This is a developing story.

Today, a bipartisan group of lawmakers introduced a bill that would force ByteDance, the Chinese technology company that owns TikTok, to sell the app to a non-Chinese company due to national security concerns.

Representative Mike Gallagher (R-WI), chair of the House select China committee, and Raja Krishnamoorthi (D-IL) co-authored legislation that would give ByteDance 165 days to divest from TikTok or face a ban from US app stores. The legislation would also expand the president's power to ban or restrict apps deemed concerning to national security.

The news comes on the heels of years of scrutiny into TikTok’s collection and analysis of American user data. China’s national security law requires domestic companies to turn over customer data if requested by the CCP and, per its privacy policy, TikTok collects a laundry list of personal identifiers from each user, including IP addresses, usage information, unique device identifiers, connected audio devices, keystroke patterns, location coordinates, and “faceprints and voiceprints.”

In 2019, the Committee on Foreign Investment in the United States (CFIUS) began investigating ByteDance’s acquisition of Musical.ly (which subsequently merged with TikTok) and shortly afterwards, the US Navy and Army banned TikTok on its government-issued devices. (In 2022, Congress passed a law banning TikTok on all federal government devices.) Then, in 2020, after several American plaintiffs filed a class-action lawsuit alleging TikTok improperly collected and shared personal data from around 89 million users, including children as young as six, President Trump signed an executive order banning TikTok from operating in the US unless ByteDance sold a majority stake in the app to an American company. But TikTok challenged the order in court, won a preliminary injunction, and ultimately saw the ban rescinded under the Biden Administration.

TikTok employees have repeatedly claimed the company safeguards American user data, but independent investigation belies this. For instance, in 2021, TikTok executive Michael Beckerman stated under sworn testimony to a subcommittee of the Senate Commerce Committee that TikTok “[did] not share information with the Chinese government” and that TikTok had “no affiliation” with a Beijing-based ByteDance affiliate. But in 2022, BuzzFeed News reporting based on leaked internal audio found China-based ByteDance employees routinely accessed confidential American TikTok user data. TikTok subsequently launched “Project Texas,” a $1.5 billion initiative to “make every American on TikTok feel safe” by ensuring their data was stored on US-based servers operated by Oracle, an Austin-based company.

TikTok CEO Shou Zi Chew leaned heavily on the privacy guarantees of Project Texas in his five-hour hearing before the House Committee on Energy and Commerce last April, where he insisted TikTok had built “a firewall to seal off protected U.S. user data from unauthorized foreign access” and that “American data [was] stored on American soil, by an American company, overseen by American personnel.” The testimony came after the Biden Administration threatened to ban TikTok unless ByteDance sold the app. Yet shortly after the hearing, Pirate Wires found a number of “limited exceptions” clauses in Project Texas allowing ByteDance employees to access American user data. Further investigation by Forbes revealed TikTok’s American data center operations were still “tightly enmeshed” with China-based ByteDance operations, with server work orders sent to technicians by a ByteDance subsidiary partially owned by the CCP. (TikTok is also currently facing a joint FBI-DOJ investigation for its alleged surveillance of American journalists who have broken stories related to its data collection methods.)

Faced with this scrutiny, TikTok has hired dozens of well-connected DC lobbyists, many of whom have close connections with the CFIUS. Pirate Wires detailed these connections in a report last April, which found TikTok had hired former staffers of Joe Biden, Barack Obama, Hillary Clinton, Nancy Pelosi, Pete Buttigieg, Kevin McCarthy, Paul Ryan, John McCain, Adam Schiff, and Jeff Flake, along with several lawyers who used to work for the Department of Justice and the Department of the Treasury.

The federal government can force foreign companies into divestiture under several legal and regulatory mechanisms. Though the CFIUS typically investigates mergers that would give non-citizens majority control over American companies, in 2020 it forced Kunlun, the Chinese owner of Grindr, to sell the dating app due to privacy concerns. Elsewhere, the Biden Administration recently issued an executive order restricting American investment in Chinese companies developing advanced semiconductors and quantum computers, in an attempt to stymie the CCP’s deployment of cutting-edge defense technology.

UPDATE:

A few hours after announcement of the legislation broke, House Energy and Commerce Committee Chair Cathy McMorris Rodgers announced the committee would hold a full meeting Thursday to discuss two bills: H.R. 7521, the Protecting Americans from Foreign Adversary Controlled Applications Act, and H.R. 7520, the Protecting Americans’ Data from Foreign Adversaries Act of 2024.

Of the former, which would force ByteDance to divest from TikTok or face an American app store ban, Rodgers said: "Foreign adversaries like China pose the greatest national security threat of our time. With applications like TikTok, these countries are able to target, surveil, and manipulate Americans. [H.R. 7521] ends this practice by banning applications controlled by foreign adversaries of the United States that pose a clear national security risk."

— Sanjana Friedman