On April 24, 2024, President Joseph Biden signed into law emergency supplemental appropriations (Pub. Law No. 118-50) that, among numerous measures, included the Protecting Americans from Foreign Adversary Controlled Applications Act. This now enacted law is most widely known for its efforts to ban Chinese-owned TikTok and comes after prior attempts to address any potential national security concerns failed. For more details on these past actions see Thompson Hine Updates of August 7, 2020, August 17, 2020, October 5, 2020 and August 12, 2021.

The law makes it unlawful for an entity to distribute, maintain, or update (or enable the distribution, maintenance, or updating of) a foreign adversary controlled application by carrying out, within the land or maritime borders of the United States, any of the following:

  • Providing services to distribute, maintain, or update such foreign adversary controlled application (including any source code of such application) by means of a marketplace (including an online mobile application store) through which users may access, maintain, or update such application.
  • Providing internet hosting services to enable the distribution, maintenance, or updating of such foreign adversary controlled application for users.

The law defines a “foreign adversary” to included China, Iran, North Korea and Russia. The term “foreign adversary controlled application” means a website, desktop application, mobile application, or augmented or immersive technology application that is operated, directly or indirectly (including through a parent company, subsidiary, or affiliate), by: (i) ByteDance, Ltd., TikTok, and any of their subsidiaries or successors; and, (ii) any other covered company that is controlled by a foreign adversary and is determined by the president to present a significant threat to the United States. For any other “covered company,” the law establishes a process by the president in which any company that operates a website, desktop application, mobile application, or augmented or immersive technology application that permits a user to create an account or profile to generate, share, and view text, images, videos, real-time communications, or similar content, and has more than 1,000,000 monthly active users, can – after a public notice and public report to Congress – be determined to pose a national security threat. 

The law becomes effective in January 2025 for ByteDance and TikTok, and 270 days after any determination by the president on any other covered company. Failing any order by the foreign company to divest, it would be banned from web hosting sites and app stores. Further, any violations could subject an entity to investigation by the Department of Justice and potential enforcement of a civil penalty in an amount not to exceed the amount that results from multiplying $5,000 by the number of users within the United States determined to have accessed, maintained, or updated the foreign adversary controlled application.