Why a bill that could ban TikTok is raising privacy concerns

A bipartisan bill that aims to give the administration the power to ban apps linked to foreign adversaries, including TikTok, is raising privacy concerns across the political spectrum.

The RESTRICT Act, led by Sen. Mark Warner (D-Va.), is touted by supporters as a way for the administration to review and potentially ban services without solely targeting the controversial video app, the way other GOP-backed bills do.

Although the broader scope may evade issues of targeting one company, digital rights groups, industry officials and privacy experts are sounding the alarm that the RESTRICT Act poses concerns that could limit Americans’ freedom online. Critics argue the proposal is overly broad about what companies it would target and who would be on the receiving end of enforcement.

“There’s a risk of unintended targets. There could be consequences for businesses or individuals that inadvertently get swept up in this,” said Darrell West, a senior fellow with the Center for Technology Innovation at the Brookings Institution.

How the RESTRICT Act works

The bill doesn’t explicitly set out to ban TikTok or any app, but gives the Commerce Department power to identify and mitigate risks from technology linked to foreign adversaries including China, North Korea, Iran, Russia, Cuba and Venezuela — including by banning the technology.

TikTok is owned Chinese-based company ByteDance, which some lawmakers say poses national security risks involving the storage and sharing of U.S. user data. TikTok has pushed back on the allegations that the app poses any national security risks.

A chief concern raised by critics of the bill is that individuals who seek to use TikTok or any service banned under the rules it lays out would be punished.

The digital rights groups Electronic Frontier Foundation and Fight for the Future, along with the ACLU, have all come out against the proposal. The groups are among critics that argue the bill could potentially punish individuals that seek to gain access to banned apps, possibly through VPNs, or virtual private networks.

Would the bill ban VPNs?

A VPN lets users search online without having an internet service provider or other third parties see what sites they visit or their data. By using a VPN, a user can also access sites that are banned, and is among the technical limitations of enforcing a TikTok ban. It is one way users in other countries that have banned access social media sites have been able to keep using those platforms.

The legislation does not explicitly ban the use of a VPN, but the broad scope of the bill could lead to it being interpreted that way, said Kayla Williams, chief information security officer at Devo, a cloud-native security analytics platform.

The debate centers on a portion of the bill states that “no person may engage in any transaction or take any other action with intent to evade the provisions of this Act.”

“There’s not any clarification of what the implications could be to an individual versus a corporation,” Williams said.

“It’s very concerning to me as a citizen, that I have VPN on my phone, to protect myself. Does that mean that I could potentially face jail for having that technology? It’s too broad, in my opinion,” she added.

Warner says the RESTRICT Act doesn’t target individuals

Warner has pushed back strongly on the criticism that individuals could be targeted.

When asked for comment, Warner spokesperson Rachel Cohen directed The Hill to a Twitter thread the senator posted last week that he said aimed to “dispel some myths” about his bill.

“The RESTRICT Act is focused on foreign corporations, not on users. The 1st Amendment protects Americans’ right to share and receive information – and this bill doesn’t alter that,” Warner tweeted.

“Let me say it again: there are NO criminal penalties in this bill for your free speech – you’re even free to drag the RESTRICT Act if you want! I stand firmly with freedom of speech, and my bill doesn’t affect or influence what Americans can say in any way, shape or form,” he added.

Despite Warner’s comments, though, the text of the bill leaves it open to be interpreted in a way that puts individuals at risk, said Lauren Hendry Parsons, privacy advocate and global head of communications of software company ExpressVPN.

“While the intent as spoken by Sen. Warner is clear, and the senator has assured us in the short term that individuals will not be prosecuted, the primary concern that we have is that this is a slippery slope with serious long term implications on privacy rights,” Parsons added.

Brandon Pugh, policy director and resident senior fellow for cybersecurity and emerging threats at R Street Institute, said in an email that the “ambiguity” of the text “combined with the large discretion provided to the secretary of commerce, creates concerns that this law could be used for reasons that extend beyond simply curbing applications like TikTok.”

Other experts say those concerns are overblown.

Roger Cressey, former National Security Council member in the administrations of former President Clinton and George W. Bush , said the criticism that the bill could lead to punishment for individuals who try to evade a ban is a “little hysteria.”

“The criticism always is rooted in the worst case scenarios. And that is the greatest consequence and least probability of happening. It’s about foreign ownership of apps, about ownership of apps from countries that we’re worried about,” Cressey said.

“But if people are worried that you know circumventing what might be the Commerce Department’s policy approach in terms of implementation is going to lead to this type of overreach, I just think it’s excessive and not grounded in what I would call reality,” he added.

What about a data privacy bill?

Critics of the legislation and progressive lawmakers pushing against a TikTok ban have argued that Congress should instead be focused on a comprehensive data privacy bill.

The U.S. lags behind other nations without putting a comprehensive data privacy law on the books, despite bipartisan momentum and support for one proposal last year.

“The best solution would be a national privacy bill, because it would address the confidentiality of people’s records, and create consequences for companies that violate that,” West said.

He said it is “clear” from hearings in Congress that the problem is “not just TikTok, but the whole social media ecosystem,” he said.

Cressey, though, said it isn’t an “either-or choice.”

“The idea that, ‘well, we need a comprehensive data privacy law and therefore, the RESTRICT Act is bad,’ is ludicrous. We need a comprehensive data privacy law, and we need something in place that deals with this issue of foreign owned apps in countries of concern,” he said.

Pugh, however, said that acting on a measure directed at TikTok or the broader RESTRICT Act without a comprehensive data privacy and security bill “would not solve the underlying problem.”

For the latest news, weather, sports, and streaming video, head to The Hill.