Protecting Americans from Foreign Adversary Controlled Applications Act (“PAFACA”)
On January 10, 2025, the Supreme Court heard oral arguments regarding TikTok, Inc.’s legal challenges to PAFACA following the decision of the U.S. Court of Appeals for the District of Columbia Circuit on December 6, 2024 rejecting TikTok’s challenges.
ime is running short. PAFACA will make it illegal for app stores and internet hosts to continue to make TikTok available within the United States on January 19, 2025, one day before President Trump assumes office. President Trump petitioned the Supreme Court to stay the January 19th effective date to allow his administration the opportunity to resolve the issues at stake through political means. Considering the tenor of the oral arguments, it appears the Supreme Court will affirm the lower court’s decision with respect to the case’s data collection rationale; however, it is possible the Court will have other guidance regarding the case’s covert content manipulation rationale and how that relates to PAFACA’s severability provisions (discussed below). It remains to be seen whether the timeline arguments made by TikTok and President Trump will result in the unique crafting of some form of extension. As discussed below, if PAFACA is left intact, even in part, it will pave the way for application to other foreign adversary controlled apps and websites.
TikTok, Inc. challenged PAFACA on First Amendment, equal protection, Bill of Attainder, and Fifth Amendment Takings grounds. In its denial of TikTok’s challenges, the D.C. Court stated:
During the Supreme Court’s oral argument session, the Court questioned TikTok’s counsel:
While this case has attracted global attention, it is important to note that PAFACA is not just about TikTok. PAFACA can be applied to a host of similarly functioning foreign adversary apps and websites. As will be described below, PAFACA represents a new tool of the executive branch in countering hybrid commercial threats to U.S. national security.
PAFACA was passed by Congress following a series of classified briefings and hearings regarding matters of national security. It comprises one division of the April 24, 2024 appropriations bill known as Public Law 118-50. That bill contained both PAFACA (in its Division H) and the Protecting Americans’ Data from Foreign Adversaries Act of 2024 (in its Division I) (the “PADFAA”). PAFACA and PADFAA are complementary. The former limits the ability of foreign adversaries to collect American data directly through adversary-controlled applications and the latter prohibits third party data brokers from transferring “personally identifiable sensitive data of a United States individual” to a foreign adversary country or an entity “controlled by a foreign adversary.” PADFAA and Provisions Pertaining to Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons (the “Bulk Data Rules”) are the subject of our next WireScreen Blog installment.
Congress identified two specific policy justifications for combating hybrid commercial threats to U.S. national security with PAFACA: (1) counter foreign adversaries’ efforts to collect great quantities of data about tens of millions of Americans, and (2) limit their ability to manipulate content covertly on such platforms. While certain briefs from the U.S. intelligence community were redacted, a number of adversary-controlled app features were discussed publicly. These included storage of sensitive information about Americans (such as social security numbers) on servers located in foreign adversary countries, monitoring of the physical locations of specific U.S. citizens, and construction of dossiers of personal information for blackmail and corporate espionage purposes. Such discussions also reiterated the known harvesting features of various apps such as keystroke patterns, activity across devices, phone and social network contacts, browsing and search history, location data, image, audio, and biometric identifiers, and metadata.
App Stores and Internet Hosts Subject to Billions in Penalties
PAFACA works mechanically by making it illegal for any entity to:
The penalty for violating PAFACA is a civil fine not to exceed $5,000 multiplied by each user determined to have accessed the offending website or app. In the case of a foreign adversary-controlled app with a user base the size of TikTok’s, the fine could be up to $600,000,000,000 ($5,000 x 150 million users). Given the size of these amounts, the penalty is besides the point; rather, the effect of the rule is to completely ban the offending website or app.
The Centerpiece: Company Ownership Analysis
The centerpiece of the PAFACA legislation is its three-part foreign adversary control test and its four-part covered company test. The control test looks for a minimal connection between the website or app and the currently designated foreign adversary countries (China, Russia, DPRK, and Iran) while the covered company test looks for websites and apps that share a significant amount of user content. Both tests must be satisfied by a website or app to have PAFACA offending status bestowed upon it by way of Presidential determination.
Foreign Adversary Control Test
PAFACA determines foreign adversary control of a covered company or other entity based on a set of nested headquarters, aggregate percentage, and direction and control tests.
Headquarters Test
Under the headquarters test, any foreign person that is domiciled in, is headquartered in, or has a principal place of business in, or is organized under the laws of a foreign adversary country is subject to PAFACA. The headquarters test is adopted by various sanctions regimes and can cover group entities established in third party jurisdictions to evade the intent of PAFACA. As shown by the WireScreen screenshot below, multiple Cayman Islands and Hong Kong registered companies are revealed to be actually headquartered in China.
Aggregate Percentage Test
Under the aggregate percentage test, any entity, even if a U.S. entity, having a foreign person or combination thereof meeting the Headquarters Test that directly or indirectly owns at least 20 percent is subject to PAFACA. The Aggregate Percentage Test easily applies to various types of investment fund arrangements where the foreign adversary has a significant stake. As shown by the WireScreen screenshot below, a foreign adversary country headquartered investment fund is revealed to maintain 20 percent stakes in numerous portfolio companies.
Direction and Control Test
Under the direction and control test, any person, even a U.S. person, subject to the direction or control of a foreign person or entity meeting the Headquarters Test or the Aggregate Percentage Test is subject to PAFACA. The Direction and Control Test applies to a variety of commonly used investment holding structures (overt and covert) such as the variable interest entity, noninee arrangements, trusts, and other agency type holdings. As shown by the WireScreen screenshot below, a foreign adversary country headquartered entity controls by such means two other entities established in Singapore and the United States.
Covered Company Test
PAFACA defines a covered company to be an entity that operates, directly or indirectly (including through a parent company, subsidiary, or affiliate), a website, desktop application, mobile application, or augmented or immersive technology application that:
According to Statista, several hundred apps meet these criteria and this number increases steadily1. In particular, most games contain features which satisfy the viewable content components of this definition. In addition, according to US government sources, dating apps, and similar apps, constitute a top priority for further investigation under PAFACA.
A Covered Company carve-out exception exists for those apps whose primary purpose is to allow users to post product reviews, business reviews, or travel information and reviews.
Presidential Determinations
All websites, desktop applications, mobile applications, or augmented or immersive technology applications that are operated, directly or indirectly (including through a parent company, subsidiary, or affiliate), by a Covered Company meeting the Foreign Adversary Control test for the China, Russian, DPRK, or Iran will violate PAFACA if the President determines they constitute a significant threat to the national security of the United States. In addition, Congress codified in advance that all apps operated directly or indirectly by ByteDance, Ltd., TikTok, Inc. its subsidiaries, successors, or other instrumentalities are automatically determined as such through the passage of PAFACA. Both categories become unlawful 270 days after the determination or enactment of PAFACA, as applicable. This is January 19, 2025 for TikTok.
More Company Ownership Analysis: The Qualified Divestiture Exemption
PAFACA provides for an exception to its application if a “qualified divestiture” is executed before the date on which it applies to a given app or website. In addition, PAFACA will cease to apply to those apps and websites already subject to PAFACA as soon as a qualified divestiture occurs.
The key to a qualified divestiture is a transaction where the app or website is no longer controlled by a foreign adversary and it does not allow for any operational relationship between the United States operations between the app or website and any formerly affiliated entities that are controlled by a foreign adversary. This includes any cooperation with respect to the operation of a content recommendation algorithm or an agreement with respect to data sharing.
WireScreen’s Organization Screener allows for rapid analysis of the new ownership structures (and residual ties, if any) of divested entities.
Data Portability Penalties
In recognizing that apps and websites may be classified as running afoul of PAFACA following a long period of successful operation, there are provisions that require operators to migrate data back to users. The penalty for failure to do so upon user request is $500 multiplied by each user. Once again, in the case of popular apps, this penalty can become astronomical.
Severability Provisions
Apart from granting the D.C. Circuit exclusive jurisdiction over PAFACA challenges, a severability clause was also added to protect PAFACA from various legal challenges. The severability clause not only applies to all provisions or applications of the law but also applies in the event it is held invalid in connection with specifying TikTok’s Inc. by name.
1See https://www.statista.com/statistics/1484738/one-million-monthly-downloads-apps-by-store/
Navigate China’s business landscape, identify risk, and spot opportunity.
