[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[H.R. 7521 Referred in Senate (RFS)]
<DOC>
118th CONGRESS
2d Session
H. R. 7521
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
March 14, 2024
Received; read twice and referred to the Committee on Commerce,
Science, and Transportation
_______________________________________________________________________
AN ACT
To protect the national security of the United States from the threat
posed by foreign adversary controlled applications, such as TikTok and
any successor application or service and any other application or
service developed or provided by ByteDance Ltd. or an entity under the
control of ByteDance Ltd.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Protecting Americans from Foreign
Adversary Controlled Applications Act''.
SEC. 2. PROHIBITION OF FOREIGN ADVERSARY CONTROLLED APPLICATIONS.
(a) In General.--
(1) Prohibition of foreign adversary controlled
applications.--It shall be unlawful for an entity to
distribute, maintain, or update (or enable the distribution,
maintenance, or updating of) a foreign adversary controlled
application by carrying out, within the land or maritime
borders of the United States, any of the following:
(A) Providing services to distribute, maintain, or
update such foreign adversary controlled application
(including any source code of such application) by
means of a marketplace (including an online mobile
application store) through which users within the land
or maritime borders of the United States may access,
maintain, or update such application.
(B) Providing internet hosting services to enable
the distribution, maintenance, or updating of such
foreign adversary controlled application for users
within the land or maritime borders of the United
States.
(2) Applicability.--Subsection (a) shall apply--
(A) in the case of an application that satisfies
the definition of a foreign adversary controlled
application pursuant to subsection (g)(3)(A), beginning
on the date that is 180 days after the date of the
enactment of this Act; and
(B) in the case of an application that satisfies
the definition of a foreign adversary controlled
application pursuant to subsection (g)(3)(B), beginning
on the date that is 180 days after the date of the
relevant determination of the President under such
subsection.
(b) Data and Information Portability to Alternative Applications.--
Before the date on which a prohibition under subsection (a) applies to
a foreign adversary controlled application, the entity that owns or
controls such application shall provide, upon request by a user of such
application within the land or maritime borders of United States, to
such user all the available data related to the account of such user
with respect to such application. Such data shall be provided in a
machine readable format and shall include any data maintained by such
application with respect to the account of such user, including content
(including posts, photos, and videos) and all other account
information.
(c) Exemptions.--
(1) Exemptions for qualified divestitures.--Subsection
(a)--
(A) does not apply to a foreign adversary
controlled application with respect to which a
qualified divestiture is executed before the date on
which a prohibition under subsection (a) would begin to
apply to such application; and
(B) shall cease to apply in the case of a foreign
adversary controlled application with respect to which
a qualified divestiture is executed after the date on
which a prohibition under subsection (a) applies to
such application.
(2) Exemptions for certain necessary services.--Subsections
(a) and (b) do not apply to services provided with respect to a
foreign adversary controlled application that are necessary for
an entity to attain compliance with such subsections.
(d) Enforcement.--
(1) Civil penalties.--
(A) Foreign adversary controlled application
violations.--An entity that violates subsection (a)
shall be subject to pay a civil penalty in an amount
not to exceed the amount that results from multiplying
$5,000 by the number of users within the land or
maritime borders of the United States determined to
have accessed, maintained, or updated a foreign
adversary controlled application as a result of such
violation.
(B) Data and information violations.--An entity
that violates subsection (b) shall be subject to pay a
civil penalty in an amount not to exceed the amount
that results from multiplying $500 by the number of
users within the land or maritime borders of the United
States affected by such violation.
(2) Actions by attorney general.--The Attorney General--
(A) shall conduct investigations related to
potential violations of subsection (a) or (b), and, if
such an investigation results in a determination that a
violation has occurred, the Attorney General shall
pursue enforcement under paragraph (1); and
(B) may bring an action in an appropriate district
court of the United States for appropriate relief,
including civil penalties under paragraph (1) or
declaratory and injunctive relief.
(e) Severability.--
(1) In general.--If any provision of this section or the
application of this section to any person or circumstance is
held invalid, the invalidity shall not affect the other
provisions or applications of this section that can be given
effect without the invalid provision or application.
(2) Subsequent determinations.--If the application of any
provision of this section is held invalid with respect to a
foreign adversary controlled application that satisfies the
definition of such term pursuant to subsection (g)(3)(A), such
invalidity shall not affect or preclude the application of the
same provision of this section to such foreign adversary
controlled application by means of a subsequent determination
pursuant to subsection (g)(3)(B).
(f) Rule of Construction.--Nothing in this Act may be construed--
(1) to authorize the Attorney General to pursue
enforcement, under this section, other than enforcement of
subsection (a) or (b);
(2) to authorize the Attorney General to pursue
enforcement, under this section, against an individual user of
a foreign adversary controlled application; or
(3) except as expressly provided herein, to alter or affect
any other authority provided by or established under another
provision of Federal law.
(g) Definitions.--In this section:
(1) Controlled by a foreign adversary.--The term
``controlled by a foreign adversary'' means, with respect to a
covered company or other entity, that such company or other
entity is--
(A) a foreign person that is domiciled in, is
headquartered in, has its principal place of business
in, or is organized under the laws of a foreign
adversary country;
(B) an entity with respect to which a foreign
person or combination of foreign persons described in
subparagraph (A) directly or indirectly own at least a
20 percent stake; or
(C) a person subject to the direction or control of
a foreign person or entity described in subparagraph
(A) or (B).
(2) Covered company.--
(A) In general.--The term ``covered company'' means
an entity that operates, directly or indirectly
(including through a parent company, subsidiary, or
affiliate), a website, desktop application, mobile
application, or augmented or immersive technology
application that--
(i) permits a user to create an account or
profile to generate, share, and view text,
images, videos, real-time communications, or
similar content;
(ii) has more than 1,000,000 monthly active
users with respect to at least 2 of the 3
months preceding the date on which a relevant
determination of the President is made pursuant
to paragraph (3)(B);
(iii) enables 1 or more users to generate
or distribute content that can be viewed by
other users of the website, desktop
application, mobile application, or augmented
or immersive technology application; and
(iv) enables 1 or more users to view
content generated by other users of the
website, desktop application, mobile
application, or augmented or immersive
technology application.
(B) Exclusion.--The term ``covered company'' does
not include an entity that operates a website, desktop
application, mobile application, or augmented or
immersive technology application whose primary purpose
is to allow users to post product reviews, business
reviews, or travel information and reviews.
(3) Foreign adversary controlled application.--The term
``foreign adversary controlled application'' means a website,
desktop application, mobile application, or augmented or
immersive technology application that is operated, directly or
indirectly (including through a parent company, subsidiary, or
affiliate), by--
(A) any of--
(i) ByteDance, Ltd.;
(ii) TikTok;
(iii) a subsidiary of or a successor to an
entity identified in clause (i) or (ii) that is
controlled by a foreign adversary; or
(iv) an entity owned or controlled,
directly or indirectly, by an entity identified
in clause (i), (ii), or (iii); or
(B) a covered company that--
(i) is controlled by a foreign adversary;
and
(ii) that is determined by the President to
present a significant threat to the national
security of the United States following the
issuance of--
(I) a public notice proposing such
determination; and
(II) a public report to Congress,
submitted not less than 30 days before
such determination, describing the
specific national security concern
involved and containing a classified
annex and a description of what assets
would need to be divested to execute a
qualified divestiture.
(4) Foreign adversary country.--The term ``foreign
adversary country'' means a country specified in section
4872(d)(2) of title 10, United States Code.
(5) Internet hosting service.--The term ``internet hosting
service'' means a service through which storage and computing
resources are provided to an individual or organization for the
accommodation and maintenance of 1 or more websites or online
services, and which may include file hosting, domain name
server hosting, cloud hosting, and virtual private server
hosting.
(6) Qualified divestiture.--The term ``qualified
divestiture'' means a divestiture or similar transaction that--
(A) the President determines, through an
interagency process, would result in the relevant
foreign adversary controlled application no longer
being controlled by a foreign adversary; and
(B) the President determines, through an
interagency process, precludes the establishment or
maintenance of any operational relationship between the
United States operations of the relevant foreign
adversary controlled application and any formerly
affiliated entities that are controlled by a foreign
adversary, including any cooperation with respect to
the operation of a content recommendation algorithm or
an agreement with respect to data sharing.
(7) Source code.--The term ``source code'' means the
combination of text and other characters comprising the
content, both viewable and nonviewable, of a software
application, including any publishing language, programming
language, protocol, or functional content, as well as any
successor languages or protocols.
(8) United states.--The term ``United States'' includes the
territories of the United States.
SEC. 3. JUDICIAL REVIEW.
(a) Right of Action.--A petition for review challenging this Act or
any action, finding, or determination under this Act may be filed only
in the United States Court of Appeals for the District of Columbia
Circuit.
(b) Exclusive Jurisdiction.--The United States Court of Appeals for
the District of Columbia Circuit shall have exclusive jurisdiction over
any challenge to this Act or any action, finding, or determination
under this Act.
(c) Statute of Limitations.--A challenge may only be brought--
(1) in the case of a challenge to this Act, not later than
165 days after the date of the enactment of this Act; and
(2) in the case of a challenge to any action, finding, or
determination under this Act, not later than 90 days after the
date of such action, finding, or determination.
Passed the House of Representatives March 13, 2024.
Attest:
KEVIN F. MCCUMBER,
Clerk.