United StatesProtecting Americans from Foreign Adversary Controlled Applications Act
Pub. L. 118-50, div. H, 138 Stat. 955 (15 U.S.C. 9901 note)
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Prohibition, Data subject rights
As of .
What it requires
- It reaches you if you provide a marketplace (including an online mobile application store) or internet hosting services through which users within the land or maritime borders of the United States distribute, maintain, or update an application operated by ByteDance Ltd., TikTok, or a covered company the President has determined to present a significant threat to the national security of the United States, or if you own or control such an application (section 2(a) and (b)).
- Do not distribute, maintain, or update (or enable the distribution, maintenance, or updating of) a foreign adversary controlled application within the land or maritime borders of the United States, either by providing services through a marketplace (including an online mobile application store) or by providing internet hosting services, once the prohibition applies to that application (section 2(a)(1)).
- If you own or control a foreign adversary controlled application, provide a user within the land or maritime borders of the United States who asks, before the prohibition applies, all the available data related to the user's account, including posts, photos, and videos and all other account information, in a machine readable format (section 2(b)).
- The prohibition does not apply to an application for which a qualified divestiture is executed before the date on which the prohibition would begin to apply to it, and it ceases to apply to an application for which a qualified divestiture is executed after that date (section 2(c)(1)).
- Services necessary for you to attain compliance with subsections (a) and (b) are outside both subsections (section 2(c)(2)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
The civil penalty under section 2(d)(1)(A) for a violation of the prohibition in section 2(a), not to exceed $5,000 multiplied by the number of users within the land or maritime borders of the United States determined to have accessed, maintained, or updated the application as a result of the violation. Section 2(d)(1)(B) sets a separate maximum of $500 multiplied by the number of users affected by a violation of the data portability duty in section 2(b).
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Person
- Per violation amount
- 5,000
Who enforces it
Enforcement body
The Attorney General of the United States, who conducts the investigations and pursues enforcement under section 2(d)(2) of the Act.
What this law does
Division H of Public Law 118-50 makes it unlawful for an entity to distribute, maintain, or update (or enable the distribution, maintenance, or updating of) a foreign adversary controlled application by carrying out, within the land or maritime borders of the United States, either of two acts.
The first act is providing services to distribute, maintain, or update the application, including any source code of the application, by means of a marketplace, including an online mobile application store, through which users within the land or maritime borders of the United States may access, maintain, or update it.
The second act is providing internet hosting services to enable the distribution, maintenance, or updating of the application for users within the land or maritime borders of the United States. A foreign adversary controlled application includes a website, desktop application, mobile application, or augmented or immersive technology application that ByteDance Ltd. operates, directly or indirectly.
It also includes such an application operated by TikTok, or by a subsidiary of or a successor to ByteDance Ltd. or TikTok that is controlled by a foreign adversary. A foreign adversary controlled application also includes the application of a covered company that is controlled by a foreign adversary and that the President determines to present a significant threat to the national security of the United States.
For an application operated by ByteDance Ltd. or TikTok, the prohibition applies beginning on the date that is 270 days after the date of the enactment of the division. For an application of a covered company that the President determines to present a significant threat, the prohibition applies beginning on the date that is 270 days after the date of the relevant determination of the President.
The President may grant a one-time extension of not more than 90 days if the President certifies to Congress that a path to executing a qualified divestiture has been identified, that evidence of significant progress toward it has been produced, and that the relevant binding legal agreements are in place to enable it.
Before the prohibition applies to an application, the entity that owns or controls it must provide, on request by a user within the United States, all the available data related to the user's account, in a machine readable format. The prohibition does not apply to an application with respect to which a qualified divestiture is executed before the date on which the prohibition would begin to apply to it.
The prohibition ceases to apply to an application with respect to which a qualified divestiture is executed after the date on which the prohibition applies to it. A qualified divestiture is a divestiture or similar transaction that the President determines, through an interagency process, would result in the relevant foreign adversary controlled application no longer being controlled by a foreign adversary.
The President must also determine, through an interagency process, that the transaction precludes the establishment or maintenance of any operational relationship between the United States operations of the relevant application and any formerly affiliated entities that are controlled by a foreign adversary, including any cooperation with respect to the operation of a content recommendation algorithm or an agreement with respect to data sharing.
An entity that violates the prohibition is subject to a civil penalty not to exceed the amount that results from multiplying $5,000 by the number of users within the land or maritime borders of the United States determined to have accessed, maintained, or updated a foreign adversary controlled application as a result of the violation.
An entity that violates the data portability duty is subject to a civil penalty not to exceed the amount that results from multiplying $500 by the number of users within the land or maritime borders of the United States affected by the violation. The Attorney General conducts investigations related to potential violations and, if an investigation results in a determination that a violation has occurred, pursues enforcement under the civil penalty provisions.
The Attorney General may bring an action in an appropriate district court of the United States for appropriate relief, including civil penalties and declaratory and injunctive relief. Nothing in the division authorizes the Attorney General to pursue enforcement against an individual user of a foreign adversary controlled application.
The Court of Appeals for the District of Columbia Circuit has exclusive jurisdiction over any challenge to the division or any action, finding, or determination under it. A challenge to the division itself may be brought only not later than 165 days after the date of its enactment. On , the Federal Register published an Executive Order of stating that the Act's prohibitions with respect to ByteDance Ltd. and TikTok became effective on .
That order directs the Attorney General not to take any action on behalf of the United States to enforce the Act for 120 days from the date of the order.
When LexLint raises it
When your app profile says your app operates an app store or operates a social platform.