# Protecting Americans from Foreign Adversary Controlled Applications Act

The Protecting Americans from Foreign Adversary Controlled Applications Act (PAFACA), signed into law on April 24, 2024, bans social networking services within 270 days if the president deems them a "foreign adversary controlled application," with a possible 90-day extension, covering websites and apps. The act explicitly applies to ByteDance Ltd. and its subsidiaries particularly TikTok with the company to become compliant by January 19, 2025. It ceases to be applicable if the foreign adversary controlled application is divested and no longer considered to be controlled by a foreign adversary of the United States.
PAFACA was introduced as H.R. 7521 during the 118th United States Congress by representatives Mike Gallagher and Raja Krishnamoorthi, following years of various attempts by federal lawmakers to ban TikTok in the country. The bill was passed by the House of Representatives on March 13, 2024. A modified version was passed by the House on April 20 as a rider to a foreign aid package, which was then passed by the Senate on April 23.
The bill was the subject of extensive lobbying by TikTok and ByteDance, as well as several advocacy groups and corporations. Critics of the act say a forced sale under the threat of a ban may be a violation of the First Amendment or motivated by political opinions regarding the Israel–Hamas war, and that a comprehensive privacy legislation would be more appropriate than singling out TikTok. ByteDance filed a lawsuit against the legislation on May 7, 2024. On January 17, 2025, the United States Supreme Court, upheld the earlier U.S. District of Columbia Circuit Court of Appeals ruling, finding the law to be constitutional and did not violate the First Amendment. The Biden administration left enforcement of the law to the then pending Trump administration.
TikTok shuttered its site on January 18, 2025, Google and Apple removed it from their app stores the following day. Donald Trump signed an executive order on January 20 following his inauguration, delaying the enforcement of PAFACA for at least 75 days. TikTok and other ByteDance apps remained unable to be downloaded from app stores in the aftermath of the ban, until being restored in mid-February.

## Background

TikTok had more than 150 million monthly users in the United States as of March 2023. The company has come under scrutiny since 2020, with American national security officials and lawmakers warning that its parent ByteDance's ties to China are national security risks and their government could access TikTok data to spy on Americans. There is no public evidence to show that American user data has already been accessed by the Chinese government.

### Prior regulatory actions

In May 2019, President Donald Trump issued Executive Order 13873 that declared a national emergency related to the security of U.S. supply chains for information and communications technology and services (ICTS), and Trump subsequently issued Executive Order 13942 in August 2020 to augment the previous executive order under the International Emergency Economic Powers Act (IEEPA) by directing the Secretary of Commerce to restrict TikTok's U.S. operations. TikTok and ByteDance filed a lawsuit against Executive Order 13942 that argued that it exceeded the statutory authority delegated under the IEEPA, and the court ruled in favor of the companies and issued a preliminary injunction in the case that barred the executive order from being enforced. In 2019, the Committee on Foreign Investment in the United States (CFIUS) conducted a retroactive national security review and investigation of ByteDance's acquisition of musical.ly (which ByteDance subsequently merged with TikTok) and referred the transaction to Trump for a presidential decision–which indicated that CFIUS could not mitigate identified national security risks arising from the transaction.
In August 2020, Trump issued a divestment order under section 721 of the Defense Production Act of 1950 (DPA) in response to the CFIUS review that required ByteDance to sell assets that support TikTok operations in the United States and U.S. user data obtained through TikTok and musical.ly, which TikTok and ByteDance challenged in a lawsuit under the Due Process Clause and Takings Clause of the Fifth Amendment and the Administrative Procedure Act. Before the injunction in the Executive Order 13942 lawsuit was scheduled to expire in June 2021, President Joe Biden rescinded Executive Orders 13873 and 13942 under Executive Order 14034, and the lawsuit against Executive Order 13942 was voluntarily dismissed by the parties. Executive Order 14034 more broadly required the Secretary of Commerce to identify and address national security risks from foreign internet and software based applications operating in the United States, but left the national emergency declaration and the DPA divestment order in place.
In January 2021, the Commerce Department issued an interim final rule and request for comments under Executive Order 13873 for ICTS supply chains that Executive Order 14034 expanded, and the Commerce Department issued a final rule for ICTS supply chains in June 2023. However, as of September 2023, the Commerce Department had not blocked any transactions under the ICTS supply chain rule and had only invoked the rule to subpoena China-based companies providing ICTS in the United States. Following the presidential transition of Joe Biden, the companies and the government filed a joint request in the DPA divestment order case for it to be held in abeyance while the parties attempted to negotiate a mutual agreement that the court granted in February 2021 and required the government to file status reports on the negotiations every 60 days. In December 2022, the No TikTok on Government Devices Act signed into law by Biden as part of the Consolidated Appropriations Act, 2023 required the Office of Management and Budget (OMB) to establish deadlines and develop guidelines for federal executive agencies to remove TikTok from all U.S. government computers and information technology that OMB issued in February 2023.

### National security concerns

In March 2024 the Office of the Director of National Intelligence (ODNI) said TikTok accounts from China "reportedly targeted candidates" during the 2022 United States elections and that China using TikTok to influence the 2024 United States elections could not be ruled out. Other members of the US law enforcement and intelligence communities have said China can leverage user data for influence operations and that TikTok can spy on users' activities. United States Secretary of State Antony Blinken stated that TikTok should be "ended one way or another".
China has said that any divestment of TikTok would need to comply with Chinese export regulations. A former Trump official said ByteDance is required to follow the 2017 National Intelligence Law and that even after divestment, TikTok would still need to scrub its source code. The Commerce Department has asserted that ByteDance has close ties to the Chinese Communist Party (CCP) and had signed an agreement with the public relations bureau of the Ministry of Public Security in 2019. In 2021 WangTouZhongWen Technology, aided by the China Internet Investment Fund, acquired a 1% golden share and board seat in a ByteDance subsidiary that owns TikTok's technology.
In 2021 research conducted by the Citizen Lab found no overt data transmission from TikTok to the Chinese government or servers in China but did not rule out that non-China servers could relay the data. Based on leaked materials, BuzzFeed News reported in June 2022 that ByteDance employees in China had repeatedly accessed American user data. ByteDance eventually dismissed four employees (two in China and two in US) who had accessed the user data of at least two journalists in order to find the sources of the leak.
Cybersecurity studies have shown that TikTok similar amounts of data as its competitors. In 2023, Forbes reported that the Taxpayer Identification Numbers including Social Security numbers of American content creators and businesses being paid by TikTok were stored in China and accessible by ByteDance employees there, and a company software hosting internal TikTok information seen by Forbes had been inspected by Chinese cybersecurity agents ahead of the 20th National Congress of the CCP. A former executive suing ByteDance for wrongful dismissal alleged that its internal CCP committee was granted access to the user data of pro-democracy activists in Hong Kong in 2018, while another lawsuit in December 2019 alleged that user data was harvested and sent to servers located in China.
TikTok and ByteDance have acknowledged that their policies in 2019 and 2020, no longer applicable globally, could be used to suppress topics politically sensitive in China and other countries but claimed that this was done to "[minimize] conflict on the platform". In November 2023, members of the U.S. Intelligence Community and an Australian Strategic Policy Institute researcher raised concerns that TikTok and other social media platforms can be used by the CCP and the Chinese govenment to shape political narrative.

#### Criticism

Observers have argued that the national security concerns raised are largely hypothetical. There is insufficient public evidence to show that American user data has been accessed by or shared with the Chinese government, with some claims reportedly exaggerated. Biden himself was on TikTok as the president, while Trump has reversed his previous position. Lawmakers against the bill said the process was quickly rushed. According to computer security specialist Bruce Schneier, which company owns TikTok may also be irrelevant, as Russia interfered in the 2016 US elections using Facebook without owning it.
TikTok said the company takes regular action against covert influence networks and has "more than 150 elections globally" behind it. ByteDance is incorporated in the Cayman Islands, while TikTok Inc. is incorporated in California and Delaware and says 60% of ByteDance is owned by global institutional investors. In response to lawmaker concerns about data privacy, TikTok began an initiative called "Project Texas" to locally store all American data monitored by employees of the Oracle Corporation.

### Pro-Palestine hashtags

In 2023, an apparent spike in pro-Palestine content appeared on TikTok following the Israeli bombing of the Gaza Strip in response to the Hamas-led attack on Israel. Representative Mike Gallagher (R-WI) decried "rampant pro-Hamas propaganda on the app" in his push for a ban. This was echoed by senators Josh Hawley and Marco Rubio. Gallup polling data going back to 2010 shows that younger Americans, who are more likely to use TikTok, show greater sympathy for Palestine than Israel.
The company also denied intentionally boosting pro-Palestine hashtags, saying regions such as the Middle East and South East Asia account for a significant proportion of its user views and content, and it is easy to cherry pick hashtags to fit certain narratives. Some for example may have fewer videos but receive more views, or be much older than newer tags.

## Provisions

PAFACA prohibits the distribution, maintenance, or updating of "foreign adversary controlled applications" by web hosting services and app stores unless the application's owners execute a "qualified divestiture" within 270 days of the application being designated as a foreign adversary controlled application. This effectively bans affected services from the U.S. market. While TikTok and the applications of ByteDance and its subsidiaries are explicitly designated as foreign adversary controlled applications under the law, applications owned and operated by other companies may be designated if:
* The application is "a website, desktop application, mobile application, or augmented or immersive technology application" that allows registered users to "generate, share, and view text, images, videos, real-time communications, or similar content" and has at least 1 million monthly active users, unless the application's "primary purpose" is to allow "users to post product reviews, business reviews, or travel information and reviews";
* The application is operated by persons domiciled in, headquartered in, maintaining a principal place of business in, or organized under the laws of a country designated as a U.S. foreign adversary under Section 4872(d)(2) of Title 10 of the United States Code, or is operated by a company with at least 20% of its ownership stake held by such persons;
* The application has been determined by the President to present a significant national security threat.
The president may grant a one-time extension of the divestiture deadline by as long as 90 days if a path to a qualified divestiture has been identified, "significant" progress has been made to executing the divestiture, and legally binding agreements for facilitating the divestiture are in place. For divestitures to qualify under PAFACA, the President must determine through an interagency process that the application is no longer controlled by, or has no operational relationship with, a foreign adversary after the transaction is completed, and restrictions under the law cease to apply upon completion of the transaction. However, PAFACA does not require the owners of designated applications to execute a qualified divestiture. Before the divestiture deadline, the company that owns the designated application must provide users their data from the service at their request and in a machine readable format. Web hosting services and app stores that do not comply with the restrictions on distribution, maintenance, and updating of designated applications are subject to civil penalties of $5,000 per U.S. user that accesses, maintains, or updates the application, while the owners of designated applications are subject to civil penalties of $500 per U.S. user that is not provided their data as required by the law.
The Attorney General is authorized under PAFACA to investigate potential violations of its terms and, upon determination of violations, to bring lawsuits in United States district courts for either the law's civil penalties or for declaratory or injunctive relief, but PAFACA does not clearly specify what actions the Attorney General may take to enforce the law by administrative proceedings. Under PAFACA, petitions for review challenging the law itself or determinations made under the law may only be filed with the United States Court of Appeals for the District of Columbia Circuit. Other bills in the 118th United States Congress had proposed removing exceptions under the International Emergency Economic Powers Act that allowed Executive Order 13942 to be successfully challenged in court, with some authorizing, in addendum to removing the IEEPA exceptions, for the executive branch to impose visa restrictions on the employees of companies that owned the designated applications, to require U.S. nationals employed by the companies to register as foreign agents under the Foreign Agents Registration Act, or the specific power to prohibit transactions with companies that knowingly provide the user data of persons within U.S. jurisdiction to China.
One bill would have authorized the creation of a new system to review transactions for national security risks by directing the President to create and maintain a list of "untrustworthy applications and social media entities" and by requiring the Federal Communications Commission to issue rules prohibiting app stores and internet service providers from supporting the applications. The proposed RESTRICT Act would have explicitly authorized review for information and communications technology and services transactions separate from the Commerce Department's ICTS supply chain rule created under the IEEPA, and would have created a separate process similar to the Committee on Foreign Investment in the United States to review foreign adversary holdings in ICTS companies. Other proposals involved expanding data privacy frameworks or cross-border data transfers that would restrict TikTok's data collection.

## Legislative history
### House of Representatives

On March 7, 2024, the House Energy and Commerce Committee, to whom the bill had been referred, voted unanimously to report the bill favorably and without amendment. On March 13, PAFACA was passed by the House of Representatives. The vote was 352 to 65, with 50 Democrats and 15 Republicans voting against the bill.
On April 20, 2024, the House passed a foreign aid package (H.R. 8038), the 21st Century Peace through Strength Act, as part of Public Law 118-50. The bill incorporates a modified version of PAFACA, with the time allowed for a sale to complete increased from 180 days to a minimum of 270 days. By bundling a potential TikTok ban or divestment with foreign aid, which has traditionally enjoyed bipartisan support in both chambers, the House pressured the United States Senate to act quickly with a combined vote, because rewriting the bill to exclude the provisions on TikTok would delay foreign aid.

### Senate

Senator Rand Paul opposed the bill on First Amendment grounds and said he would hold it. His opposition prevented a similar bill (S. 85) from proceeding in 2023 but was not expected to be able to stop the foreign aid package. On April 23, 2024, the Senate passed the law, which included the 21st Century Peace through Strength Act along with three other bills, 79–18. Regarding the potential of a political backlash, then Senate Majority leader Chuck Schumer told reporters that House Republicans jammed the TikTok amendment into the $95 billion foreign aid package that could no longer wait and had to be "passed as quickly as possible". Republican political strategists pointed to the large Democrat following on TikTok and said that Biden, who signed the bill, will likely take the brunt of any blame.

### Lobbying

TikTok and ByteDance spent millions on lobbying against the bill. Several civil liberties and digital rights advocacy organizations also lobbied against it, including the American Civil Liberties Union, the Electronic Frontier Foundation, the Knight First Amendment Institute, Fight for the Future, the Center for Democracy & Technology, Freedom of the Press Foundation, the Asian American Federation, Access Now, the Chinese Progressive Association, FreedomWorks and PEN America. Groups lobbying for the bill included the Foundation for Defense of Democracies, State Armor Action, the Heritage Foundation, Americans for Prosperity, the American Principles Project, Hadassah and the Anti-Defamation League. Other industry and advocacy groups that reportedly lobbied for or against the bill included Oracle, Google, LinkedIn, Lenovo, Dell Technologies, the NCTA, the Competitive Carriers Association, and Issue One.

## Response

Before the vote, TikTok had been encouraging users to call representatives with a full-screen notification about the upcoming bill, causing many congressional offices to be inundated with calls. During the House debate, various lawmakers mentioned the pop-up stating that the app was forcing its users to call their representative. The United States House Select Committee on Strategic Competition between the United States and the Chinese Communist Party stated that TikTok's push for users to contact lawmakers may have been illegal and called for the Federal Trade Commission to investigate.
On March 11, 2024, former president Donald Trump denounced the bill, claiming that it would give too much power to Facebook and its owner Meta. Despite Trump denouncing the bill, many of his political allies voted in favor of it. Other supporters of a ban included hedge fund manager Bill Ackman and former Facebook executive Samuel Lessin.
Shortly after the House of Representatives vote, a spokesperson for China's Foreign Ministry said the bill was putting the U.S. on "the opposite side of the principle of fair competition and international economic and trade rules." Representatives from the Chinese embassy met with U.S. congressional staffers to lobby against the legislation. Sources told The Wall Street Journal that the Publicity Department of the Chinese Communist Party instructed the country's state media outlets to increase positive coverage of ByteDance, although Beijing's overall response appeared to be muted.
Some TikTok creators mobilized against the legislation. Individuals interviewed by CNN reacted negatively to the bill. North Carolina Representative Jeff Jackson, who had grown a large following on TikTok, voted in favor of the bill, leading to backlash from users on the app. As a result of the backlash Jackson lost approximately 200,000 followers. He later released an "apology video".
Advocates and experts have called for Congress to pass comprehensive privacy legislation, rather than a bill focused mostly on TikTok. Jameel Jaffer of the Knight First Amendment Institute said Congress can address the problems associated with TikTok "without restricting Americans' access" to it by "passing a comprehensive privacy law". Evan Greer of the digital rights advocacy group Fight for the Future called for "strong privacy legislation to protect our data from all Big Tech companies" and governments. Justin Sherman, an adjunct professor at Duke University, said that TikTok's ownership by ByteDance "should prompt real national security questions" but "the US also needs comprehensive privacy and cybersecurity regulations for all companies." Critics of the legislation have outlined that American platforms such as Facebook and Twitter have been targeted by foreign influence operations, including by the Chinese government, in the recent past. As lawmakers focused their attention on TikTok, Facebook began allowing political ads again that questioned the 2020 U.S. presidential election results.
A group of free speech and civil rights petitioners including the ACLU argued that the government "cannot accomplish indirectly what it is barred from doing directly". A potential ban to force a sale may violate the First Amendment, including prohibiting app stores from carrying TikTok, if the threat to national security does not justify such measures or if they are ineffective at addressing the underlying security concerns.
House Majority Leader Steve Scalise reportedly pressured K Street lobbyist groups with ties to TikTok/ByteDance to disassociate from the company, under threat of investigation by the House Select Committee on the Chinese Communist Party and prohibition from holding future meetings with congressional offices. On May 9, 2024, trade association NetChoice removed TikTok (which the firm had represented since 2019) as a member, after previously defending it in other efforts to ban or force divestiture of the platform. (Four days earlier, NetChoice filed an amicus brief requesting that the Ninth Circuit Court of Appeals uphold an injunction against Montana SB 419, a 2023 law that sought to ban TikTok from operating in the state, which was blocked by U.S. District Court Judge Donald Molloy in November 2023 before it was enacted.)

### Israel–Hamas war

Some opponents to the bill stated that the renewed momentum for a ban stemmed from a belief that the unpopularity of Israel and the United States during the ongoing Israel–Hamas war grew because of TikTok, although evidence for that belief is unclear. The Jewish Federations of North America expressed support for the proposed ban ahead of the House vote, stating that "social media is a major driver" of increased antisemitism in the United States and that "TikTok is the worst offender by far." Sandra Tamari of Adalah said that if antisemitism was a concern, supporters of the TikTok ban would have also focused on X, which has many anti-Jewish conspiracies. The real reason, according to Tamari, is because "they don't have control over TikTok", which has allowed Palestinian voices to be heard directly.
Edward Ahmed Mitchell, the national deputy director of the Council on American-Islamic Relations, said it would be "hypocritical for politicians" to restrict access to TikTok because of people expressing their support for Palestinian human rights on a platform that is less restrictive of such views, adding that young people have become more sympathetic to the Palestinians after getting information from outside of mainstream media.
In May 2024, Senator Mitt Romney and House Representative Mike Lawler (both of whom backed the legislation) indicated that the PAFACA's passage was motivated by scrutiny from lawmakers supportive of Israel to criticism of both the Israel–Hamas war, and the Israel and United States governments' handling of the conflict, blaming TikTok in particular and social media more generally for shaping public opinion against Israel and contributing to protests opposing the war. Such claims spurred criticism from free speech and civil liberties advocates that the bill was intended as an implicit act of viewpoint discrimination prohibited by the First Amendment.

### Legal challenge

TikTok and ByteDance filed suit against the U.S. government on May 7, 2024, a few weeks after the bill was passed. TikTok argued the bill interfered with free speech rights. Due to the timeline for divestment in January 2025, the lawsuit was placed on an accelerated schedule in the Court of Appeals for the District of Columbia Circuit as well as by the Supreme Court. Observers believe the court would likely uphold the law. The Court issued its per curiam decision upholding the constitutionality of the law on January 17, 2025.
Senator Ed Markey introduced legislation after the oral arguments and before the deadline to extend the deadline for ByteDance and TikTok to comply with the law by 270 days, giving time for the Supreme Court to reach its decision and allow the companies to determine future plans if necessary.

## Enforcement

On January 16, 2025, a Biden administration official stated that it would forego any decision on whether to enforce the ruling to the incoming second Trump administration, which takes office on January 20.
ByteDance opted to shutter TikTok and remove it from app stores on January 18, 2025, though stated in a message to users that they expect this to be a temporary outage pending Trump taking office. Oracle Corporation, which provides web services for TikTok, reportedly sought confirmation that the incoming administration would sign an executive order about the ban before restoring its services. Some TikTok users reported that they still could not access their accounts by using a virtual private network. The shutdown extended to CapCut, Lemon8, and Marvel Snap, all of which had ties to ByteDance.
Trump affirmed on January 19, 2025, that he will issue an executive order to extend the deadline for ByteDance to seek a buyer once he was in office, which led to TikTok to restore service the same day with the assurances that Trump will not seek prosecution of app store providers. Trump suggested that the U.S. government may arrange to have a 50% ownership of TikTok, which would satisfy the ownership concerns of PAFACA, though would raise issues around moderation and the First Amendment. Trump signed the executive order on January 20 following his inauguration, delaying the enforcement of PAFACA for at least 75 days for his administration and promising immunity for companies that provided services to TikTok during that time. TikTok and other ByteDance apps remained unable to be downloaded from app stores in the aftermath of the ban, until being restored in mid-February.