Protecting Americans from Foreign Adversary Controlled Applications Act

TikTok had more than 150 million monthly users in the United States as of March 2023. The company has come under scrutiny since 2020, with American national security officials and lawmakers warning that its parent ByteDance's ties to China are national security risks and the Chinese government could access TikTok data to spy on Americans. According to the Associated Press published in The Hill, as of March 2023, there was no evidence that TikTok had "turned over" to the Chinese government personal data "relevant" to China's national security. CNN also reported that there was "still no public evidence the Chinese government has actually spied on people through TikTok." In May 2023, an ex-ByteDance employee claimed the Chinese Communist Party (CCP) members in ByteDance's Beijing office "maintained supreme access to all the company data, even data stored in the United States" in his wrongful termination complaint. A CNN article described it as potentially the first public evidence. ByteDance called the allegations a publicity grab. In December 2024, a federal judge ageed with ByteDance that the ex-employee had lied and faked evidence. Prior regulatory actions In May 2019, President Donald Trump issued Executive Order 13873 that declared a national emergency related to the security of U.S. supply chains for information and communications technology and services (ICTS), and Trump subsequently issued Executive Order 13942 in August 2020 to augment the previous executive order under the International Emergency Economic Powers Act (IEEPA) by directing the Secretary of Commerce to restrict TikTok's U.S. operations. TikTok and ByteDance filed a lawsuit against Executive Order 13942 that argued that it exceeded the statutory authority delegated under the IEEPA, and the court ruled in favor of the companies and issued a preliminary injunction in the case that barred the executive order from being enforced. In 2019, the Committee on Foreign Investment in the United States (CFIUS) conducted a retroactive national security review and investigation of ByteDance's acquisition of musical.ly (which ByteDance subsequently merged with TikTok) and referred the transaction to Trump for a presidential decision–which indicated that CFIUS could not mitigate identified national security risks arising from the transaction. In August 2020, Trump issued a divestment order under section 721 of the Defense Production Act of 1950 (DPA) in response to the CFIUS review that required ByteDance to sell assets that support TikTok operations in the United States and U.S. user data obtained through TikTok and musical.ly, which TikTok and ByteDance challenged in a lawsuit under the Due Process Clause and Takings Clause of the Fifth Amendment and the Administrative Procedure Act. Before the injunction in the Executive Order 13942 lawsuit was scheduled to expire in June 2021, President Joe Biden rescinded Executive Orders 13873 and 13942 under Executive Order 14034, and the lawsuit against Executive Order 13942 was voluntarily dismissed by the parties. Executive Order 14034 more broadly required the Secretary of Commerce to identify and address national security risks from foreign internet and software based applications operating in the United States, but left the national emergency declaration and the DPA divestment order in place. In January 2021, the Commerce Department issued an interim final rule and request for comments under Executive Order 13873 for ICTS supply chains that Executive Order 14034 expanded, and the Commerce Department issued a final rule for ICTS supply chains in June 2023. However, as of September 2023, the Commerce Department had not blocked any transactions under the ICTS supply chain rule and had only invoked the rule to subpoena China-based companies providing ICTS in the United States. Following the presidential transition of Joe Biden, the companies and the government filed a joint request in the DPA divestment order case for it to be held in abeyance while the parties attempted to negotiate a mutual agreement that the court granted in February 2021 and required the government to file status reports on the negotiations every 60 days. In December 2022, the No TikTok on Government Devices Act signed into law by Biden as part of the Consolidated Appropriations Act, 2023 required the Office of Management and Budget (OMB) to establish deadlines and develop guidelines for federal executive agencies to remove TikTok from all U.S. government computers and information technology that OMB issued in February 2023. National security concerns In March 2024, the Office of the Director of National Intelligence (ODNI) said TikTok accounts from China "reportedly targeted candidates" during the 2022 United States elections and that China using TikTok to influence the 2024 United States elections could not be ruled out. Other members of the US law enforcement and intelligence communities have said China can leverage user data for influence operations and that TikTok can spy on users' activities. United States Secretary of State Antony Blinken stated that TikTok should be "ended one way or another". China has said that any divestment of TikTok would need to comply with Chinese export regulations. A former Trump official said ByteDance is required to follow the 2017 National Intelligence Law and that even after divestment, TikTok would still need to scrub its source code. The Commerce Department has asserted that ByteDance has close ties to the CCP and had signed an agreement with the public relations bureau of the Ministry of Public Security in 2019. In 2021 WangTouZhongWen Technology, aided by the China Internet Investment Fund, acquired a 1% golden share and board seat in a ByteDance subsidiary that owns TikTok's technology. In 2021 research conducted by the Citizen Lab found no overt data transmission from TikTok to the Chinese government or servers in China but did not rule out that non-China servers could relay the data. Based on leaked materials, BuzzFeed News reported in June 2022 that ByteDance employees in China had repeatedly accessed American user data. ByteDance eventually dismissed four employees (two in China and two in US) who had accessed the user data of at least two journalists in order to find the sources of the leak. Cybersecurity studies have shown that TikTok similar amounts of data as its competitors. In 2023, Forbes reported that the Taxpayer Identification Numbers including Social Security numbers of American content creators and businesses being paid by TikTok were stored in China and accessible by ByteDance employees there, and a company software hosting internal TikTok information seen by Forbes had been inspected by Chinese cybersecurity agents ahead of the 20th National Congress of the CCP. A former executive suing ByteDance for wrongful dismissal alleged that its internal CCP committee was granted access to the user data of pro-democracy activists in Hong Kong in 2018, while another lawsuit in December 2019 alleged that user data was harvested and sent to servers located in China. In December 2024, the former executive was found out by a U.S. federal judge to have lied and fabricated evidence. In November 2023, members of the U.S. Intelligence Community and an Australian Strategic Policy Institute researcher raised concerns that TikTok and other social media platforms can be used by the CCP and the Chinese government to shape political narrative. Criticism Observers have argued that the national security concerns raised are largely hypothetical. There is insufficient public evidence to show that American user data has been accessed by or shared with the Chinese government, with some claims reportedly exaggerated. Biden himself was on TikTok as the president, while Trump has reversed his previous position. Lawmakers against the bill said the process was quickly rushed. According to computer security specialist Bruce Schneier, which company owns TikTok may also be irrelevant, as Russia interfered in the 2016 US elections using Facebook without owning it. TikTok said the company takes regular action against covert influence networks and has "more than 150 elections globally" behind it. ByteDance is incorporated in the Cayman Islands, while TikTok Inc. is incorporated in California and Delaware In response to lawmaker concerns about data privacy, TikTok began an initiative called "Project Texas" to locally store all American data monitored by employees of the Oracle Corporation. Pro-Palestine hashtags In 2023, an apparent spike in pro-Palestine content appeared on TikTok following the Israeli bombing of the Gaza Strip in response to the Hamas-led attack on Israel. The company also denied intentionally boosting pro-Palestine hashtags, saying regions such as the Middle East and South East Asia account for a significant proportion of its user views and content, and it is easy to cherry pick hashtags to fit certain narratives. Some for example may have fewer videos but receive more views, or be much older than newer tags. == Provisions ==

PAFACA prohibits the distribution, maintenance, or updating of "foreign adversary controlled applications" by web hosting services and app stores unless the application's owners execute a "qualified divestiture" within 270 days of the application being designated as a foreign adversary controlled application. • The application has been determined by the President to present a significant national security threat. The president may grant a one-time extension of the divestiture deadline by as long as 90 days if a path to a qualified divestiture has been identified, "significant" progress has been made to executing the divestiture, and legally binding agreements for facilitating the divestiture are in place. For divestitures to qualify under PAFACA, the President must determine through an interagency process that the application is no longer controlled by, or has no operational relationship with, a foreign adversary after the transaction is completed, and restrictions under the law cease to apply upon completion of the transaction. However, PAFACA does not require the owners of designated applications to execute a qualified divestiture. Before the divestiture deadline, the company that owns the designated application must provide users their data from the service at their request and in a machine readable format. Web hosting services and app stores that do not comply with the restrictions on distribution, maintenance, and updating of designated applications are subject to civil penalties of $5,000 per U.S. user that accesses, maintains, or updates the application, while the owners of designated applications are subject to civil penalties of $500 per U.S. user that is not provided their data as required by the law. The Attorney General is authorized under PAFACA to investigate potential violations of its terms and, upon determination of violations, to bring lawsuits in United States district courts for either the law's civil penalties or for declaratory or injunctive relief, but PAFACA does not clearly specify what actions the Attorney General may take to enforce the law by administrative proceedings. Under PAFACA, petitions for review challenging the law itself or determinations made under the law may only be filed with the United States Court of Appeals for the District of Columbia Circuit. Other bills in the 118th United States Congress had proposed removing exceptions under the International Emergency Economic Powers Act that allowed Executive Order 13942 to be successfully challenged in court, with some authorizing, in addendum to removing the IEEPA exceptions, for the executive branch to impose visa restrictions on the employees of companies that owned the designated applications, to require U.S. nationals employed by the companies to register as foreign agents under the Foreign Agents Registration Act, or the specific power to prohibit transactions with companies that knowingly provide the user data of persons within U.S. jurisdiction to China. One bill would have authorized the creation of a new system to review transactions for national security risks by directing the President to create and maintain a list of "untrustworthy applications and social media entities" and by requiring the Federal Communications Commission to issue rules prohibiting app stores and internet service providers from supporting the applications. The proposed RESTRICT Act would have explicitly authorized review for information and communications technology and services transactions separate from the Commerce Department's ICTS supply chain rule created under the IEEPA, and would have created a separate process similar to the Committee on Foreign Investment in the United States to review foreign adversary holdings in ICTS companies. Other proposals involved expanding data privacy frameworks or cross-border data transfers that would restrict TikTok's data collection. ==Legislative history==

House of Representatives On March 7, 2024, the House Energy and Commerce Committee, to whom the bill had been referred, voted unanimously to report the bill favorably and without amendment. On March 13, PAFACA was passed by the House of Representatives. The vote was 352 to 65, with 50 Democrats and 15 Republicans voting against the bill. On April 20, 2024, the House passed a foreign aid package (H.R. 8038), the , as part of Public Law 118-50. The bill incorporates a modified version of PAFACA, with the time allowed for a sale to complete increased from 180 days to a minimum of 270 days. By bundling a potential TikTok ban or divestment with foreign aid, which has traditionally enjoyed bipartisan support in both chambers, the House pressured the United States Senate to act quickly with a combined vote, because rewriting the bill to exclude the provisions on TikTok would delay foreign aid. Senate Senator Rand Paul opposed the bill on First Amendment grounds and said he would hold it. His opposition prevented a similar bill (S. 85) from proceeding in 2023 but was not expected to be able to stop the foreign aid package. On April 23, 2024, the Senate passed the law, which included the 21st Century Peace through Strength Act along with three other bills, 79–18. Regarding the potential of a political backlash, then Senate Majority leader Chuck Schumer told reporters that House Republicans jammed the TikTok amendment into the $95 billion foreign aid package that could no longer wait and had to be "passed as quickly as possible". Republican political strategists pointed to the large Democrat following on TikTok and said that Biden, who signed the bill, will likely take the brunt of any blame. Lobbying TikTok and ByteDance spent millions on lobbying against the bill. Several civil liberties and digital rights advocacy organizations also lobbied against it, including the American Civil Liberties Union, the Electronic Frontier Foundation, the Knight First Amendment Institute, Fight for the Future, the Center for Democracy & Technology, Freedom of the Press Foundation, the Asian American Federation, Access Now, the Chinese Progressive Association, FreedomWorks and PEN America. == Response ==

Before the vote, TikTok had been encouraging users to call representatives with a full-screen notification about the upcoming bill, causing many congressional offices to be inundated with calls. During the House debate, various lawmakers mentioned the pop-up stating that the app was forcing its users to call their representative. The United States House Select Committee on Strategic Competition between the United States and the Chinese Communist Party stated that TikTok's push for users to contact lawmakers may have been illegal and called for the Federal Trade Commission to investigate. On March 11, 2024, former president Donald Trump denounced the bill, claiming that it would give too much power to Facebook and its owner Meta. Despite Trump denouncing the bill, many of his political allies voted in favor of it. Other supporters of a ban included hedge fund manager Bill Ackman and former Facebook executive Samuel Lessin. Representatives from the Chinese embassy met with U.S. congressional staffers to lobby against the legislation. Sources told The Wall Street Journal that the Publicity Department of the Chinese Communist Party instructed the country's state media outlets to increase positive coverage of ByteDance, although Beijing's overall response appeared to be muted. Some TikTok creators mobilized against the legislation. Individuals interviewed by CNN reacted negatively to the bill. leading to backlash from users on the app. As a result of the backlash Jackson lost approximately 200,000 followers. He later released an "apology video". Advocates and experts have called for Congress to pass comprehensive privacy legislation, rather than a bill focused mostly on TikTok. Jameel Jaffer of the Knight First Amendment Institute said Congress can address the problems associated with TikTok "without restricting Americans' access" to it by "passing a comprehensive privacy law". Evan Greer of the digital rights advocacy group Fight for the Future called for "strong privacy legislation to protect our data from all Big Tech companies" and governments. House Majority Leader Steve Scalise reportedly pressured K Street lobbyist groups with ties to TikTok/ByteDance to disassociate from the company, under threat of investigation by the House Select Committee on the Chinese Communist Party and prohibition from holding future meetings with congressional offices. On May 9, 2024, trade association NetChoice removed TikTok (which the firm had represented since 2019) as a member, after previously defending it in other efforts to ban or force divestiture of the platform. (Four days earlier, NetChoice filed an amicus brief requesting that the Ninth Circuit Court of Appeals uphold an injunction against Montana SB 419, a 2023 law that sought to ban TikTok from operating in the state, which was blocked by U.S. District Court Judge Donald Molloy in November 2023 before it was enacted.) Israel–Gaza war Some opponents to the bill stated that the renewed momentum for a ban stemmed from a belief that the unpopularity of Israel and the United States during the ongoing Gaza war grew because of TikTok, although evidence for that belief is unclear. The Jewish Federations of North America expressed support for the proposed ban ahead of the House vote, stating that "social media is a major driver" of increased antisemitism in the United States and that "TikTok is the worst offender by far." Sandra Tamari of Adalah said that if antisemitism was a concern, supporters of the TikTok ban would have also focused on X, which has many anti-Jewish conspiracies. The real reason, according to Tamari, is because "they don't have control over TikTok", which has allowed Palestinian voices to be heard directly. Edward Ahmed Mitchell, the national deputy director of the Council on American-Islamic Relations, said it would be "hypocritical for politicians" to restrict access to TikTok because of people expressing their support for Palestinian human rights on a platform that is less restrictive of such views, adding that young people have become more sympathetic to the Palestinians after getting information from outside of mainstream media. In May 2024, Senator Mitt Romney and House Representative Mike Lawler (both of whom backed the legislation) indicated that the PAFACA's passage was motivated by scrutiny from lawmakers supportive of Israel to criticism of both the Israel–Hamas war, and the Israel and United States governments' handling of the conflict, blaming TikTok in particular and social media more generally for shaping public opinion against Israel and contributing to protests opposing the war. Such claims spurred criticism from free speech and civil liberties advocates that the bill was intended as an implicit act of viewpoint discrimination prohibited by the First Amendment. Legal challenge TikTok and ByteDance filed suit against the U.S. government on May 7, 2024, a few weeks after the bill was passed. TikTok argued the bill interfered with free speech rights. Due to the timeline for divestment in January 2025, the lawsuit was placed on an accelerated schedule in the Court of Appeals for the District of Columbia Circuit as well as by the Supreme Court. Observers believe the court would likely uphold the law. The Court issued its per curiam decision upholding the constitutionality of the law on January 17, 2025. Senator Ed Markey introduced legislation after the oral arguments and before the deadline to extend the deadline for ByteDance and TikTok to comply with the law by 270 days, giving time for the Supreme Court to reach its decision and allow the companies to determine future plans if necessary. ==Enforcement==

from January 18 to mid-February 2025 On January 16, 2025, a Biden administration official stated that it would forego any decision on whether to enforce the ruling to the incoming second Trump administration, which took office on January 20. ByteDance opted to shutter TikTok and remove it from app stores on January 18, 2025, though stated in a message to users that they expect this to be a temporary outage pending Trump taking office. Oracle Corporation, which provides web services for TikTok, reportedly sought confirmation that the incoming administration would sign an executive order about the ban before restoring its services. Some TikTok users reported that they still could not access their accounts by using a virtual private network. The shutdown extended to CapCut, Lemon8, and Marvel Snap, all of which had ties to ByteDance. Trump affirmed on January 19, 2025, that he will issue an executive order to extend the deadline for ByteDance to seek a buyer once he was in office, which led to TikTok to restore service the same day with the assurances that Trump will not seek prosecution of app store providers. Trump suggested that the U.S. government may arrange to have a 50% ownership of TikTok, which would satisfy the ownership concerns of PAFACA, though would raise issues around moderation and the First Amendment. Trump signed the executive order on January 20 following his inauguration, delaying the enforcement of PAFACA for at least 75 days for his administration and promising immunity for companies that provided services to TikTok during that time. TikTok and other ByteDance apps remained unable to be downloaded from app stores in the aftermath of the ban, until being restored in mid-February, after Apple and Google received letters with assurances from the United States Department of Justice. telling 10 companies that they can continue providing services to TikTok despite federal law banning it Trump signed a second executive order on April 4, 2025, further delaying enforcement of the PAFACA by another 75 days; this came the same week Trump announced new tariffs on most of the US's trading partners including China, with Trump suggesting he would lower tariffs in exchange for ByteDance's sale of TikTok. Trump had nearly secured a deal that included ByteDance maintaining a minority position in a new company based in the U.S. and owned by American investors, but China withdrew its support for the deal due to Trump imposing reciprocal tariffs against it. Trump signed a new executive order on June 19, 2025, to give a third 90-day extension to ByteDance. On the eve of this last extension's deadline, in September 2025, Trump issued yet another order to push the deadline out to December 16, 2025, with The Wall Street Journal reporting that this period would allow ByteDance to negotiate with a consortium of American investors, including Oracle Corporation, Silver Lake, and Andreessen Horowitz, to take 80% ownership of TikTok and operate the service from American servers, with a new app that was in development by ByteDance. On July 3, Attorney General Pam Bondi's letters to tech companies including Apple and Google became public due to two lawsuits under the Freedom of Information Act. According to Bondi, because Trump had decided that an "abrupt shutdown" of TikTok would interfere with his "constitutional duties", PAFACA must give way to the President's "core presidential national security and foreign affairs powers". Additionally, the letters to Apple Inc., Google, and Microsoft claim that "the Department of Justice is also irrevocably relinquishing any claims the United States might have had against" the companies for violating the TikTok ban. Legal experts noted that presidents "don't have the power to change the law itself" and described the administration's "radical theory of presidential power" as an "astonishing" claim that "could set a very corrosive precedent." According to Jack Goldsmith, a Harvard Law School professor who previously led DOJ's Office of Legal Counsel, "the president and the attorney general have asserted a power to wipe out the effects of any law related to national security or foreign affairs on the president's say so", an assertion that is "maybe the broadest I have ever seen any president or Justice Department make, ever, in any context." On December 18, 2025, TikTok signed a memorandum to sell its operations in the United States to a consortium of investors that will hold a 50% ownership share in the joint venture, including Oracle, Silver Lake, and MGX (who would each hold a 15% share), while 30.1% will be held by affiliates of current ByteDance investors and 19.9% will be retained by ByteDance. The joint venture will have board of directors with seven members and a majority required to be American. The deal closed on January 22, 2026. == See also ==