 Griffin also says that Timu is not just gathering consumer-related data, but using spyware and malware on their app. The lawsuit seeks to impose civil penalties of up to $10,000 per violation of the Deceptive Trade Practices Act or the Personal Information Protection Act.