In April 2024, Congress enacted the Protecting Americans from Foreign Adversary Controlled Applications Act (PAFACAA) as part of a supplemental appropriations act (P.L. 118-50). The PAFACAA makes it unlawful to provide certain services to "distribute, maintain, or update . . . a foreign adversary controlled application" in the United States unless the covered application's owners execute a "qualified divestiture" within a specified timeframe. The Act expressly includes applications operated by TikTok or its parent company ByteDance, Ltd., in the definition of "foreign adversary controlled application." Approximately two weeks after Congress enacted the PAFACAA, TikTok and ByteDance sued to enjoin enforcement of the Act. In their court filing, TikTok and ByteDance claim that the Act violates the First Amendment's Free Speech Clause, Article I's Bill of Attainder Clause, the Fifth Amendment's Takings Clause, and the equal protection component of the Fifth Amendment's Due Process Clause. (The merits of TikTok's and ByteDance's challenge to the PAFACAA have not yet been litigated. As of the date of this Sidebar's publication, the Department of Justice has not yet filed a response to the companies' petition for review.)
This Legal Sidebar summarizes the substantive provisions of the PAFACAA, analyzes the Act's provisions governing enforcement and judicial review, and addresses questions regarding application of the Bill of Attainder Clause and the First Amendment's Free Speech Clause. Other CRS products discuss policy considerations related to the Act's terms, address other legal considerations raised by proposals to restrict TikTok, and respond to frequently asked questions about the regulation of TikTok—including a question about the Fifth Amendment's Takings Clause.
Overview of the PAFACAA
The PAFACAA regulates "foreign adversary controlled applications" and the app stores and internet hosting services through which users access them. The Act expressly defines "foreign adversary controlled applications" to include applications operated by TikTok and any other subsidiary of TikTok's parent company ByteDance, Ltd. The definition also includes any other website, app, or augmented or immersive technology that (1) meets certain definitional requirements (e.g., allows users to share content with each other and has more than 1 million monthly active users); (2) is owned by a company located in, or a company for which persons owning at least a 20% stake are located in, a foreign adversary controlled country listed in 10 U.S.C. § 4872(d)(2); and (3) has been determined by the President to present a significant national security threat. The Act excludes applications from these definitional requirements if the "primary purpose" of the application "is to allow users to post product reviews, business reviews, or travel information and reviews."
Under the Act, app stores and internet hosting services are prohibited from enabling the distribution, maintenance, or updating of a foreign adversary controlled application unless the application's owners execute a "qualified divestiture." For a transaction to be a qualified divestiture, the President has to determine that, after the transaction is executed, the application would no longer be controlled by, and would have no operational relationship with, a foreign adversary. The prohibition on app stores and internet hosting services distributing, maintaining, or updating foreign adversary controlled applications takes effect 270 days after the date of enactment for TikTok and other applications operated by ByteDance or its subsidiaries. If the President were to determine that another application qualified as a foreign adversary controlled application, the 270-day period would run from the date of the applicable presidential determination. In either case, the President can grant a one-time extension of up to 90 additional days when a path to a qualified divestiture has been identified, there is evidence of "significant" progress toward executing the divestiture, and there are legally binding agreements in place to enable the divestiture. If a qualified divestiture is completed during this 270-day—or, if extended, 360-day—time period, app stores and internet hosting services can continue supporting the application at issue without interruption. Even after the prohibition on supporting a foreign adversary controlled application takes effect, it ceases to apply once a qualified divestiture has been completed.
During the period between designation as a foreign adversary controlled application and the effective date of the prohibition on supporting the application, a foreign adversary controlled application is required to provide U.S. users, upon request, with all the data related to their accounts, including their posts, photos, and videos, in a machine readable format.
Foreign adversary controlled applications, app stores, and internet hosting services could face civil penalties if they do not comply with these provisions. An app store or internet hosting service that continues to enable distribution, maintenance, or updates for a banned application could be subject to civil penalties of up to $5,000 multiplied by the number of U.S. users who accessed, maintained, or updated the application. A foreign adversary controlled application that fails to provide user data as required could be subject to civil penalties of up to $500 multiplied by the number of affected users.
Enforcement and Judicial Review
Section 2(d) of the PAFACAA governs enforcement of the Act. Section 2(d)(1) imposes civil penalties on entities who violate the Act's prohibitions. Section 2(d)(2) provides for enforcement by the Attorney General. Specifically, Section 2(d)(2)(A) authorizes the Attorney General to investigate potential violations and provides that, "if such an investigation results in a determination that a violation has occurred, the Attorney General shall pursue enforcement under paragraph (1)." Section 2(d)(2)(B) authorizes the Attorney General, upon a determination that a violation has occurred, to "bring an action in an appropriate district court of the United States for appropriate relief, including civil penalties under paragraph (1) or declaratory and injunctive relief."
Section 2(d)(2)(B) authorizes the Attorney General to sue in federal district court to sanction and remedy violations of the Act. It is not clear whether the directive in Section 2(d)(2)(A) that the Attorney General "shall pursue enforcement under paragraph (1)" provides for enforcement other than via civil suits under Section 2(d)(2)(B). To the extent Section 2(d)(2)(A) authorizes enforcement through other means, such as administrative proceedings, the Act does not clearly specify what action is authorized.
Section 3 of the PAFACAA limits judicial review of the Act itself or any enforcement actions taken pursuant to the Act. Section 3(a) provides, "A petition for review challenging this division [of P.L. 118-50] or any action, finding, or determination under this division may be filed only in the United States Court of Appeals for the District of Columbia Circuit." The term "petition for review" is generally used in other statutes to refer to judicial review of agency action. Because it is not clear whether and to what extent the Act authorizes administrative enforcement or other agency actions apart from civil suits, there may be uncertainty about what this provision includes. To the extent Section 2(d)(2)(A) of the Act authorizes administrative enforcement, Section 3(a) requires petitions for review of such agency action to proceed in the D.C. Circuit.
Section 3(b) provides that the D.C. Circuit "shall have exclusive jurisdiction over any challenge to this division [of P.L. 118-50] or any action, finding, or determination under this division." Constitutional challenges to federal laws and policies may arise in two ways other than via petitions for review of agency action. First, regulated entities or others alleging imminent harm under the law may sue to prevent enforcement of the law. TikTok and ByteDance's May 2024 suit seeking to enjoin the Attorney General from enforcing the PAFACAA is proceeding in this posture, sometimes called a pre-enforcement or offensive challenge. A challenge to a presidential determination under the Act might also proceed in this posture. A pre-enforcement challenge to a federal law is generally brought by filing a civil action in a trial-level federal district court. However, because Section 3(b) grants the D.C. Circuit exclusive jurisdiction over challenges to the Act or to actions or determinations under the Act, it appears that such challenges need to be filed at their inception in the D.C. Circuit. TikTok filed its petition for review of the constitutionality of the PAFACAA in the D.C. Circuit, asserting that that court has "original and exclusive jurisdiction" over the case.
The second way a challenge to the PAFACAA might proceed is known as a defensive challenge. In other words, if the Attorney General sued a person for violating the Act, the defendant might raise a constitutional claim as a defense to liability. A defensive challenge is ordinarily raised in response to a suit in the court where the case was commenced. Section 2(d)(2)(B) authorizes the Attorney General to bring enforcement suits in federal district court, so, absent special rules sending litigation to a different court, a defensive constitutional challenge to the Act would generally proceed in the same case in the same district court. However, under Section 3(b), it appears that such challenges need to proceed in the D.C. Circuit. This provision could mean that cases that the Attorney General files in district court would need to be transferred or otherwise referred to the D.C. Circuit if the defendant raises a constitutional defense. The Act does not expressly provide for such transfer or referral, leaving some uncertainty about how a defensive challenge would proceed.
As a constitutional matter, Congress has substantial authority to direct certain federal cases to specific federal courts, and some existing statutes require certain categories of cases to proceed in the D.C. Circuit. Typical laws that route cases to the D.C. Circuit generally apply to appeals, or to petitions for review of agency action, which sometimes begin in the federal appeals courts. Section 3(a) of the PAFACAA is similar to these laws. By contrast, sending matters to the D.C. Circuit before they are subject to a trial court or administrative agency proceeding is unusual. Congress generally does not provide for lawsuits to commence in the federal appeals courts or to be transferred to a federal appellate court if a defendant raises a particular defense. Statutes that direct certain cases to specific courts have been subject to significant litigation. Because Section 3 of the PAFACAA appears to provide for novel treatment of some cases and does not clearly specify the applicable procedures, there may be litigation around the Act's jurisdiction and venue provisions and the procedures that should apply to challenges to the Act. Such litigation is not likely to cast doubt on the constitutionality of the Act, but could impose costs and delays in enforcement.
Bill of Attainder Analysis
Article I, Section 9, clause 3, of the Constitution prohibits Congress from enacting bills of attainder—legislation that directly imposes punishment on an identifiable person or class of persons. In the leading bill of attainder case, Nixon v. Administrator of General Services, the Supreme Court held that legislation constitutes a bill of attainder if it (1) applies with specificity and (2) imposes punishment (3) without a judicial trial. All three requirements must be satisfied before a court will strike down a law as a bill of attainder. TikTok and ByteDance have challenged the PAFACAA as a bill of attainder. They argue that the Act singles them out by name for legislative punishment and inflicts on them penalties that historically have been associated with bills of attainder. There are, however, also reasons why the court may not strike down the PAFACAA as an unlawful bill of attainder.
With respect to the requirement that a bill of attainder apply with specificity, the civil penalties in the PAFACAA do not, as a technical matter, apply only to the named companies. The President could determine that additional applications qualify as foreign adversary controlled applications, and the civil penalties provided in the Act could apply both to companies that operate any foreign adversary controlled application and entities that enable the distribution or maintenance of the applications. The Act does name TikTok and ByteDance and imposes a burden on the named companies, however, essentially requiring a qualified divestiture within the statutorily provided timeframe to allow app stores to continue lawfully providing applications operated by those companies to U.S. users. A court could therefore find that the legislation satisfied the specificity requirement. Importantly, however, specificity standing alone is never sufficient to support a finding that a law is a bill of attainder; the law must also impose punishment without trial.
The determination of whether a law imposes punishment is complex and fact-based. A CRS In Focus provides analysis of how courts might apply the relevant legal standards to international sanctions legislation. The PAFACAA is not sanctions legislation, but much of that analysis would also apply to the Act. As a general matter, review of whether legislation is punitive for purposes of the Bill of Attainder Clause is deferential, and federal courts rarely strike down laws as bills of attainder. Courts are more likely to strike down legislation as a bill of attainder if it imposes punishment resembling criminal penalties based on a determination that the targeted entity has engaged in culpable conduct in the past. Courts are less likely to strike down legislation that reasonably serves a nonpunitive, forward-looking legislative purpose. To the extent a court determined that the PAFACAA is intended to protect national security rather than to punish the named companies, it would likely find that the Act does not impose punishment for purposes of the Bill of Attainder Clause.
Finally, the Bill of Attainder Clause bans only laws that impose punishment without trial. Section 2(d)(2)(B) of the PAFACAA authorizes the Attorney General to sue in district court to enforce the Act, thus providing a judicial trial before any sanction would be imposed. To the extent the PAFACAA also authorizes administrative enforcement, multiple federal appeals courts have held that the Bill of Attainder Clause does not apply to executive agency action. Moreover, it appears that any administrative enforcement action could be subject to judicial review by the D.C. Circuit. If a court found that the PAFACAA does not directly impose any legal liability without trial or agency enforcement action, it would not strike down the legislation as a bill of attainder.
First Amendment Considerations
In their petition for review challenging the PAFACAA, TikTok and ByteDance argue that the Act infringes TikTok's First Amendment rights. Some civil rights groups, trade groups, and others have made similar arguments and have also asserted that provisions included in the PAFACAA could infringe the First Amendment rights of hosting services and users. These types of First Amendment objections were raised with respect to the Trump Administration's restrictions on TikTok and WeChat and with state laws restricting TikTok, as discussed in a prior Legal Sidebar. (Ongoing litigation over a Montana law barring TikTok from operating in the state is discussed in more depth in a separate Legal Sidebar, although some of the legal issues raised in that case are specific to the state law context.) In cases challenging these restrictions in court, users argued the government violated the First Amendment by barring them from accessing an important forum for speech. TikTok claimed bans on the platform affect its own speech, in part by citing constitutional protections for speech hosts—a doctrine at issue in two cases currently pending before the Supreme Court. In other cases, TikTok also challenged bans as prior restraints, a distinct First Amendment doctrine raising additional constitutional considerations. TikTok invoked both the First Amendment rights of speech hosts and prior restraint doctrine in its petition challenging the PAFACAA. In statements about the PAFACAA's restrictions, app stores and other sites have pointed to similar constitutional privileges to curate and display content.
Most of the provisions enacted in the PAFACAA were introduced in H.R. 7521, and when that bill was introduced, some Members of Congress and government officials defended its constitutionality by arguing the bill regulates conduct rather than targeting the content of speech. The First Amendment prevents the government from unduly infringing expressive activity—whether so-called "pure" speech or expressive conduct—but does not bar the government from regulating conduct without any expressive element. First Amendment protections are triggered if a law targets conduct with both expressive and nonexpressive elements or has the inevitable effect of targeting expressive activity. With respect to the PAFACAA, some have argued that provisions in the Act focus on national security threats and an application's ownership by a foreign adversary—characterized as nonexpressive conduct of covered platforms. On the other hand, because the Act specifically identifies TikTok and could allow the President to designate other websites or applications that serve as platforms for speech, it could be seen as "singling out those engaged in expressive activity" and trigger First Amendment scrutiny. A federal trial court, for instance, ruled that a Montana law prohibiting TikTok's operations in the state targeted expressive activity, not solely nonexpressive conduct, because it banned a means of expression.
Another argument that the PAFACAA might not burden speech could stem from the Act's posture as a forced divestiture rather than a ban. Specifically, some have pointed out that the Act's prohibitions only apply if TikTok does not execute a "qualified divestiture," suggesting that the app can continue to operate "so long as it resolves the national security risks posed by its ownership structure." Depending on whether and how divestiture occurs, users might still be able to access the platform to share and receive speech, and app stores and hosting services might still be able to host the platform. The divestiture requirement could seemingly still burden TikTok's ability to operate a platform for speech, however, and the Supreme Court has recognized that even arguably economic regulations or restrictions short of a complete ban can burden speech in ways that potentially trigger some form of heightened judicial scrutiny.
If the PAFACAA were considered to burden expressive activity, the next relevant question in a constitutional analysis would be what level of First Amendment scrutiny should apply. Courts apply various tests depending on what type of speech is being regulated and how a given law operates. One important factor in this inquiry is whether a law is content based or content neutral—that is, whether a law applies to expression based on its subject matter, topic, or viewpoint. A content-based law will ordinarily be subject to strict scrutiny analysis and considered presumptively unconstitutional. Under strict scrutiny, a law is valid only if it is the least restrictive means to serve a compelling government interest. Restrictions based on the identity of the speaker may also be constitutionally suspect, particularly if the speaker is targeted because of their disfavored speech. Accordingly, if there were evidence the PAFACAA targets specific companies because of their speech or viewpoint, it might be evaluated under strict scrutiny and more likely to be ruled unconstitutional. The Act's definition of covered companies might be relevant to this inquiry. The Act excludes companies with a primary purpose of allowing users to post certain product, business, or travel reviews, arguably excluding these businesses based on the subject matter or topic of the speech they host. Lower courts that have evaluated state laws regulating social media companies have described somewhat similar exclusions in those laws as content based.
If a law is instead considered content neutral or if it only incidentally restricts speech while targeting nonexpressive activity, it may be reviewed under intermediate scrutiny. Under this constitutional standard, a law will be upheld if it advances an "important or substantial" government interest unrelated to the suppression of speech, if the restriction on speech is "no greater than is essential" to further this interest, and if it leaves open "ample alternative channels for communication of the information." Even if a reviewing court rejected the argument that the PAFACAA regulates nonexpressive conduct, it might still consider whether the legislation could be justified as a content-neutral ban on a particular manner of communicating—that is, on communicating via covered sites. Intermediate scrutiny is an easier standard for the government to satisfy than strict scrutiny but still entails a relatively robust standard of review. Courts have recognized that the federal government has a significant interest in national security, for instance, but trial courts evaluating bans on WeChat and TikTok have nonetheless concluded that the government did not meet the other prongs of the intermediate scrutiny standard. In particular, a court might evaluate whether the federal government could achieve its national security interests through an approach that is less speech-restrictive than a complete ban on the platform or a requirement to divest. It might also consider whether other speech platforms provide adequate alternatives for users to speak.