Legal Sidebari

Regulation of TikTok Under the Protecting
Americans from Foreign Adversary Controlled
Applications Act: Analysis of Selected Legal
Issues
Updated May 6, 2024
In April 2024, Congress enacted the Protecting Americans from Foreign Adversary Controlled
Applications Act (PAFACAA) as part of a supplemental appropriations act (P.L. 118-50). The PAFACAA
makes it unlawful to provide certain services to “distribute, maintain, or update . . . a foreign adversary
controlled application” within the United States. The Act expressly includes applications operated by
TikTok or its parent company ByteDance, Ltd., in the definition of “foreign adversary controlled
application.” This Legal Sidebar summarizes the substantive provisions of the PAFACAA, analyzes the
Act’s provisions governing enforcement and judicial review, and addresses potential constitutional
considerations, focusing on questions regarding application of the Bill of Attainder Clause and the First
Amendment’s Free Speech Clause. Other CRS products discuss policy considerations related to the Act’s
terms, address other legal considerations raised by proposals to restrict TikTok, and respond to frequently
asked questions about the regulation of TikTok.
Overview of the PAFACAA
The PAFACAA regulates “foreign adversary controlled applications” and the app stores and internet
hosting services through which users access them. The Act expressly defines “foreign adversary
controlled applications” to include applications operated by TikTok and any other subsidiary of TikTok’s
parent company ByteDance, Ltd. The definition also includes any other website, app, or augmented or
immersive technology that (1) meets certain definitional requirements (e.g., allows users to share content
with each other and has more than 1 million monthly active users); (2) is owned by a company located in,
or a company for which persons owning at least a 20% stake are located in, a foreign adversary controlled
country listed in 10 U.S.C. § 4872(d)(2); and (3) has been determined by the President to present a
significant national security threat. The Act excludes applications from these definitional requirements if
the “primary purpose” of the application “is to allow users to post product reviews, business reviews, or
travel information and reviews.”
Congressional Research Service
https://crsreports.congress.gov
LSB11127
CRS Legal Sidebar
Prepared for Members and
Committees of Congress

---

Congressional Research Service
2
Under the Act, app stores and internet hosting services are prohibited from enabling the distribution,
maintenance, or updating of a foreign adversary controlled application unless the application’s owners
execute a “qualified divestiture.” For a transaction to be a qualified divestiture, the President has to
determine that, after the transaction is executed, the application would no longer be controlled by, and
would have no operational relationship with, a foreign adversary. The prohibition on app stores and
internet hosting services distributing, maintaining, or updating foreign adversary controlled applications
takes effect 270 days after the date of enactment for TikTok and other applications operated by
ByteDance or its subsidiaries. If the President were to determine that another application qualified as a
foreign adversary controlled application, the 270-day period would run from the date of the applicable
presidential determination. In either case, the President can grant a one-time extension of up to 90
additional days when a path to a qualified divestiture has been identified, there is evidence of
“significant” progress toward executing the divestiture, and there are legally binding agreements in place
to enable the divestiture. If a qualified divestiture is completed during this 270-day—or, if extended, 360-
day—time period, app stores and internet hosting services can continue supporting the application at issue
without interruption. Even after the prohibition on supporting a foreign adversary controlled application
takes effect, it ceases to apply once a qualified divestiture has been completed.
During the period between designation as a foreign adversary controlled application and the effective date
of the prohibition on supporting the application, a foreign adversary controlled application is required to
provide U.S. users, upon request, with all the data related to their accounts, including their posts, photos,
and videos, in a machine readable format.
Foreign adversary controlled applications, app stores, and internet hosting services could face civil
penalties if they do not comply with these provisions. An app store or internet hosting service that
continues to enable distribution, maintenance, or updates for a banned application could be subject to civil
penalties of up to $5,000 multiplied by the number of U.S. users who accessed, maintained, or updated
the application. A foreign adversary controlled application that fails to provide user data as required could
be subject to civil penalties of up to $500 multiplied by the number of affected users.
Enforcement and Judicial Review
Section 2(d) of the PAFACAA governs enforcement of the Act. Section 2(d)(1) imposes civil penalties on
entities who violate the Act’s prohibitions. Section 2(d)(2) provides for enforcement by the Attorney
General. Specifically, Section 2(d)(2)(A) authorizes the Attorney General to investigate potential
violations and provides that, “if such an investigation results in a determination that a violation has
occurred, the Attorney General shall pursue enforcement under paragraph (1).” Section 2(d)(2)(B)
authorizes the Attorney General, upon a determination that a violation has occurred, to “bring an action in
an appropriate district court of the United States for appropriate relief, including civil penalties under
paragraph (1) or declaratory and injunctive relief.”
Section 2(d)(2)(B) authorizes the Attorney General to sue in federal district court to sanction and remedy
violations of the Act. It is not clear whether the directive in Section 2(d)(2)(A) that the Attorney General
“shall pursue enforcement under paragraph (1)” provides for enforcement other than via civil suits under
Section 2(d)(2)(B). To the extent Section 2(d)(2)(A) authorizes enforcement through other means, such as
administrative proceedings, the Act does not clearly specify what action is authorized.
Section 3 of the PAFACAA limits judicial review of the Act itself or any enforcement actions taken
pursuant to the Act. Section 3(a) provides, “A petition for review challenging this division [of P.L. 118-
50] or any action, finding, or determination under this division may be filed only in the United States
Court of Appeals for the District of Columbia Circuit.” The term “petition for review” is generally used in
other statutes to refer to judicial review of agency action. Because it is not clear whether and to what
extent the Act authorizes administrative enforcement or other agency actions apart from civil suits, there

---

Congressional Research Service
3
may be uncertainty about what this provision includes. To the extent Section 2(d)(2)(A) of the Act
authorizes administrative enforcement, Section 3(a) requires petitions for review of such agency action to
proceed in the D.C. Circuit.
Section 3(b) provides that the D.C. Circuit “shall have exclusive jurisdiction over any challenge to this
division [of P.L. 118-50] or any action, finding, or determination under this division.” Constitutional
challenges to the Act could potentially arise in two ways other than via petitions for review of agency
action. First, regulated entities or others alleging imminent harm under the Act could sue to prevent
enforcement of the Act. This action might take the form of a pre-enforcement (or offensive) challenge to
the Act seeking to enjoin (i.e., prevent) the Attorney General from enforcing the Act. A challenge to a
presidential determination under the Act might also proceed in this posture. Under current law, a pre-
enforcement challenge to a federal law is generally brought by filing a civil action in a trial-level federal
district court. However, because Section 3(b) grants the D.C. Circuit exclusive jurisdiction over
challenges to the Act or to actions or determinations under the Act, it appears that such challenges would
need to proceed in the D.C. Circuit.
Second, if the Attorney General sued a person for violating the Act, the defendant might raise a
constitutional claim as a defense to liability (which is sometimes called a defensive challenge). A
defensive challenge is ordinarily raised in response to a suit in the court where the case was commenced.
Section 2(d)(2)(B) authorizes the Attorney General to bring enforcement suits in federal district court, so,
absent special rules sending litigation to a different court, a defensive constitutional challenge to the Act
would generally proceed in the same case in the same district court. However, under Section 3(b), it
appears that such challenges need to proceed in the D.C. Circuit. This provision could mean that cases
that the Attorney General filed in district court would need to be transferred or otherwise referred to the
D.C. Circuit if the defendant raised a constitutional defense. The Act does not expressly provide for such
transfer or referral, leaving some uncertainty about how a defensive challenge would proceed.
As a constitutional matter, Congress has substantial authority to direct certain federal cases to specific
federal courts, and some existing statutes require certain categories of cases to proceed in the D.C.
Circuit. Typical laws that route cases to the D.C. Circuit generally apply to appeals, or to petitions for
review of agency action, which sometimes begin in the federal appeals courts. Section 3(a) of the
PAFACAA is similar to these laws. By contrast, sending matters to the D.C. Circuit before they are
subject to a trial court or administrative agency proceeding is unusual. Congress generally does not
provide for lawsuits to commence in the federal appeals courts or to be transferred to a federal appellate
court if a defendant raises a particular defense. Statutes that direct certain cases to specific courts have
been subject to significant litigation. Because Section 3 of the PAFACAA appears to provide for novel
treatment of some cases and does not clearly specify the applicable procedures, litigation around the Act’s
jurisdiction and venue provisions could occur if the law is challenged or enforced in court. Such litigation
would not be likely to cast doubt on the constitutionality of the Act, but could impose costs and delays in
enforcement.
Bill of Attainder Analysis
Article I, Section 9, clause 3, of the Constitution prohibits Congress from enacting bills of attainder—
legislation that directly imposes punishment on an identifiable person or class of persons. Because the
PAFACAA applies to TikTok and ByteDance by name and imposes legal consequences that the
companies find objectionable, there is some risk that TikTok and ByteDance will challenge the law as a
bill of attainder. However, there are several reasons why courts may be unlikely to strike down the
legislation on that ground.
In the leading bill of attainder case, Nixon v. Administrator of General Services, the Supreme Court held
that legislation constitutes a bill of attainder if it (1) applies with specificity and (2) imposes punishment

---

Congressional Research Service
4
(3) without a judicial trial. All three requirements must be satisfied before a court will strike down a law
as a bill of attainder.
With respect to specificity, as a technical matter, the civil penalties in the PAFACAA do not apply only to
the named companies. The President could determine that additional applications qualify as foreign
adversary controlled applications, and the civil penalties provided in the Act could apply both to
companies that operate any foreign adversary controlled application and entities that enable the
distribution or maintenance of the applications. The Act does name TikTok and ByteDance and imposes a
burden on the named companies, however, essentially requiring a qualified divestiture within the
statutorily provided timeframe to allow app stores to continue lawfully providing applications operated by
those companies to U.S. users. A court could therefore find that the legislation satisfied the specificity
requirement. Importantly, however, specificity standing alone is never sufficient to support a finding that
a law is a bill of attainder; the law must also impose punishment without trial.
The determination of whether a law imposes punishment is complex and fact-based. A CRS In Focus
provides analysis of how courts might apply the relevant legal standards to international sanctions
legislation. The PAFACAA is not sanctions legislation, but much of that analysis would also apply to the
Act. As a general matter, review of whether legislation is punitive for purposes of the Bill of Attainder
Clause is deferential, and federal courts rarely strike down laws as bills of attainder. Courts are more
likely to strike down legislation as a bill of attainder if it imposes punishment resembling criminal
penalties based on a determination that the targeted entity has engaged in culpable conduct in the past.
Courts are less likely to strike down legislation that reasonably serves a nonpunitive, forward-looking
legislative purpose. To the extent a court determined that the PAFACAA is intended to protect national
security rather than to punish the named companies, it would likely find that the Act does not impose
punishment for purposes of the Bill of Attainder Clause.
Finally, the Bill of Attainder Clause bans only laws that impose punishment without trial. Section
2(d)(2)(B) of the PAFACAA authorizes the Attorney General to sue in district court to enforce the Act,
thus providing a judicial trial before any sanction would be imposed. To the extent the PAFACAA also
authorizes administrative enforcement, multiple federal appeals courts have held that the Bill of Attainder
Clause does not apply to executive agency action. Moreover, it appears that any administrative
enforcement action could be subject to judicial review by the D.C. Circuit. If a court found that the
PAFACAA does not directly impose any legal liability without trial or agency enforcement action, it
would not strike down the legislation as a bill of attainder.
First Amendment Considerations
Some civil rights groups, trade groups, and others have asserted that provisions included in the
PAFACAA could infringe the First Amendment rights of TikTok, hosting services, and users. Similar
claims were made with respect to the Trump Administration’s restrictions on TikTok and WeChat and
with state laws restricting TikTok, as discussed in a prior Legal Sidebar. (Ongoing litigation over a
Montana law barring TikTok from operating in the state is discussed in more depth in a separate Legal
Sidebar, although some of the legal issues raised in that case are specific to the state law context.) In cases
challenging these restrictions in court, users argued the government violated the First Amendment by
barring them from accessing an important forum for speech. TikTok claimed bans on the platform affect
its own speech, in part by citing constitutional protections for speech hosts—a doctrine at issue in two
cases currently pending before the Supreme Court. In other cases, TikTok also challenged bans as prior
restraints, a distinct First Amendment doctrine raising additional constitutional considerations. App stores
and other sites have alleged similar constitutional privileges to curate and display content.
Most of the provisions enacted in the PAFACAA were introduced in H.R. 7521, and when that bill was
introduced, some Members of Congress and government officials defended its constitutionality by

---

Congressional Research Service
5
arguing the bill regulates conduct rather than targeting the content of speech. The First Amendment
prevents the government from unduly infringing expressive activity—whether so-called “pure” speech or
expressive conduct—but does not bar the government from regulating conduct without any expressive
element. First Amendment protections are triggered if a law targets conduct with both expressive and
nonexpressive elements or has the inevitable effect of targeting expressive activity. With respect to the
PAFACAA, some have argued that provisions in the Act focus on national security threats and an
application’s ownership by a foreign adversary—characterized as nonexpressive conduct of covered
platforms. On the other hand, because the Act specifically identifies TikTok and could allow the President
to designate other websites or applications that serve as platforms for speech, it could be seen as “singling
out those engaged in expressive activity” and trigger First Amendment scrutiny. A federal trial court, for
instance, ruled that a Montana law prohibiting TikTok’s operations in the state targeted expressive
activity, not solely nonexpressive conduct, because it banned a means of expression.
Another argument that the PAFACAA might not burden speech could stem from the Act’s posture as a
forced divestiture rather than a ban. Specifically, some have pointed out that the Act’s prohibitions only
apply if TikTok does not execute a “qualified divestiture,” suggesting that the app can continue to operate
“so long as it resolves the national security risks posed by its ownership structure.” Depending on whether
and how divestiture occurs, users might still be able to access the platform to share and receive speech,
and app stores and hosting services might still be able to host the platform. The divestiture requirement
could seemingly still burden TikTok’s ability to operate a platform for speech, however, and the Supreme
Court has recognized that even arguably economic regulations or restrictions short of a complete ban can
burden speech in ways that potentially trigger some form of heightened judicial scrutiny.
If the PAFACAA were considered to burden expressive activity, the next relevant question in a
constitutional analysis would be what level of First Amendment scrutiny should apply. Courts apply
various tests depending on what type of speech is being regulated and how a given law operates. One
important factor in this inquiry is whether a law is content based or content neutral—that is, whether a
law applies to expression based on its subject matter, topic, or viewpoint. A content-based law will
ordinarily be subject to strict scrutiny analysis and considered presumptively unconstitutional. Under
strict scrutiny, a law is valid only if it is the least restrictive means to serve a compelling government
interest. Restrictions based on the identity of the speaker may also be constitutionally suspect, particularly
if the speaker is targeted because of their disfavored speech. Accordingly, if there were evidence the
PAFACAA targets specific companies because of their speech or viewpoint, it might be evaluated under
strict scrutiny and more likely to be ruled unconstitutional. The Act’s definition of covered companies
might be relevant to this inquiry. The Act excludes companies with a primary purpose of allowing users to
post certain product, business, or travel reviews, arguably excluding these businesses based on the subject
matter or topic of the speech they host. Lower courts that have evaluated state laws regulating social
media companies have described somewhat similar exclusions in those laws as content based.
If a law is instead considered content neutral or if it only incidentally restricts speech while targeting
nonexpressive activity, it may be reviewed under intermediate scrutiny. Under this constitutional standard,
a law will be upheld if it advances an “important or substantial” government interest unrelated to the
suppression of speech, if the restriction on speech is “no greater than is essential” to further this interest,
and if it leaves open “ample alternative channels for communication of the information.” Even if a
reviewing court rejected the argument that the PAFACAA regulates nonexpressive conduct, it might still
consider whether the legislation could be justified as a content-neutral ban on a particular manner of
communicating—that is, on communicating via covered sites. Intermediate scrutiny is an easier standard
for the government to satisfy than strict scrutiny but still entails a relatively robust standard of review.
Courts have recognized that the federal government has a significant interest in national security, for
instance, but trial courts evaluating bans on WeChat and TikTok have nonetheless concluded that the
government did not meet the other prongs of the intermediate scrutiny standard. In particular, a court
might evaluate whether the federal government could achieve its national security interests through an

---

Congressional Research Service
6
approach that is less speech-restrictive than a complete ban on the platform or a requirement to divest. It
might also consider whether other speech platforms provide adequate alternatives for users to speak.

Author Information

Peter J. Benson
Joanna R. Lampe
Legislative Attorney
Legislative Attorney


Valerie C. Brannon

Legislative Attorney




Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff
to congressional committees and Members of Congress. It operates solely at the behest of and under the direction of
Congress. Information in a CRS Report should not be relied upon for purposes other than public understanding of
information that has been provided by CRS to Members of Congress in connection with CRS’s institutional role.
CRS Reports, as a work of the United States Government, are not subject to copyright protection in the United
States. Any CRS Report may be reproduced and distributed in its entirety without permission from CRS. However,
as a CRS Report may include copyrighted images or material from a third party, you may need to obtain the
permission of the copyright holder if you wish to copy or otherwise use copyrighted material.

LSB11127 · VERSION 3 · UPDATED

---