On December 6, 2024, the United States Court of Appeals for the D.C. Circuit upheld the constitutionality of the Protecting Americans from Foreign Adversary Controlled Applications Act (“Act”). The Act, signed into law by President Biden on April 24, 2024, prohibits the “distribution or maintenance” in the U.S. of applications controlled by ByteDance, TikTok’s China-based parent. The Act also allows the President to subject other applications to the prohibition, if he determines the company that owns the application is “controlled by a foreign adversary” and “presents a significant threat to national security.”
The Court determined that the TikTok-specific provisions triggered heightened scrutiny under the First Amendment because it “impose[d] a disproportionate burden on TikTok, an entity engaged in expressive activity.” The Court also considered whether the Act should be subject to intermediate scrutiny as a “content-based” restriction but declined to resolve the question because it found that the Act satisfies strict scrutiny as it is “the least restrictive means of advancing the Government’s compelling national security interests.” Those compelling interest included: (1) countering the People’s Republic of China’s (“PRC”) efforts to collect vast amounts of data about U.S. persons and (2) protecting against the risk that that PRC could covertly manipulate content on TikTok.
In so doing, the Court accepted a number of allegations that the U.S. government has long made against the PRC, including:
- PRC Law gives the state nearly unfettered access to data held by private companies. The Court found that China’s broad national security laws mean that “even putatively ‘private’ companies based in China do not operate with independence from the government and cannot be analogized to private companies in the United States.” The Court pointed to China’s National Security Law of 2015, which “requires all citizens and corporations to provide necessary support to national security authorities,” and its Cybersecurity Law of 2017, which “requires Chinese companies to grant the PRC full access to their data and to cooperate with criminal and security investigations.” According to the Court, “through its control over Chinese parent companies, the PRC can also access information from and about U.S. subsidiaries and compel their cooperation with PRC directives” and can “conduct espionage, technology transfer, data collection, and other disruptive activities under the disguise of an otherwise legitimate commercial activity.” (quotations omitted).
- PRC seeks to collect sensitive data of US persons through a variety of means. The Court found that “[t]he PRC’s methods for collecting data include using its relationships with Chinese companies, making strategic investments in foreign companies, and purchasing large data sets.” (quotations omitted). Most notably, the Court relied on testimony from the FBI’s Assistant Director for Counterintelligence, which alleged that “the PRC endeavors strategically to pre-position commercial entities in the United States that the PRC can later ‘co-opt.’”
The Court also found that TikTok had exacerbated these national security concerns in a number of ways, including by:
- Storing sensitive information about U.S. persons, such as social security numbers and tax identifications, on servers in China.
- Allowing, or at least not preventing, PRC-based employees to access TikTok user data and IP addresses to monitor the physical locations of specific U.S. citizens.
In adopting the Government’s evidence on these matters, the Court emphasized that, on matters of national security such as this, the Government’s “judgment . . . is entitled to significant weight.”
By holding that preventing Chinese-owned companies from accessing sensitive data is a compelling state interest, the D.C. Circuit may have opened the door for additional action against Chinese-owned companies. While President-Elect Trump has promised to save TikTok, he may also be interested in using the Act to ban other PRC-owned applications. The D.C. Circuit’s TikTok opinion would make it difficult to challenge such actions on constitutional grounds. In addition, the Act offers stronger statutory authority to ban PRC-based applications than other tools, such as the International Emergency Economic Powers Act (“IEEPA”). IEEPA, for instance, generally exempts “informational materials” from regulation under that statute—an exception that frustrated President Trump’s attempts to ban TikTok and WeChat during his first term. The Protecting Americans from Foreign Adversary Controlled Applications Act, by contrast, has no similar exemption.
