The Complex Case of TikTok in the United States

Rinehart, William

Introduction

Last year, it seemed as though TikTok would get shut down.

In the first couple of weeks in January, at the beginning of a new legislative session, 10 different states banned TikTok from government mobile devices.¹ By the end of the legislative calendar, which for most states was the summer, 34 state governments had gotten in on the action.²

Montana went the furthest with a bill banning the app for all Montanans. But that bill is now tied up in the courts. In Congress, six bills were filed that either narrowly focused on TikTok or could include an outright ban of the app. The volume in Congress has lowered because there has been a tonal shift.

There has been a dramatic change of fortune for TikTok. People are much less sure about banning the app than they were in March. Support for banning the app dropped from 50 percent in March to 38 percent at the beginning of October, according to Pew.³ Opinion is split three ways.

This paper aims to document TikTok’s moment in the spotlight, charting its rise in prominence and its recent legal troubles. Only with this context can the most important public policy questions be answered: What risks, if any, does TikTok pose? How would a ban work in practice? What other options are available? And most important of all, is any of this even constitutional?

People are worried that TikTok could come under the sway of the Chinese Communist Party (CCP) and fundamentally undermine national security. While there have been troubling reports of improper access to user data, so far administration officials have cited speculative harms. Banning TikTok would be a dramatic shift in policy and one that would run afoul of long-standing free speech principles.⁴ TikTok serves 150 million people in the United States and is clearly a forum for the expression of speech.

For its own part, TikTok maintains an uneasy relationship with the CCP. When protests again sprung up in Hong Kong in 2020, TikTok shut down its Hong Kong operations. TikTok has reinstated videos that have been critical of the CCP, has been cooperative with US regulators, and has spent $1.5 billion to secure user data. Altogether, these actions have caused a backlash in China, where the founder is routinely called “a traitor of China, a coward, and an American apologist.”⁵

What separates the United States from China is that we rely on open debate and due process. Thoughtful, targeted responses are needed, not blanket bans. Given that free speech is concerned, policymakers should consider alternative options that would be less restrictive than a ban or even a forced divestiture.

TikTok might be in legal limbo, but it is not in policy limbo. Policymakers should normalize what is already the reality: TikTok’s Committee on Foreign Investment in the United States (CFIUS) review should be conditionally allowed, subject to an audit. Besides, rather than outright prohibitions that conflict with free speech values, policymakers should choose rigorous oversight and transparency.

A History of TikTok

TikTok is actually a copycat of an app called Musical.ly. Musical.ly was founded in 2014 by Alex Zhu and Luyu Yang because of a train ride that Zhu took from San Francisco to Mountain View, California.⁶ Zhu caught sight of a typical scene: a bunch of teens huddled together, some jamming to tunes, lost in the music, others snapping away, their screens a flurry of pictures and emoji. Zhu wondered if an app built around lip-syncing videos might be popular. Thirty days later, the app was up and running, and Zhu traveled back to China to found the company in Shanghai, China.⁷

The company launched in two markets, China and the United States. Quickly the app found an audience in the United States but faltered in China. Eventually Musical.ly pulled its Chinese product and focused on the United States.

Seeing the success of Musical.ly in the United States, China’s ByteDance, already a titan in the tech industry, launched two copycat services toward the end of 2016 to compete. In China, ByteDance launched Douyin. For the United States, Europe, and the rest of the world, ByteDance created TikTok.⁸ It didn’t take long for Douyin to explode in popularity, sweeping up 100 million users in China and Thailand alone in just its first year.⁹

For a time, TikTok and Musical.ly competed in the United States, and Musical.ly was winning.¹⁰ At its peak, the app had 100 million monthly users.¹¹ But within a year of going live with TikTok, ByteDance made a formal offer to buy out Musical.ly. In November 2017, Musical.ly agreed to be acquired for $1 billion.¹²

The merger made sense for both parties. Musical.ly was facing a growth problem at the time, as the number of new users was plateauing.¹³ And TikTok was floundering in the United States. So when ByteDance took over, it shifted over users from Musical.ly to TikTok and started pumping resources into TikTok to drive its growth. One arm of this strategy involved massive ad spending. At one point in 2018, the company spent $3 million per day on acquisition marketing in the United States alone, totaling $1 billion at year’s end.¹⁴ Some 80 percent of that ad spending went to its US competitor Snap.¹⁵

Snap CEO Evan Spiegel recently commented that this part of the business plan seemed “unimaginable—no startup could afford to invest billions and billions and billions of dollars in user acquisition like that around the world.” Spiegel continued, “It was a totally different strategy than any technology company had expected before because it wasn’t an innovation-led strategy; it was really about subsidizing large-scale user acquisition.”¹⁶

The strategy of massive ad buying was coupled with sweeping changes of the algorithm that drove growth. ByteDance employs an unusually large number of software engineers even for a tech company. About half of the company is made up of people working on the problem of algorithms.¹⁷ ByteDance had success with the algorithm-driven app Toutiao for news and then with Douyin in China. This brute-force method of bettering the algorithm was then applied to TikTok to resounding success.

Applying the engine behind ByteDance to TikTok “abstracted that problem away,” as Eugene Wei explained.¹⁸ He continued:

That, more than anything else, was the critical upgrade Bytedance applied to Musical.ly to turn it into TikTok. Friends at Bytedance claimed, with some pride, that after they plugged Musical.ly, now TikTok, into Bytedance’s back-end algorithm, they doubled the time spent in the app. I was skeptical until I asked some friends who had some data on the before and after. The step change in the graph was anything but subtle.

To outsiders and many of those who use it, TikTok seems to knows our innermost thoughts.¹⁹ As one writer explained, “The TikTok algorithm is smart. Or, at least, I think it is.”²⁰ In reality, the TikTok algorithm is the result of attacking a complex problem with lots of people. Julian McAuley, a seasoned computer science professor at the University of California San Diego, dispelled the myth, noting that “there seems to be some perception (by the media? or the public?) that they’ve cracked some magic code for recommendation, but most of what I’ve seen seems pretty normal.”²¹

The algorithm is scrutable. Behind the scenes, it’s a combination of machine learning, user-engagement metrics, and content analysis that drives the platform. While the exact weightings and nuances of these factors may be proprietary to TikTok, the general principles are not revolutionary or unknowable. Given the right circumstances and permissions, a comprehensive audit could shed light on the inner workings of this system.

Trump’s Executive Order on TikTok

The legal foundations for Trump’s executive order on TikTok were laid a year earlier. On May 15, 2019, the Trump administration issued Executive Order 13873, which declared that the widespread use of communications networks could be exploited by foreign adversaries and thus posed a threat to national security.²² While it was initially used to target Huawei, this executive order was the groundwork that allowed the president to invoke the International Emergency Economic Powers Act (IEEPA) in August 2020 and to issue Executive Order 13942 to restrict TikTok’s US operations.²³

The first official announcement that the White House was considering a ban of TikTok came in July 7, 2020, which seemed to coincide with reports that TikTok was in talks with Microsoft to get bought out. Just days before Microsoft was set to announce a deal, President Trump slapped down the idea of a domestic company buying the platform.²⁴ He told reporters when the news broke that “as far as TikTok is concerned we’re banning them from the United States. Well, I have that authority. I can do it with an executive order or that,” referring to emergency economic powers.

On August 6, 2020, the White House gave TikTok’s parent company in Beijing, ByteDance, 45 days to sell off the social media app or face a ban in the United States.²⁵ Hours later, the administration also dropped an executive order on Tencent, banning the WeChat app from phones with a similar deadline.²⁶

As outlined in the executive order, the administration was concerned that TikTok could become an arm of the CCP if the company were to (1) censor TikTok content that could be damaging to the CCP, (2) track federal employees and blackmail them, or (3) manipulate the algorithm to distribute propaganda.

Still, TikTok has taken actions to distance itself from the Chinese government. Even before the executive order dropped, TikTok had announced that it was open to disclosing its algorithms, moderation policies, and data flows to regulators for review.²⁷ When China began to crack down on Hong Kong, TikTok pulled out of the region because it didn’t want to comply with the censorship and requests for data.²⁸ The company also reinstated videos condemning Beijing’s crackdown on Muslims, claiming they were wrongfully taken down.²⁹ In another incident, the Acton Institute ran ads about the crackdowns in Hong Kong, and they were taken down. But once news spread, TikTok reinstated the think tank’s profile and the ads the next day.³⁰

If the CCP was using TikTok to track US citizens, none of the most blatant methods of accessing unauthorized data, also called exfiltration, were occurring.

Shortly after the executive order dropped, French security researcher Elliot Alderson conducted a deep dive into TikTok’s data logs and found nothing unusual, saying, “In its current state, TikTok doesn’t have a suspicious behavior and is not exfiltrating unusual data.”³¹ He continued, “We would obtain similar results with Facebook, Snapchat, Instagram and others.”³² If CCP officials have access, it stands to reason, then the access is through a back door.

In a thorough look at all of the criticism, Dr. Milton L. Mueller and Dr. Karim Farhat of Georgia Tech’s Internet Governance Project found:

The app “is not exporting censorship, either directly by blocking material, or indirectly via its recommendation algorithm. Its content policies are governed by market forces.”³³
“The data collected by TikTok can only be of espionage value if it comes from users who are intimately connected to national security functions and use the app in ways that expose sensitive information.”³⁴
And importantly, “Because social media apps publish and share so much data, China does not need to have special legal powers over ByteDance to use TikTok (or any other social media app) to monitor users.”³⁵

Similarly, the Citizen Lab at the University of Toronto concluded in 2021 that “TikTok’s program features and code do not pose a threat to national security.”³⁶ The Australian government also set up an official government task force to look into TikTok and found that there was “no reason for us to restrict those applications at this point.”³⁷

Although US officials have warned about China’s potential for abuse with TikTok since 2019, there has been limited evidence that the Chinese government has actually interfered with TikTok’s operations. Some reports suggest that engineers in China seem to have backdoor access to American users, but this power seems to be utilized sparingly and hasn’t been confirmed.³⁸

The most damning and direct claims of interference have come from the court documents of a former employee of ByteDance, Yintao Yu.³⁹ In a series of filings related to a wrongful-termination suit, Yu alleged that the CCP spied on pro-democracy protesters in Hong Kong in 2018 by using backdoor access to TikTok to identify and monitor the activists’ locations and communications.⁴⁰ All of TikTok’s Hong Kong operations ceased when the new draconian Chinese information law went into effect.

Still, the presence of a backdoor for US users has long been a point of dispute. Testifying before Congress, TikTok CEO Shou Zi Chew said that “TikTok has never shared, or received a request to share, US user data with the Chinese government. Nor would TikTok honour such a request if one were ever made.” Beginning in 2020, ByteDance began erecting technical firewalls to limit this kind of access after it received criticism.⁴¹ To quiet critics, TikTok also onshored US data flows via Project Texas, which will be discussed later. In other words, ByteDance took the extremely rare decision to region-lock internal codebases and data against its own engineers from China beginning in 2020 and has been working since then to bifurcate data operations.

Forbes also revealed that TikTok has kept highly sensitive financial information about its prominent stars, including those participating in its Creator Fund, on servers based in China. In contrast, earlier this year, CEO Shou Chew stated to Congress that “American data has always been stored in Virginia and Singapore.”⁴²

Still, TikTok hasn’t made any friends in the press, because it has also been recently revealed that the company spied on news organizations. Journalist Emily Baker-White has uncovered the misconduct by TikTok and its parent company, ByteDance.⁴³ According to a number of people cited in the report, ByteDance admitted to allegations of spying on journalists, although the company asserts it was a result of a mishandled leak investigation.⁴⁴

Recently it was reported that the Justice Department, the FBI, and the US attorney for the Eastern District of Virginia are investigating ByteDance, the parent company of TikTok, for the company’s surveillance of American citizens.⁴⁵ The investigation, which began late last year, seems to have come after ByteDance admitted that its employees inappropriately obtained data on American TikTok users, including two reporters and a few of their associates. Still, it is difficult to situate these types of incidents. Almost all platforms have had some version of a data leak or breach. The question is whether the individual evidence reflects some systemic problem or is a more limited, isolated incident.

The TikTok Ban Is Challenged

Two challenges were filed in court, one by TikTok and ByteDance, and the other by a group of TikTok users. The litigation in both cases centered around two exceptions to IEEPA. The first is the personal-communication exception, which prohibits the president from limiting “any personal communication that does not involve a transfer of anything of value,” such as postal, telegraphic, or telephonic communication. The second is the informational-materials exception, also known as the Berman Amendment, which bars the president from restricting most forms of “information or informational materials,” including publications, films, posters, photographs, artworks, and news-wire feeds.

In 1988, Congress passed amendments to IEEPA, authored by Rep. Howard Berman, to ensure that American citizens received information from countries that were being embargoed. These revisions, now called the Berman Amendment, included changes to IEEPA as well as the Trading with the Enemy Act of 1917, which gives the president of the United States the power to oversee or restrict trade in times of war. After the Berman Amendment went into effect, the Office of Foreign Assets Control under the US Department of Treasury interpreted this exemption narrowly. In response, Berman again led Congress to act. In 1994, the Free Trade in Ideas Act was signed into law. This bill broadened the Berman Amendment to include newer and forthcoming electronic mediums. It also was made clear that the president’s emergency sanction powers under IEEPA and the Trading with the Enemy Act cannot be used with regard to any information or informational materials, regardless of their format or medium and whether they are intended for personal or commercial use.

Congress today is vastly different from Congress in the late 1980s and into the mid-1990s, when the Berman Amendment was passed. Even still, much of what is in the amendments is statutory codifications of First Amendment principles.⁴⁶ In other words, if Berman didn’t exist, it’s still possible that executive action would get struck down on First Amendment grounds.

The plaintiffs asserted that TikTok’s primary function of creating and sharing short-form videos involved transmitting personal communication and informational materials, albeit in a modern format. To sidestep this argument, the Commerce Department limited its restrictions to “business-to-business transactions.”

On September 27, 2020, the US District Court for the District of Columbia granted TikTok’s case a preliminary injunction, allowing the platform to stay on app stores run by Apple and Google.⁴⁷ One month later, a district court ruled on the case brought by users and fully blocked the Trump administration’s ban.⁴⁸ Then, in December 2020, the US District Court of the District of Columbia granted a permanent nationwide injunction originally sought by ByteDance.⁴⁹ Taken together, these cases only affirmed that the exemptions included TikTok.

Both cases were dropped when President Biden came into office. Plans to force the sale of TikTok’s US operations to Walmart and Oracle were also shelved with the switch of leadership.⁵⁰ But TikTok continued to work with Oracle for an audit.⁵¹ Instead, President Biden replaced President Trump’s executive orders with Executive Order 14032 on June 9, 2021. This order outlined a process to mitigate the “unacceptable risk” associated with Chinese social media apps. It also involved an interagency report within 120 days, federal executive-action recommendations within 180 days, and ongoing evaluations of risky app transactions by the secretary of commerce. The report still hasn’t been released.

The CFIUS process

Around the same time that President Trump started the process to ban TikTok, CFIUS opened an investigation of TikTok. Treasury Secretary Janet Yellen oversees CFIUS, a committee made up of members from the State, Justice, Energy, and Commerce Departments, among others, that investigates national security risks from foreign investments in American firms. CFIUS is a secretive intragovernment committee that has the authority to review any transaction that could result in the control of a US business by a foreign person or entity, regardless of the size or value of the transaction. It also has the power to investigate transactions that have already been completed. CFIUS’s legal hook with TikTok came about because ByteDance merged Musical.ly into its existing TikTok app.

CFIUS also grants the president substantial power to act separately from CFIUS. If the president deems there is credible evidence suggesting a transaction could jeopardize national security, and such threats are not mitigable through other legal means, he or she can forbid or halt such a transaction. A week after the original TikTok executive order was signed, President Trump issued a divestment order using the power of CFIUS to force the sale of TikTok.⁵²

To help stave off this sale and respond to the executive orders, ByteDance opened a parallel negotiation with US companies to house data with the blessing of the Trump administration.⁵³ As part of this agreement, ByteDance would have created a US subsidiary called TikTok Global, which would have been part-owned by Walmart and Oracle. ByteDance would have still owned 80 percent of the business, but the biggest concession was that it agreed to migrate US user data to Oracle servers in the States. Still, it was an about-face from the administration, which was vehemently against Microsoft or any other domestic firm owning TikTok just weeks before.

TikTok and ByteDance also filed a challenge to the divestment order in November 2020, arguing that it violated constitutional protections of due process rights under the Fifth Amendment and the taking of private property without just compensation. After the transition to the Biden administration, TikTok, ByteDance, and the executive branch requested that the court hold the case in abeyance while the parties tried to resolve the issue. At time of writing, this case remains in abeyance.

All the while, the CFIUS process continued. In the late summer of 2022, ByteDance, TikTok, and CFIUS were close to an agreement, which would have given US authorities extensive power over the platform.⁵⁴ That arrangement would have given either the Department of Justice or the Department of Defense the ability to (1) examine TikTok’s US facilities, records, equipment, and servers with minimal or no notice, (2) block changes to the app’s US terms of service, moderation policies, and privacy policy, (2) veto the hiring of any executive involved in leading TikTok’s US Data Security organization, (4) order TikTok and ByteDance to pay for and subject themselves to various audits, assessments, and other reports on the security of TikTok’s US functions, and (5) in some circumstances, require ByteDance to temporarily stop TikTok from functioning in the United States—a kill switch.

But it was around this time that CFIUS’s review of TikTok ground to a halt, primarily because the Department of Justice wanted more.⁵⁵ James Lewis, the director of the Strategic Technologies Program at the Center for Strategic and International Studies, told Bloomberg last year that ByteDance and CFIUS “had an agreement drafted, DOJ and FBI didn’t like it, they didn’t think it was tough enough, so [FBI director] Wray did the typical Washington thing, which is to take the deal back to the table.”⁵⁶

CFIUS has been flexing the power given to it by the 2018 Foreign Investment Risk Review Modernization Act, known as FIRRMA. In 2018, despite presenting a mitigation proposal to allay concerns over Chinese access to data, the $1.2 billion deal between MoneyGram and China’s Ant Financial was blocked. In March 2019, CFIUS ordered Kunlun Tech to divest Grindr. While nothing official was ever announced, it was reported that data concerns over geolocation, sexual preferences, and HIV status sank the deal. Beijing Shiji Information Technology was also forced to divest all interests in StayNTouch based on a CFIUS decision. Again, nothing official was ever announced, but it was reported that ID-scanning and facial-recognition technology likely raised concerns.

TikTok has said that it has complied with CFIUS’s demands.⁵⁷ Moreover, ByteDance has suggested that it would be open to the divestiture of TikTok.⁵⁸ However, the company considers this option to be a last resort and will only go down this road if the company cannot come to an agreement with CFIUS and can find a willing buyer.

Some aspects of the 2022 bargain were typical for CFIUS, including the need for audits and the ability to examine TikTok’s US facilities, equipment, and servers. But the kill switch and the ability to change moderation policies on a whim would be dramatic departures.

The deal would have also forced TikTok US to rely on an executive security committee that would operate in secrecy from ByteDance. Members of this committee would be responsible first for protecting the national security of the United States, as defined by the executive branch, and only then for making the company money. Ama Adams, a managing partner and CFIUS expert at Ropes & Gray, told Forbes that “setting up a structure that has allegiance to the United States—I’ve never seen language, per se, to that extent.”

If this reporting is indeed correct, CFIUS would have inserted the executive into content-moderation decisions of one of the biggest platforms in the United States, embroiling it in thorny free speech issues. Executive agencies are already facing the Supreme Court because of the intense pressure that the Biden White House placed on Facebook and Instagram to crack down on alleged misinformation.⁵⁹ This proposed deal would be an emboldened version of that, giving the government final say in TikTok’s content decisions. It too would spark concerns about governmental censorship or distortion of TikTok’s content.

A CFIUS decision has only ever been challenged in court once.⁶⁰ That case was settled out of court before the toughest judicial questions could be answered. So, it makes sense that CFIUS has opted to extend the negotiations because there are uncertainties about how a court might rule. Still, the fact that CFIUS review is secretive makes it difficult to truly assess whether everyone is negotiating in good faith. However, given what has been made public, it seems that CFIUS is demanding extensive provisions that go much further than what is needed.⁶¹

Legislation in the US Congress

In Congress, legislation aimed at banning TikTok has tended to focus on either amending the IEEPA or layering on another CFIUS-like process.

Senator Rubio offered up one vehicle for change through the Averting the National Threat of Internet Surveillance, Oppressive Censorship and Influence, and Algorithmic Learning by the Chinese Communist Party Act, or simply the ANTI-SOCIAL CCP Act.⁶² Senator Rubio’s act would change the wording of Section 1702(b) of IEEPA to give the president the authority to prohibit the import of nonphysical goods. This would allow the ban of intangible property like software applications, opening the door for the president to ban TikTok.

Senator Warner’s RESTRICT Act, however, has gotten the most attention and was once considered the vehicle to make a ban happen. In effect, it would establish a parallel review system to CFIUS in the Department of Commerce. If it passed, the secretary of commerce would have the authority to review transactions made by specific foreign entities offering “information and communications technologies products or services.”⁶³ The effect would be the elimination of the Berman Amendments altogether.

It remains an open question whether either one of these changes to the law would be constitutional. The First Amendment still limits what Congress or the president can do.

Of course, the White House endorsed the RESTRICT Act because it would grant the executive sweeping powers.⁶⁴ But analysts have pointed to the many flaws in this legislation, including the opaque and largely unaccountable authority the bill would provide to the secretary of commerce.⁶⁵ The bill is so expansive, especially with its definition of “internet communications technologies,” that mundane and helpful services like VPNs or payment systems might be caught up in a ban. The reaction by civil society was swift and critical because of just how sweeping the bill is.⁶⁶ It would mean violators could face 20 years in prison for using a VPN to access TikTok.

Attorneys at Dunlap Bennett & Ludwig, however, think the most direct way to address the informational-materials exception in IEEPA “is to give the President the power to review foreign technologies, specifically involving communications networks and social media companies that provide tangible and intangible technologies (from computer chips to software code) for importation into the United States that have an adversarial interest against the United States.”⁶⁷ In other words, instead of going after Section 1702(b), a specific power to review social media companies and other related technologies should be created as Section 1702(a)(4) of IEEPA. Much like an outright ban, as explained in the previous section, this change would have to pass court muster and First Amendment challenge. That is currently a really big if.

Policymakers should be mindful of the collateral effects of any TikTok-ban bill. Broader bills like the RESTRICT Act, which could lead to TikTok’s being banned or otherwise limited, could catch many international small and medium-sized businesses in their purview either intentionally or unintentionally.

The biggest problem with RESTRICT is that it would give even more power to the executive. The responsibility of crafting and implementing policies, especially those related to national security and foreign investments, already largely lies with the president. By transferring more decision-making authority to the executive branch, there is a potential risk of consolidating too much power in the hands of a single entity that already says little about how it makes decisions. In other words, placing the authority to ban apps solely in the hands of the executive branch raises concerns about accountability. Already the CFIUS process is opaque. By limiting Congress even more, there is a risk of diminished oversight and reduced opportunities for public debate.

States’ Legislatures Enter the Fray

While federal legislation has seemingly stalled, state legislatures have acted. This summer Montana passed SB 419, which was titled appropriately An Act Banning TikTok in Montana.⁶⁸ This legislation, the first of its kind, was explicit: “Tiktok may not operate within the territorial jurisdiction of Montana.”

On May 17, Governor Greg Gianforte signed the bill but not before trying to negotiate with the legislature to change the language so it didn’t specifically target the app.⁶⁹ At the end of April, Governor Gianforte sent back to the legislature what is known as an amendatory veto, which provides alternative draft language that the governor would sign if the legislature agreed.⁷⁰ In an e-mail exchange between Montana attorney general Austin Knudsen, bill-sponsor senator Shelly Vance, and the governor’s office, Knudsen wrote that “at this point, my preference is to leave the bill as is. [Montana’s Department of Justice] is prepared to defend it.”⁷¹

Almost immediately the bill was challenged in court by TikTok users.⁷² Much as expected, the challenge called into question the constitutionality of the bill especially as it relates to the First Amendment. First Amendment jurisprudence sets a high bar for a government restriction on a tool of expression.

Courts could say that a broad TikTok ban is prior restraint and is thus subject to the highest level of constitutional scrutiny—strict scrutiny. Under this framework the government would need to demonstrate that the ban is narrowly tailored in furtherance of a “compelling government interest.”⁷³ Narrow tailoring means that “if a less restrictive alternative would serve the [g]overnment’s purpose, the legislature must use that alternative.”⁷⁴ In other words, the government would have to bear the burden of proof that proposed alternatives are less effective than the challenged law.

Or the courts could say that a ban is content neutral, meaning it would be judged under intermediate scrutiny. Regulations that either don’t focus on content or only occasionally curtail speech during the regulation of conduct fall under this constitutional standard. Still, there are similar thresholds to strict scrutiny, requiring that the regulation “furthers an important or substantial governmental interest” that is “unrelated to the suppression of free expression,” and that “the incidental restriction on alleged First Amendment freedoms is no greater than is essential to the furtherance of that interest.” Courts might also ask whether a regulation “leave[s] open ample alternative channels for communication.”⁷⁵ In a review of the legality of Trump’s WeChat ban, which happened around the same time as the TikTok ban, the court concluded the restrictions were not appropriately tailored and failed intermediate scrutiny. It noted that there were “obvious alternatives to a complete ban, such as barring WeChat from government devices . . . or taking other steps to address data security.” As it stands, courts must look closely at the government’s evidence to ensure “that the recited harms are real, not merely conjectural, and that the regulation will in fact alleviate these harms in a direct and material way.”⁷⁶ It is likely that a similar set of criteria would be applied to a TikTok ban.

What Should Be Done and What’s Likely to Have Limited Effects

Rightly, TikTok gets associated with Chinese intelligence interests and the CCP. While it is irrefutable that the Chinese government poses a significant threat, policymakers should be careful in dealing with TikTok. Taking hasty measures now might lead to long-term ramifications, especially if these actions create the expectation that the US government can blacklist foreign companies using national security as blanket justification.

There are a lot of options on the table with TikTok, but they all must begin with defining the exact harms that need to be mitigated. When considering a legal action that would affect the free speech rights, economic income, and entertainment of up to 150 million Americans, the evidentiary support should carry equal weight to the action itself.

While evidence might be uncovered that supports the worst national security fears, the evidence so far does not support the strongest claims against TikTok. Rather, the chorus from the intelligence community is that TikTok has the potential for harm. FBI director Wray and others have never made specific claims. Rather, he, like others, has warned of “the possibility that the Chinese government could use to control data collection on millions of users or control the recommendation algorithm, which could be used for influence operations.”⁷⁷

Sometime between 2021 and 2022, TikTok worked to allay fears by implementing a new data architecture, known as Project Texas.⁷⁸ TikTok has spent some $1.5 billion to implement the plan, which now routes all US user data to Oracle’s cloud infrastructure instead of the data centers in Virginia and Singapore. TikTok has spent a lot to comply, which does suggest it is committed. On June 17, 2022, as part of Project Texas, TikTok completed the migration of data to Oracle servers for US TikTok users.⁷⁹ In March 2023, the company began deleting data held in other servers.

Project Texas also brought content moderation into United States. On top of this, TikTok has offered to disclose its algorithm, moderation policies, and data flows to regulators and other third parties for review. All of these changes are in addition to the above-noted alteration in the codebase to restrict Chinese engineers.

TikTok may be navigating ambiguous legal waters, but it is already subject to an oversight regime. Formalizing this process would be the most prudent next step.

CFIUS could take the lead and agree to a pared-down version of its summer 2022 agreement. A government agency, likely the Department of Justice, would have the ability to (1) examine TikTok’s US facilities, records, equipment, and servers with minimal or no notice; (2) ensure ByteDance has put in place restrictions on source code and sensitive data; and (3) order TikTok and ByteDance to pay for and subject themselves to various audits, assessments, and other reports on the security of TikTok’s US functions.

To ensure compliance, the deal could be probationary. If TikTok wasn’t compliant, CFIUS could reopen the case. Samm Sacks of Yale has been a proponent of this solution since “TikTok could be audited by an outside party to verify how it manages its data, including to verify a firewall with its parent company in China.”⁸⁰ It would formalize what is already occurring.

The passage of a federal privacy law has also been floated as a potential solution. One of the supposed merits of this approach is that it wouldn’t solely target TikTok.⁸¹ Nevertheless, if the concern is that the CCP or another hostile government might access user data or have sway in algorithmic decision-making, the bill would have to include language that localizes user data and restricts all governments from modifying algorithms. Data localization has largely been outside of the scope of current proposals and is not a provision in the leading bill, the American Data Privacy and Protection Act.⁸²

It is worth noting that the Chinese intelligence community can already buy US data on the open market through data brokers if it wants. The Secret Service does it, bypassing the need for a warrant.⁸³ If this kind of exfiltration is a concern, then Congress should just ban all sales of personal data to China. Two laws recently proposed would do just that. Under HR 6942, the Internet Application Integrity and Disclosure Act, and HR 6969, the Telling Everyone the Location of Data Leaving the US (TELL) Act, companies would be limited in the kind of information that they export or sell to Chinese companies.

Some have argued that divestiture is the only real path forward. But if stringent measures are taken to ensure that user data and the codebase are securely firewalled, they will effectively mimic divestiture. When implemented robustly, these barriers ensure that data remains confined to its intended environment. In other words, protective measures offer a safeguard similar to the outcomes expected from a divestiture, without the need for actual ownership changes or structural separations.

Still, ByteDance has suggested that it would be open to the divestiture of TikTok.⁸⁴ However, the company considers this option to be a last resort and will only go down this road if the company cannot come to an agreement with CFIUS and can find a willing buyer. Neither this administration or the previous one has been especially open to this idea. Trump effectively nixed a deal that could have solved this problem long ago. The Biden administration under the leadership of Federal Trade Commission chair Khan has taken a tough stance on antitrust. So finding a willing buyer will be difficult.⁸⁵ If the administration really wants a divestiture, it will need to change its stance on antitrust.

While there is no evidence of overt manipulation of the algorithm, a sophisticated Chinese influence campaign could take a more subtle tactic.⁸⁶ Operating under false names, a Chinese-backed group could engage in coordinated disinformation campaigns that TikTok just fails to police. As James Andrew Lewis explained, “The greatest risk comes not from what TikTok does, but from what it doesn’t do.”⁸⁷

Still, close watchers of TikTok are skeptical of the claims of censorship in the United States. Analyst Eugene Wei noted, “I tend to think that problem is overrated because my sense is that many in China still don’t understand the nuances of American culture, just as America doesn’t understand theirs.”⁸⁸

Given the serious talk of banning TikTok, it’s crucial that Congress properly research and validate the need for such a significant step. In other words, Congress needs to open an investigation, as it has done in the past, to determine whether there is sufficient evidence of harm to justify a remedy as severe as a ban or divestment order. Earlier this year, the House of Representatives established a select committee on China to investigate the strategic challenges posed by the country.⁸⁹ A look into TikTok has been suggested, but nothing official has been announced.

How the CCP fits into this story is still uncertain. Shu Jueting, a spokeswoman for the government, said that if the US decision would be based on TikTok’s foreign ownership, rather than its products and services, it would “severely damage confidence of foreign investors, including those from China.”⁹⁰

Daniel Russel of the Asia Society Policy Institute thinks there is more posturing than hard line in China’s statements about TikTok. As he explained, “The Chinese government’s public declaration that it would block the sale of TikTok in the US has little to do with protection of Chinese algorithms and technology and a lot to do with giving Washington a taste of its own medicine.”⁹¹ Continuing, he noted that “Beijing, having heard [Commerce] Secretary Raymond’s lament that banning TikTok would infuriate voters under 35, is now double-daring Congress and the Administration to ‘make my day.’” So it remains unclear whether China would try to push back against a sale.

While those in favor of banning TikTok highlight the benefits, there are clear downsides as well. For one, banning apps like WeChat and TikTok closes off American companies from foreign markets. One recent report estimates that Apple would suffer a 25–30 percent decline in global sales if these apps were not available.⁹²

Most importantly, banning TikTok removes the soft influence that the US market could play in shaping one of the most valuable tech companies in the world. In fact, the company seems to be struggling to pull itself away from its Chinese roots. All of the small shifts to capture the large international market have caused a backlash in China, where the founder is routinely called “a traitor of China, a coward, and an American apologist.”⁹³ The move would embolden techno-nationalist voices within China to take even harder stances on the United States.⁹⁴

Policymakers need to be clear-eyed that there’s limited evidence of harm with TikTok. TikTok exists in a legal gray area, but it is being de facto regulated by the CFIUS process. Simply put, there are ways of mitigating the potential threats of TikTok other than a complete ban. But first and most importantly, those concerns need to be clearly laid out.

Conclusion

This likely won’t be the last time the US needs to address an app with ties to a foreign adversary. Indeed, there are other popular Chinese-based apps in use throughout the US.⁹⁵ Whatever is done with TikTok will set a precedent domestically and internationally for other Chinese-based apps or apps and platforms that are based in other countries, whether they are foreign adversaries or countries with lax laws or corrupt governments. The benefits and risks of the Internet are that it is a borderless, international network.

In the end, we need to move away from the false dilemma of ban or no ban, and work toward more nuanced and effective approaches that safeguard user privacy, promote healthy competition, and encourage responsible content moderation.

The Complex Case of TikTok in the United States

Executive Summary

Resources

Focuses

Introduction

A History of TikTok

Trump’s Executive Order on TikTok

The TikTok Ban Is Challenged

The CFIUS process

Legislation in the US Congress

States’ Legislatures Enter the Fray

What Should Be Done and What’s Likely to Have Limited Effects

Conclusion

Executive Summary

Resources

Related Publications

Related News

Related Blogs

Focuses

Introduction

A History of TikTok

Trump’s Executive Order on TikTok

The TikTok Ban Is Challenged

The CFIUS process

Legislation in the US Congress

States’ Legislatures Enter the Fray

What Should Be Done and What’s Likely to Have Limited Effects

Conclusion