 per violation, carving out the stipulated penalties in Paragraphs 22, 27 and 29(h). Paragraph 49 gives Temu a notice-and-cure window for most data provisions: penalties for violations of Paragraph 29, other than a failed audit, accrue only from the 31st day after written notice from the Office of the Attorney General identifying the violation with reasonable specificity. That notice period is withheld from a repeat violation of the same numbered paragraph.

What the Law Actually Says

The statutory base is narrow. The Consumer Protection Division of the Texas attorney general's office enforces the Texas Deceptive Trade Practices and Consumer Protection Act, Tex. Bus. & Com. Code sections 17.41 through 17.63. Section 17.46(a) declares "false, misleading, or deceptive acts or practices in the conduct of any trade or commerce" unlawful and subject to division action. Section 17.46(b) lists non-exhaustive examples, and the subsection the data allegations leaned on, 17.46(b)(24), reaches "failing to disclose information concerning goods or services which was known at the time of the transaction if such failure to disclose such information was intended to induce the consumer into a transaction into which the consumer would not have entered had the information been disclosed."

Section 17.47(a) is the enforcement hook, authorizing the division to sue in the name of the state for a temporary restraining order, temporary injunction or permanent injunction when it has reason to believe a person is engaging in unlawful practices and that proceedings would be in the public interest. Section 17.47(b) sets venue in the district court of the county where the defendant resides, has its principal place of business, has done business, or where the transaction occurred, which is the basis for Collin County here. Section 17.47(c) allows a civil penalty of not more than $10,000 per violation, plus up to an additional $250,000 where the practice targeted a consumer 65 or older.

The limit worth noting is in section 17.47(e). A person who violates the terms of a DTPA injunction "shall forfeit and pay to the state a civil penalty of not more than $10,000 per violation, not to exceed $50,000." Section 17.47(f) adds that an award under subsection (e) "applies only to violations of the injunction incurred prior to the awarding of the penalty order" and that second or subsequent violations are subject to the same penalties, so $50,000 is a ceiling per award rather than a lifetime total. Nothing in chapter 17 authorizes a court to impose an eight-million-dollar penalty for a failed audit.

Texas's standing privacy statute is a separate chapter, and it was not the cause of action. The Texas Data Privacy and Security Act is chapter 541 of the Business and Commerce Code, added by House Bill 4 in the 2023 regular session and effective July 1, 2024. The judgment borrows its definitions: Paragraph 9(k) adopts the chapter 541 meanings of personal data and sensitive data, which section 541.001(19) defines as information linked or reasonably linkable to an identified or identifiable individual, and section 541.001(29) defines to include data revealing racial or ethnic origin, religious beliefs, health diagnosis, sexuality, citizenship or immigration status, genetic or biometric data processed to identify an individual, data collected from a known child, and precise geolocation data. Our explainer on what the TDPSA is walks through who the chapter covers.

The chapter's own duties are thinner than the judgment's. Section 541.101(a)(2) requires a controller to maintain reasonable administrative, technical and physical data security practices appropriate to the volume and nature of the data. Section 541.102 sets privacy notice content. We read the chapter's duty provisions and found no server-location or data-residency requirement in them. The remedies are capped too: section 541.151 gives the attorney general exclusive enforcement authority, section 541.154 requires a written notice and a 30-day cure before suit, section 541.155(a) caps the civil penalty at $7,500 per violation, and section 541.156 forecloses a private right of action. Our Texas data privacy law guide covers the chapter's scope and exemptions in detail.

The judgment also measures itself against a federal rule. Paragraph 29's preamble invokes the Department of Justice rule on access to US sensitive personal data and government-related data by countries of concern, 28 C.F.R. Part 202, and Paragraph 9(n) takes its definition of sensitive personal data from 28 C.F.R. section 202.249, which lists covered personal identifiers, precise geolocation data, biometric identifiers, human omic data, personal health data and personal financial data. Part 202 implements Executive Order 14117 and, per its scope provision at section 202.101, prohibits or restricts classes of transactions that may enable access by countries of concern to government-related data or bulk US sensitive personal data. It is framed around transactions and bulk thresholds, not around where a company's servers sit.

What We Could Not Confirm

The copy of the agreed final judgment published on the attorney general's website reads "SIGNED this ______ day of ____________________, 2026." The court's signature and date are blank. Its PDF metadata shows it was created in Microsoft Word on October 16, 2026. The party signatures are dated October 15, 2026: Johnathan Stone for the Office of the Attorney General, Qin Sun as president of Whaleco, and Lei Chen as co-chief executive officer of PDD Holdings.

That matters because the Effective Date is the date the court signs, and every deadline in the judgment plus its four-year term runs from it. We could not confirm entry or the signature date from a court record. We tried the Collin County District Clerk's case information pages, the county's judicial online search application, the statewide public civil records portal at research.txcourts.gov, the appellate search at search.txcourts.gov and the txcourts.gov document search. The county and statewide portals either blocked our requests or returned only an application shell, and none produced a docket entry for Cause No. 471-01114-2026.

The attorney general's October 16, 2026 release calls the settlement "First-of-Its-Kind" and a "landmark injunction." That is the state's characterization of its own case, and we have not tested it against other states' resolutions. We report it as the attorney general's framing, not as a finding.

What Happens Next

Every deadline in this judgment counts forward from the Effective Date, which Paragraph 9(g) defines as the date the court signs it. The copy published by the attorney general carries a blank signature line, so the clock below has a shape but not yet a start date.

The first tier is short. Paragraph 11 makes the $3,000,000 payable within 30 days of the Effective Date. Within the same 30 days, Paragraph 20(a) makes three obligations enforceable: the Texas law reference in the privacy notice under Paragraph 23, the designation of a United States based compliance officer identified to the Office of the Attorney General in writing under Paragraph 29(d), and the on-platform settlement notice under Paragraph 30. Paragraph 20(b) adds pre-listing product safety certification and the one-click account deletion link at 90 days.

The data terms land at 180 days. Paragraph 20(c) makes Paragraph 29(a) through (c) and (e) enforceable then: the United States storage requirement, the prohibited access ban, the disclosure of categories shared outside the United States, and the retention and deletion duty with its quarterly sweep of accounts inactive for 24 months.

Then the reporting cycle starts. Paragraph 9(b) fixes the Annual Reporting Date as September 1. The first app security report under Paragraph 21, the first product testing report under Paragraph 25, the first storage and access assessment under Paragraph 29(g), and each defendant's first officer certification under Paragraph 32 are all due on the first September 1 falling at least six months after the Effective Date. After each Final Report, Paragraphs 40 and 41 give Temu 30 days to send the attorney general a written notice of completion and a copy of the report itself.

Two longer clocks run alongside. Paragraph 47(b) requires Temu to notify the attorney general within 30 days of signing any comparable resolution with another state, with an unredacted copy and its own calculation of the net payment, and Paragraph 47(a)(ii) closes that parity period three years after the Effective Date. Paragraph 51 ends the judgment four years after the Effective Date, and Paragraph 53 makes that expiration automatic.

Paragraph 57 keeps the case in one place. The court retains exclusive and continuing jurisdiction over the judgment, and any proceeding arising under or relating to it must be brought in that court. Paragraph 52 keeps the confidentiality term, the release and the no-admission and no-private-right provisions alive in perpetuity after the rest expires.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The notable thing here is the route, not the destination. A requirement that a company hold a population's data on servers inside a country, owned by companies of that country, is ordinarily the product of legislation. Texas got that result in a consumer-protection enforcement case pleaded entirely under sections 17.46(a) and (b) of the DTPA, a statute about deception in trade and commerce that says nothing about where data is stored.

The mechanism is agreement. Section 17.47(a) lets the attorney general seek an injunction against unlawful practices, and the content of a negotiated injunction is whatever the parties will sign and a court will enter. So the remedy can go well past anything the legislature wrote. The clearest illustration is the penalty structure: section 17.47(e) caps the civil penalty for violating a DTPA injunction at $10,000 per violation and not more than $50,000 per penalty award, and section 17.47(f) confines each award to violations incurred before it while making second or subsequent violations subject to the same ceiling again. Paragraphs 22 and 29(h) of this judgment set $8,000,000 per failed annual audit. Those figures exist because the defendants agreed to them, not because a statute supplies them.

The definitional borrowing points the same way. The judgment measures Temu's duties using the TDPSA's definitions of personal and sensitive data and the DOJ rule's definition of sensitive personal data, while resting liability on the DTPA. Chapter 541 supplies the vocabulary and the compliance benchmark without supplying the cause of action, which also sidesteps chapter 541's own 30-day cure requirement and its $7,500 penalty ceiling.

There are real limits on what this judgment is. It binds two companies, not an industry. It expires automatically four years after the Effective Date. Paragraph 56 bars its use as evidence or precedent in any proceeding other than one to enforce it, and Paragraph 61 says it creates no private right of action. The deception theory in Paragraph 4 is about what Temu told consumers, so the duty it produced is contractual and time-limited rather than a rule of general application.

Paragraph 47 is the term to watch, because it is the only part of the judgment that reaches beyond the parties' own bargain. If Temu signs a comparable resolution with another state during the three-year parity period that is materially more favorable on injunctive, compliance, reporting or monitoring terms, those provisions become self-executing in Texas unless the Office of the Attorney General objects within 90 days. The clause is drafted as a ratchet in Texas's favor, and we note only that it exists; we make no prediction about whether any comparable resolution will be signed.

Finally, read Paragraph 9(q) alongside Paragraph 29(a). The storage duty attaches to data of Texas Consumers, and Texas residency is established by an IP geolocation or a default delivery address, with no obligation to verify. The judgment states a per-state duty measured by per-state proxies, and it says nothing about how Temu should architect its systems to satisfy it.

How This Affects You

There is nothing here for a consumer to claim. The judgment orders no restitution to Texas consumers, and the entire $3,000,000 goes to the State under Paragraphs 10 through 13. Paragraph 46 states plainly that the Office of the Attorney General "is not a forum for individual consumer claims under this Judgment," and Paragraphs 18 and 61 confirm the judgment creates no right in, and no cause of action for, anyone who is not a party.

The one refund path is product-specific. Under Paragraph 26, when annual testing confirms a product exceeds an applicable federal safety standard, Temu must notify each Texas consumer who bought it and issue a full refund. That depends on the annual independent testing cycle in Paragraph 25, whose first report is due on the first September 1 falling at least six months after the Effective Date.

Texas shoppers should expect visible changes on the platform rather than correspondence. Paragraph 30 requires Temu to post a notification on the platform alerting Texas consumers to the settlement. Paragraph 23 requires the privacy notice available to Texans to clearly identify applicable Texas law including the TDPSA. Paragraph 29(f) requires a one-click link, for logged-in users, to the account deletion page.

Your statutory privacy rights are unaffected by this settlement and operate independently of it. Chapter 541 gives Texas consumers rights to confirm processing, access, correct, delete and obtain a portable copy of personal data, and to opt out of targeted advertising, sale and certain profiling, with a controller response deadline and an appeal process under sections 541.051 through 541.053. Our page on the rights the TDPSA gives Texas residents explains how to use them. Because section 541.156 bars a private right of action, chapter 541 complaints go to the attorney general.

If your concern is a specific bad transaction rather than data handling, that is a different track. Deceptive practices complaints and marketplace fraud reports go to the Consumer Protection Division, and how Texas treats scams and consumer fraud sets out the reporting routes and the private DTPA remedies that remain available to individuals.

This is general legal information, not legal advice. This article covers one Texas state court settlement, the Texas Deceptive Trade Practices Act, the Texas Data Privacy and Security Act, and the federal rule at 28 C.F.R. Part 202. Sources were verified on October 18, 2026. Laws change; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• Data localization laws by country
• Texas data privacy laws and the TDPSA
• What the Texas Data Privacy and Security Act covers
• Your TDPSA consumer rights
• Texas scam and fraud laws

---

Last updated: 2026-10-18. The published copy of the agreed final judgment is unsigned by the court; we will update this page if a conformed, entered copy or a docket record becomes available.

Frequently Asked Questions

What does the Texas Temu settlement actually require about data storage?

Paragraph 29(a) of the agreed final judgment requires Temu to store the personal data of Texas consumers, including sensitive data, on commercial servers located in the United States that are owned and controlled by an American company. Paragraph 20(c) makes that obligation enforceable 180 days after the Effective Date, which Paragraph 9(g) defines as the date the court signs the judgment.

Does the settlement ban all access to Texans' data from China?

No. Paragraph 29(b) prohibits access by a Prohibited Person in an unencrypted or decryptable form to personal data linked or reasonably linkable to an identifiable individual. It allows two exceptions: specific per-instance consumer consent, and, for data that is not sensitive, access that is reasonably necessary and proportionate to commercially reasonable purposes such as order fulfillment, fraud detection, platform troubleshooting, and compliance with US legal process.

How much is Temu paying, and does any of it go to consumers?

Paragraph 10 orders PDD Holdings and Whaleco to pay the State of Texas $3,000,000 jointly and severally, due within 30 days of the Effective Date under Paragraph 11, as civil penalties under DTPA section 17.47(c) plus attorney's fees, investigative fees and costs. The judgment orders no restitution to Texas consumers. The only consumer refunds are under Paragraph 26, for products that annual testing confirms exceed a federal safety standard.

What is the $8,000,000 penalty in the Temu settlement?

It is a stipulated penalty, not a statutory one. Paragraph 29(h) imposes $8,000,000 per failed annual audit when an independent firm's final report finds Material Noncompliance with the storage or access duties, and Paragraph 22 imposes the same figure per failed annual mobile app security audit. Each annual audit cycle is a separate potential violation. A timely objection to the firm's report under Paragraphs 36 through 38 suspends the penalty's accrual until the firm issues a final report. By comparison, DTPA section 17.47(e) caps penalties for violating a DTPA injunction at $10,000 per violation and $50,000 per penalty award, and section 17.47(f) allows a further award for later violations.

Was the case brought under the Texas Data Privacy and Security Act?

No. The State's original petition pleaded violations of the Texas Deceptive Trade Practices Act, sections 17.46(a) and (b), and identified subsections 17.46(b)(5), (7), (11) and (24). The TDPSA appears in the judgment in several places rather than as a cause of action: the Paragraph 29 preamble names it as a standard Temu is required to meet, Paragraph 9(k) borrows its definitions of personal data and sensitive data, and Paragraph 23 requires Temu's privacy notice to reference applicable Texas law including the TDPSA. Paragraph 54's release does extend to TDPSA claims arising from the covered conduct.

Which court handled the case, and has a judge signed the judgment?

The case is Cause No. 471-01114-2026 in the 471st Judicial District Court of Collin County, Texas, and Collin County's courts directory lists Judge Bryan Gantt as that court's judge. The copy of the agreed final judgment published by the attorney general on October 16, 2026 has a blank court signature line. As of October 18, 2026 we could not confirm entry or a signature date from any accessible court record, so the Effective Date is not established by the document we read.

How long does the Temu settlement last?

Paragraph 51 provides that the judgment remains in effect for four years after the Effective Date, and Paragraph 53 states that it and each paragraph expire automatically at the end of the applicable term without any petition or motion. Certain provisions survive, including the confidentiality term in Paragraph 42 and the release in Paragraph 54, which Paragraph 52 makes perpetual.

Can a Texas consumer sue Temu based on this settlement?

Not based on the judgment itself. Paragraph 18 states the judgment creates no right in and grants no cause of action to any non-party, and Paragraph 61 says it neither confers nor limits any private right of action a consumer may otherwise hold. Paragraph 55 also reserves from the release any claim held by a person who is not a party. Whether a consumer has an independent claim depends on general law, not on this document.

Does Texas law require companies to keep residents' data in the United States?

The storage requirement in this matter comes from the agreed judgment, not from a Texas statute of general application. We read the duty provisions of chapter 541 of the Business and Commerce Code, the Texas Data Privacy and Security Act, and found no server-location or data-residency requirement in them; section 541.101(a)(2) requires reasonable data security practices appropriate to the volume and nature of the data.

What happens if another state gets better terms from Temu?

Paragraph 47 contains a most-favored-protection clause running for three years from the Effective Date. If a comparable resolution with another state carries a net payment more than five percent higher, Temu owes Texas the difference within 60 days. If it carries injunctive, compliance, reporting or monitoring provisions that are materially more favorable to that state, those provisions become self-executing in Texas unless the Office of the Attorney General objects within 90 days. Paragraph 47(e) excludes several categories, including resolutions with federal agencies, foreign regulators and private parties.