The National Security Act of 2024 contains language to prevent app store availability and web hosting services for foreign adversary-controlled apps like TikTok in the U.S. However, the Protecting Americans from Foreign Adversary Controlled Applications Act, the central TikTok-related provision in the law, also permits TikTok to continue operating in the U.S. if its parent company, ByteDance, sells the app to a U.S.-approved firm. This is the most significant regulatory action taken against TikTok by either Congress or an administration. The law also includes the Protecting Americans’ Data from Foreign Adversaries Act, which prohibits the transfer of Americans’ personally identifiable sensitive data to foreign adversaries.
Below is an oversight guide and calendar for these new provisions.
The new legislation prohibits the distribution, maintenance, updating, or internet hosting of a foreign adversary-controlled application providing certain services within the United States. The provision specifically applies the prohibition to any such application operated directly or indirectly by ByteDance, TikTok, their subsidiaries, and any entity owned or controlled by them. Civil penalties will be imposed on any company that distributes or maintains TikTok unless “qualifying divestiture” takes place.
Therefore, ByteDance will likely be required to sell TikTok to an entity operating outside of the jurisdiction of a foreign adversary for that app to continue to operate within U.S. jurisdiction. After the legislation’s passage, the Chinese Foreign Ministry hinted at plans to retaliate, which could take the form of direct economic countermeasures or indirect actions. TikTok itself has already sued the U.S. Government, challenging the law as unconstitutional, and the courts have fast-tracked their lawsuit, which will be heard in September.
Specifically, the new legislation:
• Mandates that U.S.-approved entities, such as internet service providers and app stores, are prohibited from hosting the platform unless it spins off from ByteDance Ltd. within 270 days of the measure’s enactment (or 360 days if the president grants a one-time exception). Other applications could be subject to the same restrictions if they are controlled by a foreign adversary and the President determines they pose a national security risk. Oversight Opportunity – Congress can ensure that the executive branch enforces these changes in a manner consistent with Congressional intent and amends regulations and regulatory guidance appropriately.
• Bars companies from licensing, selling, or otherwise making available the sensitive data of U.S. residents to foreign adversaries, or companies controlled by foreign adversaries, such as China, Iran, North Korea, and Russia, within 60 days of the measure’s enactment. Oversight Opportunity – Congress can inquire upon enactment which companies have been identified by the administration.
• June 23, 2024—Companies will be barred from licensing, selling, or otherwise making available the sensitive data of U.S. residents to foreign adversaries (Section 2(d) of Division I).
• October 6, 2024—The latest date by which a challenge can be brought to the Protecting Americans from Foreign Adversary Controlled Applications Act contained in Division H (Sec. 3(c) of Division H).
• January 19, 2025—The prohibition on distributing, maintaining, updating, or internet hosting of a foreign adversary-controlled application goes into effect, including TikTok (Sec. 2(a)(2) of Division H).
• April 19, 2025—If the President grants a one-time extension of no more than 90 days, the prohibition on distributing, maintaining, updating, or internet hosting of a foreign adversary-controlled application will go into effect on this date. The extension can be granted if it is certified to Congress that (1) a path to executing a qualified divestiture has been identified with respect to such application; (2) evidence of significant progress toward executing such qualified divestiture has been produced with respect to such application; and (3) there are in place the relevant binding legal agreements to enable execution of such qualified divestiture during the period of such extension (Sec. 2(a)(3) of Division H).
Note: The dates and deadlines specified by Division H of the National Security Act, the Protecting Americans from Foreign Adversary Controlled Applications Act, are subject to judicial review. The United States Court of Appeals for the District of Columbia Circuit has exclusive jurisdiction over any challenge to this division. Any challenge must be brought no later than 165 days (October 6, 2024) after the enactment date of this division or in the case of a challenge to any action, finding, or determination under this division, not later than 90 days after such action, finding, or determination. Currently, due to ongoing litigation, the following dates apply:
• September 16, 2024—Oral arguments before the Court of Appeals;
• December 6, 2024—The date on which the U.S. Department of Justice and TikTok have requested a ruling.