TikTok and China’s Digital Platforms: Issues for Congress, CRS, Dec. 13, 2024.
Congress and U.S. policymakers at the federal and state
levels have taken steps to address their national security-
related concerns about the extent to which the People’s
Republic of China’s (PRC or China) influences digital
platforms that are directly or indirectly tied to the PRC and
operating in the United States. Most U.S. actions to date
have focused on TikTok, owned by ByteDance, a company
with ties to the PRC government. Other expressed concerns
include PRC platforms’ large user bases, access to large
amounts of U.S. data, and company data and content
policies. In December 2024, TikTok said in its court filings
that it had 170 million U.S. users. TikTok’s CEO testified
to Congress in March 2023 that ByteDance retains in the
PRC at least seven years of U.S. TikTok users’ data.
Enacted in April 2024, P.L. 118-50 (Div. H and Div. I)
requires ByteDance to divest from TikTok, allows the
President to address other PRC-controlled digital platforms,
and directs the Federal Trade Commission to enforce
provisions that prohibit data brokers from transferring U.S.
personally identifiable sensitive data to foreign adversaries,
including the PRC.
PRC digital firms are able to serve both the U.S. and PRC
markets, while PRC investment and technology policies
restrict U.S. firms from operating in China. This asymmetry
raises issues for Congress about market access reciprocity,
fair competition, and U.S. regulation of PRC firms. PRC
digital platforms have expanded in the U.S. market over the
past 10 years. Many firms have entered regulated or
restricted parts of the U.S. economy—broadcasting, media,
health, and finance—via mobile applications (apps).
Digital platforms are internet-connected and software-
based digital spaces that facilitate the exchange of goods,
services, and information through online interactions. For
this report, PRC digital platforms or platforms that
have PRC ties refer to digital platforms that are
headquartered in China, subsidiaries, or firms otherwise tied
to a company headquartered in China, or whose relevant
technology and core business functions (e.g., algorithms,
software and technology development, and intellectual
property) are based in China, owned by a PRC parent or
subsidiary, and/or subject to PRC jurisdiction. In some cases,
PRC digital platforms might be incorporated or
headquartered outside China. The PRC digital platforms
discussed in this report are not exhaustive.
China’s Digital Platform Development
PRC policies prioritize the role digital platforms play in
China’s economic competitiveness, the development of
emerging technologies, and PRC global projects in sectors
such as communications, smart cities, financial, and
logistics services. China’s digital platforms emerged in the
late 1990s with the help of PRC government policies that
restricted U.S. and other foreign internet services firms
from operating in China while promoting alternative PRC
competitors. Alibaba began in 1999 as a competitor to
Amazon and formed Alipay in 2003 to compete with
PayPal. Baidu started as a Google competitor in mapping
and search engines. Sina Weibo began as a competitor to
Twitter. Tencent’s WeChat competed with WhatsApp. In
2016, ByteDance refined the algorithm from its news
aggregator business (Toutiao) to launch Douyin (a
predecessor-turned companion PRC application to TikTok),
a service that competed with Facebook and YouTube. The
PRC universe of digital firms has expanded as industry has
adopted digital services, and now includes other firms, such
as BGI (biotech) and DJI (drones).
As PRC digital firms became viable in China, some moved
into global markets. The PRC government allowed some
PRC firms to list and expand overseas. In 2014, Alibaba
raised $21.8 billion in its offering on the New York Stock
Exchange. U.S. investors in TikTok’s PRC parent
ByteDance include Sequoia Capital, Susquehanna Group,
and KKR. Some PRC firms focused on app offerings to
enter foreign markets. They used existing foreign operating
systems on mobile phones (e.g., Apple’s iOS and Google’s
Android) to avoid upfront technology infrastructure costs
and expand quickly. Once established, some PRC firms
developed their own infrastructure, such as cloud services,
data storage, and semiconductor design. PRC firm Huawei
has launched its own operating system (Harmony OS).
Some PRC firms inherited foreign user bases and licenses
through acquisitions. This approach gave some firms, such
as TikTok’s parent ByteDance, a significant initial U.S.
market position, and accelerated these firms’ expansion. In
2017, ByteDance acquired musical.ly, a short-form video
app firm. The deal gave ByteDance 80 million monthly
U.S. users—a base almost half of TikTok’s current user
base. ByteDance then used that U.S. user base in launching
TikTok. In another example, Tencent invested in Snap and
Epic Games (owner of the gaming platform Fortnite).
Some PRC digital platforms, such as TikTok, are
incorporated and/or headquartered in the U.S. and third
markets, and have core engineering and technology
functions in China and other PRC ties. Temu, founded in
Boston, is controlled by a PRC firm. Zoom Video
Communications, Inc., founded in California, incorporated
in Delaware, and headquartered in the United States, reports
in its FY2024 annual report that “a significant portion of
our research and development organization resides in
China” and that “we have a significant number of
employees, primarily engineers, in China, where personnel
costs are less expensive than in many other geographies.”
PRC Influence and Control
Since 2014, the PRC government and the Communist Party
of China (CPC) have adopted interrelated laws, economic
security measures, and data restrictions that enhance control
over data and commercial activity, within and outside of
China. They have expanded data localization requirements
and placed controls on the export of data and algorithms. In
2021, they introduced security review requirements for
PRC firms listing or operating overseas. These provisions
require firms to adhere to PRC rules when they conflict
with U.S. laws. PRC measures seem to be more extensive
than other countries’ approaches to data security. Such
measures have affected U.S. firms’ operations in China,
raising questions about the extent to which PRC firms
operating offshore are independent of the PRC government.
Examples of PRC authorities include
• China’s National Security Law (2015) requires
information systems in China to be “secure and
controllable.” The law underpins requirements that U.S.
firms store data and cryptographic keys in China.
• The PRC’s National Cybersecurity Law (2017) requires
firms to store personal information and data within
China. The law builds on related requirements to place
PRC data and related infrastructure in China.
• China’s Data Security Law (2021) covers data
processing inside and outside China if it “harms the
national security, public interest, or the legitimate rights
and interests of citizens or organizations of the PRC.” It
requires PRC government approval for the transfer of
data stored in China and calls for classifying data based
on its importance to economic and security interests.
• In August 2020, the PRC government placed export
controls on algorithms used in social media platforms.
Some experts saw this as an effort to influence TikTok
and other PRC digital firms’ offshore operations.
The CPC requires all firms to house a Party committee that
is empowered to attend board meetings and be part of
decisionmaking. The PRC government is also an indirect
shareholder in some firms. For example, it holds a board
seat in Douyin Information Services Co., Ltd (the owner of
TikTok’s core technology) via a 1% shareholding by a firm
backed by China’s internet regulator. Other PRC tools to
influence PRC digital platform firms include
PRC official content guidelines and censorship rules
restrict and promote content on PRC digital platforms.
China’s anti-espionage, cybersecurity, and data security
laws compel firms to support PRC state security authorities.
The core business (e.g., software and technology
development) and intellectual property is based in China,
owned by a PRC parent or subsidiary, and subject to PRC
jurisdiction. Offshore structures can obfuscate such ties.
Key U.S. Government Actions to Restrict
Certain PRC Digital Firms
May 2019: Executive Order (E.O.) 13873 declared a national
emergency to secure U.S. information and communications
technology and services supply chains. The E.O. has been
renewed annually since 2019.
January 2020-present: Some federal agencies and state
governments banned the TikTok app on government devices.
March 2020: A Presidential Order required Shiji Technology
to divest StayNTouch, a U.S. software provider under the
Committee on Foreign Investment in the United States
(CFIUS) authorities. It did not ban the firm from operating in
the U.S. market.
August 2020: A Presidential Order required ByteDance to
divest Musical.ly/TikTok under CFIUS authorities. TikTok
contested the Order in court. Since February 2021, the case
has been in abeyance at the request of the parties.
August 2020: E.O. 13942 and E.O. 13943 (later rescinded)
restricted the U.S. operations of TikTok and WeChat. Court
injunctions blocked their implementation.
January 2021: E.O. 13971 provided for scrutiny of apps and
software developed or controlled by PRC firms.
June 2021: E.O. 14034 replaced E.O. 13942 and E.O. 13943.
It created a Commerce Department program to address risks
of foreign adversary-owned internet-tied and software firms.
Issues Before Congress
The executive branch has restricted some PRC digital
firms’ operations (text box). P.L. 118-50 focuses on
national security issues and platform conduct and allows the
President to restrict foreign adversary-controlled apps. The
law designates TikTok as a “foreign adversary-controlled
application” and requires ByteDance to sell TikTok to a
non-PRC owner by January 19, 2025, or face a ban on app
stores and internet hosting services supporting the app. In
December 2024, the U.S. Court of Appeals for the District
of Columbia Circuit upheld the law in a legal challenge by
TikTok. TikTok then asked the court to bar enforcement of
the law while it appeals to the Supreme Court. P.L. 118-50
allows the President to authorize a “qualified divestiture” of
TikTok and impose terms. A 2020 Presidential Order
required ByteDance to divest Musical.ly may inform a
“qualified divestiture.” In referring the matter to the
President, CFIUS “unanimously recommended” such action
expressly “to protect U.S. users from exploitation of their
personal data.” TikTok tried to reopen a mitigation path that
CFIUS determined was not viable by legally challenging
the Order, mostly on due process issues, and re-publicizing
mitigation ideas. Some experts said TikTok could have
stored data in the United States under U.S. government
monitoring. Others said such an approach would not have
addressed TikTok’s ties to technology and functions in
China, such as regular software updates and continuous
data transmission. Congress might (1) exercise oversight
over any divestiture; (2) examine whether TikTok’s legal
challenges suggest any statutory or policy gaps; and (3)
consider whether to act with regard to other PRC platforms.
Karen M. Sutter, Specialist in Asian Trade and Finance
Michael D. Sutherland, Analyst in International Trade and
Finance