Protecting Americans from Foreign Adversary Controlled Applications Act
The Protecting Americans from Foreign Adversary Controlled Applications Act, is a United States federal law passed by the United States Congress and signed into law by President Biden on April 24, 2024 banning social networking services within 270 days defined as a "foreign adversary controlled application" if the president deems them a national security threat, with a possible 90-day extension. The act explicitly applies to ByteDance Ltd. and its subsidiaries, particularly TikTok, with the company to become compliant by January 19, 2025. It ceases to be applicable if the foreign adversary controlled application is divested and no longer considered to be controlled by a foreign adversary.
PAFACA was introduced as H.R. 7521 during the 118th United States Congress by representatives Mike Gallagher and Raja Krishnamoorthi, following years of various attempts by federal lawmakers to ban TikTok in the country. A modified version was passed by the House on April 20, 2024, as a rider to a foreign aid package, which was then passed by the Senate on April 23.
Critics of the act say a forced sale under the threat of a ban may be a violation of the First Amendment or motivated by political opinions regarding the Gaza war, and that comprehensive privacy legislation would be more appropriate than singling out TikTok. ByteDance filed a lawsuit challenging the legislation on May 7, 2024. The District of Columbia Circuit Court of Appeals found the law to be constitutional. The ruling was later upheld by the Supreme Court. TikTok shuttered its site on January 18, 2025, and Google and Apple removed it from their app stores the following day.
Donald Trump signed an executive order on January 20, 2025, following his inauguration, delaying the enforcement of PAFACA for 75 days, upon which TikTok was restored to app storefronts. As of September 2025, Trump has extended the deadline three further times through executive orders, claiming constitutional executive power to ignore the law's enforcement, while negotiating with ByteDance to have a controlling interest in TikTok by American investors as to satisfy the PAFACA requirements. In December 2025, TikTok agreed to a sale that will allow its U.S. operations to continue in compliance with the terms of PAFACA.
Background
TikTok had more than 150 million monthly users in the United States as of March 2023. The company has come under scrutiny since 2020, with American national security officials and lawmakers warning that its parent ByteDance's ties to China are national security risks and the Chinese government could access TikTok data to spy on Americans. According to the Associated Press published in The Hill, as of March 2023, there was no evidence that TikTok had "turned over" to the Chinese government personal data "relevant" to China's national security. CNN also reported that there was "still no public evidence the Chinese government has actually spied on people through TikTok."In May 2023, an ex-ByteDance employee claimed the Chinese Communist Party members in ByteDance's Beijing office "maintained supreme access to all the company data, even data stored in the United States" in his wrongful termination complaint. A CNN article described it as potentially the first public evidence. ByteDance called the allegations a publicity grab. In December 2024, a federal judge ageed with ByteDance that the ex-employee had lied and faked evidence.
Prior regulatory actions
In May 2019, President Donald Trump issued Executive Order 13873 that declared a national emergency related to the security of U.S. supply chains for information and communications technology and services, and Trump subsequently issued Executive Order 13942 in August 2020 to augment the previous executive order under the International Emergency Economic Powers Act by directing the Secretary of Commerce to restrict TikTok's U.S. operations. TikTok and ByteDance filed a lawsuit against Executive Order 13942 that argued that it exceeded the statutory authority delegated under the IEEPA, and the court ruled in favor of the companies and issued a preliminary injunction in the case that barred the executive order from being enforced. In 2019, the Committee on Foreign Investment in the United States conducted a retroactive national security review and investigation of ByteDance's acquisition of musical.ly and referred the transaction to Trump for a presidential decision–which indicated that CFIUS could not mitigate identified national security risks arising from the transaction.In August 2020, Trump issued a divestment order under section 721 of the Defense Production Act of 1950 in response to the CFIUS review that required ByteDance to sell assets that support TikTok operations in the United States and U.S. user data obtained through TikTok and musical.ly, which TikTok and ByteDance challenged in a lawsuit under the Due Process Clause and Takings Clause of the Fifth Amendment and the Administrative Procedure Act. Before the injunction in the Executive Order 13942 lawsuit was scheduled to expire in June 2021, President Joe Biden rescinded Executive Orders 13873 and 13942 under Executive Order 14034, and the lawsuit against Executive Order 13942 was voluntarily dismissed by the parties. Executive Order 14034 more broadly required the Secretary of Commerce to identify and address national security risks from foreign internet and software based applications operating in the United States, but left the national emergency declaration and the DPA divestment order in place.
In January 2021, the Commerce Department issued an interim final rule and request for comments under Executive Order 13873 for ICTS supply chains that Executive Order 14034 expanded, and the Commerce Department issued a final rule for ICTS supply chains in June 2023. However, as of September 2023, the Commerce Department had not blocked any transactions under the ICTS supply chain rule and had only invoked the rule to subpoena China-based companies providing ICTS in the United States. Following the presidential transition of Joe Biden, the companies and the government filed a joint request in the DPA divestment order case for it to be held in abeyance while the parties attempted to negotiate a mutual agreement that the court granted in February 2021 and required the government to file status reports on the negotiations every 60 days. In December 2022, the No TikTok on Government Devices Act signed into law by Biden as part of the Consolidated Appropriations Act, 2023 required the Office of Management and Budget to establish deadlines and develop guidelines for federal executive agencies to remove TikTok from all U.S. government computers and information technology that OMB issued in February 2023.
National security concerns
In March 2024, the Office of the Director of National Intelligence said TikTok accounts from China "reportedly targeted candidates" during the 2022 United States elections and that China using TikTok to influence the 2024 United States elections could not be ruled out. Other members of the US law enforcement and intelligence communities have said China can leverage user data for influence operations and that TikTok can spy on users' activities. United States Secretary of State Antony Blinken stated that TikTok should be "ended one way or another".China has said that any divestment of TikTok would need to comply with Chinese export regulations. A former Trump official said ByteDance is required to follow the 2017 National Intelligence Law and that even after divestment, TikTok would still need to scrub its source code. The Commerce Department has asserted that ByteDance has close ties to the CCP and had signed an agreement with the public relations bureau of the Ministry of Public Security in 2019. In 2021 WangTouZhongWen Technology, aided by the China Internet Investment Fund, acquired a 1% golden share and board seat in a ByteDance subsidiary that owns TikTok's technology.
In 2021 research conducted by the Citizen Lab found no overt data transmission from TikTok to the Chinese government or servers in China but did not rule out that non-China servers could relay the data. Based on leaked materials, BuzzFeed News reported in June 2022 that ByteDance employees in China had repeatedly accessed American user data. ByteDance eventually dismissed four employees who had accessed the user data of at least two journalists in order to find the sources of the leak.
Cybersecurity studies have shown that TikTok similar amounts of data as its competitors. In 2023, Forbes reported that the Taxpayer Identification Numbers including Social Security numbers of American content creators and businesses being paid by TikTok were stored in China and accessible by ByteDance employees there, and a company software hosting internal TikTok information seen by Forbes had been inspected by Chinese cybersecurity agents ahead of the 20th National Congress of the CCP. A former executive suing ByteDance for wrongful dismissal alleged that its internal CCP committee was granted access to the user data of pro-democracy activists in Hong Kong in 2018, while another lawsuit in December 2019 alleged that user data was harvested and sent to servers located in China. In December 2024, the former executive was found out by a U.S. federal judge to have lied and fabricated evidence.
TikTok and ByteDance have acknowledged that their policies in 2019 and 2020, no longer applicable globally, could be used to suppress topics politically sensitive in China and other countries but claimed that this was done to " conflict on the platform". In November 2023, members of the U.S. Intelligence Community and an Australian Strategic Policy Institute researcher raised concerns that TikTok and other social media platforms can be used by the CCP and the Chinese government to shape political narrative.
Criticism
Observers have argued that the national security concerns raised are largely hypothetical. There is insufficient public evidence to show that American user data has been accessed by or shared with the Chinese government, with some claims reportedly exaggerated. Biden himself was on TikTok as the president, while Trump has reversed his previous position. Lawmakers against the bill said the process was quickly rushed. According to computer security specialist Bruce Schneier, which company owns TikTok may also be irrelevant, as Russia interfered in the 2016 US elections using Facebook without owning it.TikTok said the company takes regular action against covert influence networks and has "more than 150 elections globally" behind it. ByteDance is incorporated in the Cayman Islands, while TikTok Inc. is incorporated in California and Delaware and says 60% of ByteDance is owned by global institutional investors. In response to lawmaker concerns about data privacy, TikTok began an initiative called "Project Texas" to locally store all American data monitored by employees of the Oracle Corporation.