Legal Sidebari

Regulation of TikTok Under the Protecting
Americans from Foreign Adversary Controlled
Applications Act: Analysis of Selected Legal
Issues
Updated May 9, 2024
In April 2024, Congress enacted the Protecting Americans from Foreign Adversary Controlled
Applications Act (PAFACAA) as part of a supplemental appropriations act (P.L. 118-50). The PAFACAA
makes it unlawful to provide certain services to “distribute, maintain, or update . . . a foreign adversary
controlled application” in the United States unless the covered application’s owners execute a “qualified
divestiture” within a specified timeframe. The Act expressly includes applications operated by TikTok or
its parent company ByteDance, Ltd., in the definition of “foreign adversary controlled application.”
Approximately two weeks after Congress enacted the PAFACAA, TikTok and ByteDance sued to enjoin
enforcement of the Act. In their court filing, TikTok and ByteDance claim that the Act violates the First
Amendment’s Free Speech Clause, Article I’s Bill of Attainder Clause, the Fifth Amendment’s Takings
Clause, and the equal protection component of the Fifth Amendment’s Due Process Clause. (The merits of
TikTok’s and ByteDance’s challenge to the PAFACAA have not yet been litigated. As of the date of this
Sidebar’s publication, the Department of Justice has not yet filed a response to the companies’ petition for
review.)
This Legal Sidebar summarizes the substantive provisions of the PAFACAA, analyzes the Act’s
provisions governing enforcement and judicial review, and addresses questions regarding application of
the Bill of Attainder Clause and the First Amendment’s Free Speech Clause. Other CRS products discuss
policy considerations related to the Act’s terms, address other legal considerations raised by proposals to
restrict TikTok, and respond to frequently asked questions about the regulation of TikTok—including a
question about the Fifth Amendment’s Takings Clause.
Overview of the PAFACAA
The PAFACAA regulates “foreign adversary controlled applications” and the app stores and internet
hosting services through which users access them. The Act expressly defines “foreign adversary
controlled applications” to include applications operated by TikTok and any other subsidiary of TikTok’s
Congressional Research Service
https://crsreports.congress.gov
LSB11127
CRS Legal Sidebar
Prepared for Members and
Committees of Congress

---

Congressional Research Service
2
parent company ByteDance, Ltd. The definition also includes any other website, app, or augmented or
immersive technology that (1) meets certain definitional requirements (e.g., allows users to share content
with each other and has more than 1 million monthly active users); (2) is owned by a company located in,
or a company for which persons owning at least a 20% stake are located in, a foreign adversary controlled
country listed in 10 U.S.C. § 4872(d)(2); and (3) has been determined by the President to present a
significant national security threat. The Act excludes applications from these definitional requirements if
the “primary purpose” of the application “is to allow users to post product reviews, business reviews, or
travel information and reviews.”
Under the Act, app stores and internet hosting services are prohibited from enabling the distribution,
maintenance, or updating of a foreign adversary controlled application unless the application’s owners
execute a “qualified divestiture.” For a transaction to be a qualified divestiture, the President has to
determine that, after the transaction is executed, the application would no longer be controlled by, and
would have no operational relationship with, a foreign adversary. The prohibition on app stores and
internet hosting services distributing, maintaining, or updating foreign adversary controlled applications
takes effect 270 days after the date of enactment for TikTok and other applications operated by
ByteDance or its subsidiaries. If the President were to determine that another application qualified as a
foreign adversary controlled application, the 270-day period would run from the date of the applicable
presidential determination. In either case, the President can grant a one-time extension of up to 90
additional days when a path to a qualified divestiture has been identified, there is evidence of
“significant” progress toward executing the divestiture, and there are legally binding agreements in place
to enable the divestiture. If a qualified divestiture is completed during this 270-day—or, if extended, 360-
day—time period, app stores and internet hosting services can continue supporting the application at issue
without interruption. Even after the prohibition on supporting a foreign adversary controlled application
takes effect, it ceases to apply once a qualified divestiture has been completed.
During the period between designation as a foreign adversary controlled application and the effective date
of the prohibition on supporting the application, a foreign adversary controlled application is required to
provide U.S. users, upon request, with all the data related to their accounts, including their posts, photos,
and videos, in a machine readable format.
Foreign adversary controlled applications, app stores, and internet hosting services could face civil
penalties if they do not comply with these provisions. An app store or internet hosting service that
continues to enable distribution, maintenance, or updates for a banned application could be subject to civil
penalties of up to $5,000 multiplied by the number of U.S. users who accessed, maintained, or updated
the application. A foreign adversary controlled application that fails to provide user data as required could
be subject to civil penalties of up to $500 multiplied by the number of affected users.
Enforcement and Judicial Review
Section 2(d) of the PAFACAA governs enforcement of the Act. Section 2(d)(1) imposes civil penalties on
entities who violate the Act’s prohibitions. Section 2(d)(2) provides for enforcement by the Attorney
General. Specifically, Section 2(d)(2)(A) authorizes the Attorney General to investigate potential
violations and provides that, “if such an investigation results in a determination that a violation has
occurred, the Attorney General shall pursue enforcement under paragraph (1).” Section 2(d)(2)(B)
authorizes the Attorney General, upon a determination that a violation has occurred, to “bring an action in
an appropriate district court of the United States for appropriate relief, including civil penalties under
paragraph (1) or declaratory and injunctive relief.”
Section 2(d)(2)(B) authorizes the Attorney General to sue in federal district court to sanction and remedy
violations of the Act. It is not clear whether the directive in Section 2(d)(2)(A) that the Attorney General
“shall pursue enforcement under paragraph (1)” provides for enforcement other than via civil suits under

---

Congressional Research Service
3
Section 2(d)(2)(B). To the extent Section 2(d)(2)(A) authorizes enforcement through other means, such as
administrative proceedings, the Act does not clearly specify what action is authorized.
Section 3 of the PAFACAA limits judicial review of the Act itself or any enforcement actions taken
pursuant to the Act. Section 3(a) provides, “A petition for review challenging this division [of P.L. 118-
50] or any action, finding, or determination under this division may be filed only in the United States
Court of Appeals for the District of Columbia Circuit.” The term “petition for review” is generally used in
other statutes to refer to judicial review of agency action. Because it is not clear whether and to what
extent the Act authorizes administrative enforcement or other agency actions apart from civil suits, there
may be uncertainty about what this provision includes. To the extent Section 2(d)(2)(A) of the Act
authorizes administrative enforcement, Section 3(a) requires petitions for review of such agency action to
proceed in the D.C. Circuit.
Section 3(b) provides that the D.C. Circuit “shall have exclusive jurisdiction over any challenge to this
division [of P.L. 118-50] or any action, finding, or determination under this division.” Constitutional
challenges to federal laws and policies may arise in two ways other than via petitions for review of
agency action. First, regulated entities or others alleging imminent harm under the law may sue to prevent
enforcement of the law. TikTok and ByteDance’s May 2024 suit seeking to enjoin the Attorney General
from enforcing the PAFACAA is proceeding in this posture, sometimes called a pre-enforcement or
offensive challenge. A challenge to a presidential determination under the Act might also proceed in this
posture. A pre-enforcement challenge to a federal law is generally brought by filing a civil action in a
trial-level federal district court. However, because Section 3(b) grants the D.C. Circuit exclusive
jurisdiction over challenges to the Act or to actions or determinations under the Act, it appears that such
challenges need to be filed at their inception in the D.C. Circuit. TikTok filed its petition for review of the
constitutionality of the PAFACAA in the D.C. Circuit, asserting that that court has “original and exclusive
jurisdiction” over the case.
The second way a challenge to the PAFACAA might proceed is known as a defensive challenge. In other
words, if the Attorney General sued a person for violating the Act, the defendant might raise a
constitutional claim as a defense to liability. A defensive challenge is ordinarily raised in response to a suit
in the court where the case was commenced. Section 2(d)(2)(B) authorizes the Attorney General to bring
enforcement suits in federal district court, so, absent special rules sending litigation to a different court, a
defensive constitutional challenge to the Act would generally proceed in the same case in the same district
court. However, under Section 3(b), it appears that such challenges need to proceed in the D.C. Circuit.
This provision could mean that cases that the Attorney General files in district court would need to be
transferred or otherwise referred to the D.C. Circuit if the defendant raises a constitutional defense. The
Act does not expressly provide for such transfer or referral, leaving some uncertainty about how a
defensive challenge would proceed.
As a constitutional matter, Congress has substantial authority to direct certain federal cases to specific
federal courts, and some existing statutes require certain categories of cases to proceed in the D.C.
Circuit. Typical laws that route cases to the D.C. Circuit generally apply to appeals, or to petitions for
review of agency action, which sometimes begin in the federal appeals courts. Section 3(a) of the
PAFACAA is similar to these laws. By contrast, sending matters to the D.C. Circuit before they are
subject to a trial court or administrative agency proceeding is unusual. Congress generally does not
provide for lawsuits to commence in the federal appeals courts or to be transferred to a federal appellate
court if a defendant raises a particular defense. Statutes that direct certain cases to specific courts have
been subject to significant litigation. Because Section 3 of the PAFACAA appears to provide for novel
treatment of some cases and does not clearly specify the applicable procedures, there may be litigation
around the Act’s jurisdiction and venue provisions and the procedures that should apply to challenges to
the Act. Such litigation is not likely to cast doubt on the constitutionality of the Act, but could impose
costs and delays in enforcement.

---

Congressional Research Service
4
Bill of Attainder Analysis
Article I, Section 9, clause 3, of the Constitution prohibits Congress from enacting bills of attainder—
legislation that directly imposes punishment on an identifiable person or class of persons. In the leading
bill of attainder case, Nixon v. Administrator of General Services, the Supreme Court held that legislation
constitutes a bill of attainder if it (1) applies with specificity and (2) imposes punishment (3) without a
judicial trial. All three requirements must be satisfied before a court will strike down a law as a bill of
attainder. TikTok and ByteDance have challenged the PAFACAA as a bill of attainder. They argue that the
Act singles them out by name for legislative punishment and inflicts on them penalties that historically
have been associated with bills of attainder. There are, however, also reasons why the court may not strike
down the PAFACAA as an unlawful bill of attainder.
With respect to the requirement that a bill of attainder apply with specificity, the civil penalties in the
PAFACAA do not, as a technical matter, apply only to the named companies. The President could
determine that additional applications qualify as foreign adversary controlled applications, and the civil
penalties provided in the Act could apply both to companies that operate any foreign adversary controlled
application and entities that enable the distribution or maintenance of the applications. The Act does name
TikTok and ByteDance and imposes a burden on the named companies, however, essentially requiring a
qualified divestiture within the statutorily provided timeframe to allow app stores to continue lawfully
providing applications operated by those companies to U.S. users. A court could therefore find that the
legislation satisfied the specificity requirement. Importantly, however, specificity standing alone is never
sufficient to support a finding that a law is a bill of attainder; the law must also impose punishment
without trial.
The determination of whether a law imposes punishment is complex and fact-based. A CRS In Focus
provides analysis of how courts might apply the relevant legal standards to international sanctions
legislation. The PAFACAA is not sanctions legislation, but much of that analysis would also apply to the
Act. As a general matter, review of whether legislation is punitive for purposes of the Bill of Attainder
Clause is deferential, and federal courts rarely strike down laws as bills of attainder. Courts are more
likely to strike down legislation as a bill of attainder if it imposes punishment resembling criminal
penalties based on a determination that the targeted entity has engaged in culpable conduct in the past.
Courts are less likely to strike down legislation that reasonably serves a nonpunitive, forward-looking
legislative purpose. To the extent a court determined that the PAFACAA is intended to protect national
security rather than to punish the named companies, it would likely find that the Act does not impose
punishment for purposes of the Bill of Attainder Clause.
Finally, the Bill of Attainder Clause bans only laws that impose punishment without trial. Section
2(d)(2)(B) of the PAFACAA authorizes the Attorney General to sue in district court to enforce the Act,
thus providing a judicial trial before any sanction would be imposed. To the extent the PAFACAA also
authorizes administrative enforcement, multiple federal appeals courts have held that the Bill of Attainder
Clause does not apply to executive agency action. Moreover, it appears that any administrative
enforcement action could be subject to judicial review by the D.C. Circuit. If a court found that the
PAFACAA does not directly impose any legal liability without trial or agency enforcement action, it
would not strike down the legislation as a bill of attainder.
First Amendment Considerations
In their petition for review challenging the PAFACAA, TikTok and ByteDance argue that the Act
infringes TikTok’s First Amendment rights. Some civil rights groups, trade groups, and others have made
similar arguments and have also asserted that provisions included in the PAFACAA could infringe the
First Amendment rights of hosting services and users. These types of First Amendment objections were
raised with respect to the Trump Administration’s restrictions on TikTok and WeChat and with state laws

---

Congressional Research Service
5
restricting TikTok, as discussed in a prior Legal Sidebar. (Ongoing litigation over a Montana law barring
TikTok from operating in the state is discussed in more depth in a separate Legal Sidebar, although some
of the legal issues raised in that case are specific to the state law context.) In cases challenging these
restrictions in court, users argued the government violated the First Amendment by barring them from
accessing an important forum for speech. TikTok claimed bans on the platform affect its own speech, in
part by citing constitutional protections for speech hosts—a doctrine at issue in two cases currently
pending before the Supreme Court. In other cases, TikTok also challenged bans as prior restraints, a
distinct First Amendment doctrine raising additional constitutional considerations. TikTok invoked both
the First Amendment rights of speech hosts and prior restraint doctrine in its petition challenging the
PAFACAA. In statements about the PAFACAA’s restrictions, app stores and other sites have pointed to
similar constitutional privileges to curate and display content.
Most of the provisions enacted in the PAFACAA were introduced in H.R. 7521, and when that bill was
introduced, some Members of Congress and government officials defended its constitutionality by
arguing the bill regulates conduct rather than targeting the content of speech. The First Amendment
prevents the government from unduly infringing expressive activity—whether so-called “pure” speech or
expressive conduct—but does not bar the government from regulating conduct without any expressive
element. First Amendment protections are triggered if a law targets conduct with both expressive and
nonexpressive elements or has the inevitable effect of targeting expressive activity. With respect to the
PAFACAA, some have argued that provisions in the Act focus on national security threats and an
application’s ownership by a foreign adversary—characterized as nonexpressive conduct of covered
platforms. On the other hand, because the Act specifically identifies TikTok and could allow the President
to designate other websites or applications that serve as platforms for speech, it could be seen as “singling
out those engaged in expressive activity” and trigger First Amendment scrutiny. A federal trial court, for
instance, ruled that a Montana law prohibiting TikTok’s operations in the state targeted expressive
activity, not solely nonexpressive conduct, because it banned a means of expression.
Another argument that the PAFACAA might not burden speech could stem from the Act’s posture as a
forced divestiture rather than a ban. Specifically, some have pointed out that the Act’s prohibitions only
apply if TikTok does not execute a “qualified divestiture,” suggesting that the app can continue to operate
“so long as it resolves the national security risks posed by its ownership structure.” Depending on whether
and how divestiture occurs, users might still be able to access the platform to share and receive speech,
and app stores and hosting services might still be able to host the platform. The divestiture requirement
could seemingly still burden TikTok’s ability to operate a platform for speech, however, and the Supreme
Court has recognized that even arguably economic regulations or restrictions short of a complete ban can
burden speech in ways that potentially trigger some form of heightened judicial scrutiny.
If the PAFACAA were considered to burden expressive activity, the next relevant question in a
constitutional analysis would be what level of First Amendment scrutiny should apply. Courts apply
various tests depending on what type of speech is being regulated and how a given law operates. One
important factor in this inquiry is whether a law is content based or content neutral—that is, whether a
law applies to expression based on its subject matter, topic, or viewpoint. A content-based law will
ordinarily be subject to strict scrutiny analysis and considered presumptively unconstitutional. Under
strict scrutiny, a law is valid only if it is the least restrictive means to serve a compelling government
interest. Restrictions based on the identity of the speaker may also be constitutionally suspect, particularly
if the speaker is targeted because of their disfavored speech. Accordingly, if there were evidence the
PAFACAA targets specific companies because of their speech or viewpoint, it might be evaluated under
strict scrutiny and more likely to be ruled unconstitutional. The Act’s definition of covered companies
might be relevant to this inquiry. The Act excludes companies with a primary purpose of allowing users to
post certain product, business, or travel reviews, arguably excluding these businesses based on the subject
matter or topic of the speech they host. Lower courts that have evaluated state laws regulating social
media companies have described somewhat similar exclusions in those laws as content based.

---

Congressional Research Service
6

If a law is instead considered content neutral or if it only incidentally restricts speech while targeting
nonexpressive activity, it may be reviewed under intermediate scrutiny. Under this constitutional standard,
a law will be upheld if it advances an “important or substantial” government interest unrelated to the
suppression of speech, if the restriction on speech is “no greater than is essential” to further this interest,
and if it leaves open “ample alternative channels for communication of the information.” Even if a
reviewing court rejected the argument that the PAFACAA regulates nonexpressive conduct, it might still
consider whether the legislation could be justified as a content-neutral ban on a particular manner of
communicating—that is, on communicating via covered sites. Intermediate scrutiny is an easier standard
for the government to satisfy than strict scrutiny but still entails a relatively robust standard of review.
Courts have recognized that the federal government has a significant interest in national security, for
instance, but trial courts evaluating bans on WeChat and TikTok have nonetheless concluded that the
government did not meet the other prongs of the intermediate scrutiny standard. In particular, a court
might evaluate whether the federal government could achieve its national security interests through an
approach that is less speech-restrictive than a complete ban on the platform or a requirement to divest. It
might also consider whether other speech platforms provide adequate alternatives for users to speak.

Author Information

Peter J. Benson
Joanna R. Lampe
Legislative Attorney
Legislative Attorney


Valerie C. Brannon

Legislative Attorney




Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff
to congressional committees and Members of Congress. It operates solely at the behest of and under the direction of
Congress. Information in a CRS Report should not be relied upon for purposes other than public understanding of
information that has been provided by CRS to Members of Congress in connection with CRS’s institutional role.
CRS Reports, as a work of the United States Government, are not subject to copyright protection in the United
States. Any CRS Report may be reproduced and distributed in its entirety without permission from CRS. However,
as a CRS Report may include copyrighted images or material from a third party, you may need to obtain the
permission of the copyright holder if you wish to copy or otherwise use copyrighted material.
LSB11127 · VERSION 4 · UPDATED

---