PAFACA – Foreign adversary controlled apps (TikTok)

Summary

The Act, enacted on 24 April 2024, makes it unlawful to distribute, maintain or update a "foreign adversary controlled application" in the United States through an online mobile application store or other marketplace, or to provide internet hosting services that enable this. It names applications operated directly or indirectly by ByteDance, Ltd., TikTok and their subsidiaries and successors, and allows the President to designate applications of other companies controlled by a foreign adversary country (China, Russia, Iran or North Korea) that present a significant threat to national security. The prohibitions apply from 19 January 2025, 270 days after enactment, and cease to apply after a "qualified divestiture" that ends foreign adversary control and any operational relationship, including cooperation on the recommendation algorithm and data sharing. Violations are subject to civil penalties of up to $5,000 per US user, enforced by the Attorney General; individual users cannot be penalised.

Information

Jurisdiction

United States

Issuing body

United States Congress

Type

Law

Available languages

English

Topics

• Supply chain
• Data protection

Notes

Before the prohibitions apply, the entity that owns or controls the application must give users who ask for it all their data in a machine-readable format, subject to a penalty of up to $500 per user. On 17 January 2025 the Supreme Court (TikTok Inc. v. Garland) held that the Act does not violate the First Amendment. The administration then suspended enforcement: Executive Order 14166 of 20 January 2025 directed the Attorney General not to enforce the Act until 5 April 2025, a period extended by Executive Orders 14258, 14310 and 14350 until 16 December 2025. With Executive Order 14352 of 25 September 2025 the President determined that the divestiture of TikTok's US operations to a new US-based joint venture, less than 20% owned by ByteDance and its affiliates, is a "qualified divestiture" once its implementation agreements are executed; the determination covers the TikTok, Lemon8 and CapCut applications, and enforcement was suspended for a further 120 days, until 23 January 2026. According to the Justice Department's Office of Legal Counsel opinion of 16 July 2026, the divestiture was completed in January 2026 and the TikTok USDS Joint Venture was established as provided for in Executive Order 14352: since then the law's prohibitions no longer apply to TikTok, but the law remains in force.

United States Congress. (2024). Protecting Americans from Foreign Adversary Controlled Applications Act (Division H of Public Law 118-50) (Public Law 118-50, Division H (15 U.S.C. 9901 note)). https://www.govinfo.gov/app/details/PLAW-118publ50

United States Congress. "Protecting Americans from Foreign Adversary Controlled Applications Act (Division H of Public Law 118-50)." 24 April 2024. https://www.govinfo.gov/app/details/PLAW-118publ50.

@misc{us_pafaca_tiktok_2024,
  author       = {{United States Congress}},
  title        = {{Protecting Americans from Foreign Adversary Controlled Applications Act (Division H of Public Law 118-50)}},
  year         = {2024},
  note         = {Public Law 118-50, Division H (15 U.S.C. 9901 note)},
  url          = {https://www.govinfo.gov/app/details/PLAW-118publ50},
  urldate      = {2026-11-02}
}