Legal Sidebari

H.R. 7521 Regulation of TikTok: Analysis of
Selected Legal Issues
March 20, 2024
On March 13, 2024, the House of Representatives passed the Protecting Americans from Foreign
Adversary Controlled Applications Act (H.R. 7521). If enacted, H.R. 7521 would make it unlawful to
provide certain services to “distribute, maintain, or update . . . a foreign adversary controlled application”
within the United States. The bill expressly includes applications operated by TikTok or its parent
company ByteDance, Ltd. in the definition of “foreign adversary controlled application.” This Legal
Sidebar summarizes the substantive provisions in H.R. 7521, analyzes the bill’s provisions related to
enforcement and judicial review, and addresses potential constitutional considerations related to the bill,
focusing on questions that have been raised regarding application of the Bill of Attainder Clause and the
First Amendment’s Free Speech Clause. Other CRS products discuss policy considerations with H.R.
7521, address other legal considerations raised by proposals to restrict TikTok, and provide more
information on the technology used by TikTok.
Overview of H.R. 7521
On March 7, 2024, the House Committee on Energy and Commerce held a hearing titled “Legislation to
Protect American Data and National Security from Foreign Adversaries” and voted unanimously to
advance the two bills discussed at the hearing. Both bills—H.R. 7521 and the Protecting Americans’ Data
from Foreign Adversaries Act of 2024 (H.R. 7520)—were favorably reported to the House without
amendment. H.R. 7521 then passed the full House less than one week later, on March 13, 2024.
(H.R. 7520 subsequently passed the House on March 20.)
H.R. 7521 would regulate “foreign adversary controlled applications” and the app stores and internet
hosting services through which users access them. The bill expressly defines a foreign adversary
controlled application to include applications operated by TikTok and any other subsidiary of TikTok’s
parent company ByteDance, Ltd. The definition also includes any other website, app, or augmented or
immersive technology that (1) meets certain definitional requirements (e.g., allows users to share content
with each other and has more than 1 million monthly active users); (2) is owned by a company located in,
or a company for which persons owning at least a 20% stake are located in, a foreign adversary controlled
country listed in 10 U.S.C. § 4872(d)(2); and (3) has been determined by the President to present a
significant national security threat. The bill excludes applications from these definitional requirements if
Congressional Research Service
https://crsreports.congress.gov
LSB11127
CRS Legal Sidebar
Prepared for Members and
Committees of Congress

---

Congressional Research Service
2
the “primary purpose” of the application “is to allow users to post product reviews, business reviews, or
travel information and reviews.”
Under the bill, app stores and internet hosting services would be prohibited from enabling the distribution,
maintenance, or updating of foreign adversary controlled applications. This prohibition would take effect
180 days after the date of enactment for TikTok and other applications operated by ByteDance or its
subsidiaries. If the President were to determine that another application qualified as a foreign adversary
controlled application, the prohibition would take effect with respect to such application 180 days after
the applicable presidential determination. During the 180-day period between designation as a foreign
adversary controlled application and the effective date of the prohibition, a foreign adversary controlled
application would be required to provide U.S. users, upon request, with all the data related to their
accounts, including their posts, photos, and videos, in a machine readable format.
Foreign adversary controlled applications, app stores, and internet hosting services would face civil
penalties if they do not comply with these provisions. An app store or internet hosting service that
continues to enable distribution, maintenance, or updates for a banned application could be subject to civil
penalties of up to $5,000 multiplied by the number of U.S. users who accessed, maintained, or updated
the application. A foreign adversary controlled application that fails to provide user data as required could
be subject to civil penalties of up to $500 multiplied by the number of affected users.
H.R. 7521’s restrictions would not apply to TikTok or any other foreign adversary controlled application
if the application completes a “qualified divestiture.” For a divestiture to qualify, the President would
have to determine that application is no longer controlled by, and has no operational relationship with, a
foreign adversary. Because the prohibition on app stores and internet hosting services enabling the
distribution, maintenance, or updating of foreign adversary controlled applications would not take effect
for 180 days—from the date of enactment for applications operated by TikTok or ByteDance, or from the
date of the relevant presidential determination for other applications—a qualified divestiture completed
within this 180-day period would prevent the prohibition from taking effect. Even after the end of the
180-day period, H.R. 7521’s restrictions would cease to apply once a qualified divestiture has been
completed.
Enforcement and Judicial Review
Section 2(d) of H.R. 7521 governs enforcement of the act. Section 2(d)(1) would impose civil penalties
on entities who violate the act’s prohibitions. Section 2(d)(2) would provide for enforcement by the
Attorney General. Specifically, Section 2(d)(2)(A) authorizes the Attorney General to investigate potential
violations and provides that “if such an investigation results in a determination that a violation has
occurred, the Attorney General shall pursue enforcement under paragraph (1).” Section 2(d)(2)(B)
authorizes the Attorney General, upon determination that a violation has occurred, to “bring an action in
an appropriate district court of the United States for appropriate relief, including civil penalties under
paragraph (1) or declaratory and injunctive relief.”
Section 2(d)(2)(B) would authorize the Attorney General to sue in federal district court to sanction and
remedy violations of H.R. 7521. It is not clear whether the directive in Section 2(d)(2)(A) that the
Attorney General “shall pursue enforcement under paragraph (1)” seeks to provide for enforcement other
than via civil suits under Section 2(d)(2)(B). To the extent Section 2(d)(2)(A) seeks to authorize
enforcement through other means, such as administrative proceedings, the bill does not clearly specify
what would be authorized.
Section 3 of H.R. 7521 would limit judicial review of the act itself or any enforcement actions taken
pursuant to the act. Section 3(a) provides, “A petition for review challenging this Act or any action,
finding, or determination under this Act may be filed only in the United States Court of Appeals for the
District of Columbia Circuit.” The term “petition for review” is generally used in other statutes to refer to

---

Congressional Research Service
3
judicial review of agency action. Because it is not clear whether and to what extent H.R. 7521 authorizes
administrative enforcement or other agency actions apart from civil suits, there may be uncertainty about
what this provision includes. To the extent Section 2(d)(2)(A) of the act would authorize administrative
enforcement, Section 3(a) would require petitions for review of such agency action to proceed in the D.C.
Circuit.
Section 3(b) provides that the D.C. Circuit “shall have exclusive jurisdiction over any challenge to this
Act or any action, finding, or determination under this Act.” If H.R. 7521 were enacted, constitutional
challenges to the act could potentially arise in two ways other than via petitions for review of agency
action. First, regulated entities or others alleging imminent harm under the act could sue to prevent
enforcement of the act. This might take the form of a pre-enforcement (or offensive) challenge to the act
seeking to enjoin (i.e., prevent) the Attorney General from enforcing the act. A challenge to a presidential
determination under the act might also proceed in this posture. Under current law, a pre-enforcement
challenge to a federal law is generally brought by filing a civil action in a trial-level federal district court.
However, because Section 3(b) grants the D.C. Circuit exclusive jurisdiction over challenges to the act or
to actions or determinations under the act, it appears that such challenges would need to proceed in the
D.C. Circuit.
Second, if the Attorney General sued a person for violating the act, the defendant might raise a
constitutional claim as a defense to liability (which is sometimes called a defensive challenge). A
defensive challenge is ordinarily raised in response to a suit in the court where the case was commenced.
Section 2(d)(2)(B) authorizes the Attorney General to bring enforcement suits in federal district court, so,
absent special rules sending litigation to a different court, a defensive constitutional challenge to the act
would generally proceed in the same case in the same district court. However, under Section 3(b), it
appears that such challenges would need to proceed in the D.C. Circuit. This could mean that cases that
the Attorney General filed in district court would need to be transferred or otherwise referred to the D.C.
Circuit if the defendant raised a constitutional defense. H.R. 7521 does not expressly provide for such
transfer or referral, leaving some uncertainty about how a defensive challenge would proceed.
As a constitutional matter, Congress has substantial authority to direct certain federal cases to specific
federal courts, and some existing statutes require certain categories of cases to proceed in the D.C.
Circuit. Existing laws that route cases to the D.C. Circuit generally apply to appeals, or to petitions for
review of agency action, which sometimes begin in the federal appeals courts. Section 3(a) of the act
would be similar to these existing laws. By contrast, sending matters to the D.C. Circuit before they are
considered by a trial court or an administrative agency would be unusual. Congress generally does not
provide for lawsuits to commence in the federal appeals courts or to be transferred to a federal appellate
court if a defendant raises a particular defense. Statutes that direct certain cases to specific courts have
been subject to significant litigation. Because Section 3 of H.R. 7521 appears to provide for novel
treatment of some cases and does not clearly specify the applicable procedures, litigation around the act’s
jurisdiction and venue provisions could occur if the bill became law. Such litigation would not be likely to
cast doubt on the constitutionality of the act but could impose costs and delays in enforcement.
Bill of Attainder Analysis of H.R. 7521
Article I, Section 9, clause 3, of the Constitution prohibits Congress from enacting bills of attainder—
legislation that directly imposes punishment on an identifiable person or class of persons. Because H.R.
7521 applies to TikTok and ByteDance by name and imposes legal consequences that the companies find
objectionable, there is some risk that, if enacted, the legislation might be challenged as a bill of attainder.
However, there are several reasons why courts may be unlikely to strike down the legislation on that
ground.

---

Congressional Research Service
4
In the leading bill of attainder case, Nixon v. Administrator of General Services, the Supreme Court held
that legislation constitutes a bill of attainder if it (1) applies with specificity and (2) imposes punishment
(3) without a judicial trial. All three requirements must be satisfied before a court will strike down a law
as a bill of attainder.
With respect to specificity, as a technical matter, the civil penalties in H.R. 7521 would not apply only to
the named companies. The President could determine that additional applications qualify as foreign
adversary controlled applications, and the civil penalties provided in the bill could apply both to
companies that operate any foreign adversary controlled application and entities that enable the
distribution or maintenance of the applications. The bill does name TikTok and ByteDance and would
impose a burden on the named companies, however, essentially requiring a qualified divestiture within
180 days to allow app stores to continue lawfully providing applications operated by those companies to
U.S. users. A court could therefore find that the legislation satisfied the specificity requirement.
Importantly, however, specificity standing alone is never sufficient to support a finding that a law is a bill
of attainder; the law must also impose punishment without trial.
The determination of whether a law imposes punishment is complex and fact-based. A CRS In Focus
provides analysis of how courts might apply the relevant legal standards to international sanctions
legislation. H.R. 7521 is not sanctions legislation, but much of that analysis would also apply to the
current bill. As a general matter, review of whether legislation is punitive for purposes of the Bill of
Attainder Clause is deferential, and federal courts rarely strike down laws as bills of attainder. Courts are
more likely to strike down legislation as a bill of attainder if it imposes punishment resembling criminal
penalties based on a determination that the targeted entity has engaged in culpable conduct in the past.
Courts are less likely to strike down legislation that reasonably serves a nonpunitive, forward-looking
legislative purpose. To the extent a court determined that H.R. 7521 was intended to protect national
security rather than punishing the named companies, it would likely find that the legislation did not
impose punishment for purposes of the Bill of Attainder Clause.
Finally, the Bill of Attainder Clause bans only laws that impose punishment without trial. Section
2(d)(2)(B) of H.R. 7521 would authorize the Attorney General to sue in district court to enforce the act,
thus providing a judicial trial before any sanction would be imposed. To the extent H.R. 7521 would also
authorize administrative enforcement, multiple federal appeals courts have held that the Bill of Attainder
Clause does not apply to executive agency action. Moreover, it appears that any administrative
enforcement action could be subject to judicial review by the D.C. Circuit. If a court found that H.R. 7521
did not directly impose any legal liability without trial or agency enforcement action, it would not strike
down the legislation as a bill of attainder.
First Amendment Considerations with H.R. 7521
Some civil rights groups, trade groups, and others have asserted that H.R. 7521 could infringe the First
Amendment rights of TikTok, hosting services, and users. Similar claims were made with respect to the
Trump Administration’s restrictions on TikTok and WeChat and with state laws restricting TikTok, as
discussed in a prior Legal Sidebar. (Ongoing litigation over a Montana law barring TikTok from operating
in the state is discussed in more depth in a separate Legal Sidebar, although some of the legal issues
raised in that case are specific to the state law context.) In cases challenging these restrictions in court,
users argued the government violated the First Amendment by barring them from accessing an important
forum for speech. TikTok claimed bans on the platform affect its own speech, in part by citing
constitutional protections for speech hosts—a doctrine at issue in two cases currently pending before the
Supreme Court. In other cases, TikTok also challenged bans as prior restraints, a distinct First Amendment
doctrine raising additional constitutional considerations. App stores and other sites have alleged similar
constitutional privileges to curate and display content.

---

Congressional Research Service
5
Some Members of Congress and government officials have defended H.R. 7521’s constitutionality by
arguing the bill regulates conduct rather than targeting the content of speech. The First Amendment
prevents the government from unduly infringing expressive activity—whether so-called “pure” speech or
expressive conduct—but does not bar the government from regulating conduct without any expressive
element. First Amendment protections are triggered if a law targets conduct with both expressive and
nonexpressive elements or has the inevitable effect of targeting expressive activity. With respect to H.R.
7521, some have argued that the bill focuses on national security threats and an application’s ownership
by a foreign adversary—characterized as nonexpressive conduct of covered platforms. On the other hand,
because the bill specifically identifies TikTok and could allow the President to designate other websites or
applications that serve as platforms for speech, it could be seen as “singling out those engaged in
expressive activity” and trigger First Amendment scrutiny. A federal trial court, for instance, ruled that a
Montana law prohibiting TikTok’s operations in the state targeted expressive activity, not solely
nonexpressive conduct, because it banned a means of expression.
Another argument that H.R. 7521 might not burden speech could stem from the bill’s posture as a forced
divestiture rather than a ban. Specifically, some have pointed out that H.R. 7521’s prohibitions only apply
if TikTok does not execute a “qualified divestiture,” suggesting that the app can continue to operate “so
long as it resolves the national security risks posed by its ownership structure.” Depending on whether
and how divestiture occurs, users might still be able to access the platform to share and receive speech,
and app stores and hosting services might still be able to host the platform. The divestiture requirement
could seemingly still burden TikTok’s ability to operate a platform for speech, however, and the Supreme
Court has recognized that even arguably economic regulations or restrictions short of a complete ban can
burden speech in ways that potentially trigger some form of heightened judicial scrutiny.
If H.R. 7521 were considered to burden expressive activity, the next relevant question in a constitutional
analysis would be what level of First Amendment scrutiny should apply. Courts apply various tests
depending on what type of speech is being regulated and how a given law operates. One important factor
in this inquiry is whether a law is content based or content neutral—that is, whether a law applies to
expression based on its subject matter, topic, or viewpoint. A content-based law will ordinarily be subject
to strict scrutiny analysis and considered presumptively unconstitutional. Under strict scrutiny, a law is
valid only if it is the least restrictive means to serve a compelling government interest. Restrictions based
on the identity of the speaker may also be constitutionally suspect, particularly if the speaker is targeted
because of their disfavored speech. Accordingly, if there were evidence H.R. 7521 is targeting specific
companies because of their speech or viewpoint, it might be evaluated under strict scrutiny and more
likely to be ruled unconstitutional. The bill’s definition of covered companies might be relevant to this
inquiry. The bill excludes companies with a primary purpose of allowing users to post certain product,
business, or travel reviews, arguably excluding these businesses based on the subject matter or topic of
the speech they host. Lower courts that have evaluated state laws regulating social media companies have
described somewhat similar exclusions in those laws as content based.
If instead a law is considered content-neutral or if it only incidentally restricts speech while targeting
nonexpressive activity, it may be reviewed under intermediate scrutiny. Under this constitutional standard,
a law will be upheld if it advances an “important or substantial” government interest unrelated to the
suppression of speech, if the restriction on speech is “no greater than is essential” to further this interest,
and if it leaves open “ample alternative channels for communication of the information.” Even if a
reviewing court rejected the argument that H.R. 7521 regulates nonexpressive conduct, it might still
consider whether the legislation could be justified as a content-neutral ban on a particular manner of
communicating—that is, on communicating via covered sites. Intermediate scrutiny is an easier standard
for the government to satisfy than strict scrutiny but still entails a relatively robust standard of review.
Courts have recognized that the federal government has a significant interest in national security, for
instance, but trial courts evaluating bans on WeChat and TikTok have nonetheless concluded that the
government did not meet the other prongs of the intermediate scrutiny standard. In particular, a court

---

Congressional Research Service
6
might evaluate whether the federal government could achieve its national security interests through an
approach that is less speech-restrictive than a complete ban on the platform or a requirement to divest. It
might also consider whether other speech platforms provide adequate alternatives for users to speak.

Author Information

Peter J. Benson
Joanna R. Lampe
Legislative Attorney
Legislative Attorney


Valerie C. Brannon

Legislative Attorney




Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff
to congressional committees and Members of Congress. It operates solely at the behest of and under the direction of
Congress. Information in a CRS Report should not be relied upon for purposes other than public understanding of
information that has been provided by CRS to Members of Congress in connection with CRS’s institutional role.
CRS Reports, as a work of the United States Government, are not subject to copyright protection in the United
States. Any CRS Report may be reproduced and distributed in its entirety without permission from CRS. However,
as a CRS Report may include copyrighted images or material from a third party, you may need to obtain the
permission of the copyright holder if you wish to copy or otherwise use copyrighted material.

LSB11127 · VERSION 2 · NEW

---