Where does Montana’s TikTok Ban Stand?

American Data Privacy at a Crossroads

Montana governor Greg Gianforte recently made a controversial move by signing a bill that bans the Chinese-owned TikTok in the state, the first such ban to occur in the United States.

Despite the immediate backlash, Gianforte took to Twitter to defend his decision as a way to protect Montanans’ personal data from possible breaches of privacy by the Chinese Communist Party (CCP). “TikTok is just one app tied to foreign adversaries,” he says. “Today, I directed the state’s Chief Information Officer to ban any application that provides personal information or data to foreign adversaries from the state network.”

Federal Communications Commissioner Brendan Carr also supports the move, as evidenced by the statement he released on Twitter: “The CCP has a track record longer than a CVS receipt of conducting business & industrial espionage as well as other actions contrary to U.S. national security, which is what makes it so troubling that [ByteDance] personnel in Beijing are accessing this sensitive and personnel data.”

While TikTok is not yet banned nationwide in the U.S., government officials have long argued that the app poses a national security risk because of the potential for its parent company, ByteDance, to share the data of American users with the Chinese government. Just last week, reports surfaced that seemed to indicate that has, in fact, happened, intensifying cries for action against the social media app.

Rooting from the vigilance to safeguard American users from data intrusion and privacy harms, this swing highlights how data privacy has become a key focus for many American regulators. Meta and other Big Tech companies have repeatedly tripped sensors for governmental concern, but TikTok, as a foreign-owned entity, has taken it to the next level.

Following the TikTok ban, other major apps–particularly Chinese ones–may be next in line for scrutiny. Former President Donald Trump signed an executive order that prohibited transactions in the WeChat app, and AliExpress was added to the Office of the United States Trade Representative’s list of Notorious Marketplaces for Counterfeiting and Piracy.

Now, the question becomes whether these actions are being taken in the name of true data privacy or whether they are largely political in nature.

The Onus of Data Protection Abroad

Data privacy remains a pressing issue for businesses and governments alike. That’s why six states have passed comprehensive data protection regulations so far in 2023, with more states already contemplating and debating similar bills.

Regulators and individuals on both sides of the political aisle have combined to try and control Big Tech, arguably the worst perpetrator of data privacy violations in the past decade, but those companies are American. TikTok, as a Chinese company, has set the same concerns the American government has over Big Tech into overdrive, only made more desperate by the app’s immense popularity.

Although China does have a comprehensive data privacy law, whereas the United States does now, China’s law, PIPL, applies to Chinese citizens and business operations within China. With the American data privacy landscape currently composed of a loose patchwork of state laws, compelling a foreign company to go beyond compliance is a difficult task.

Having American citizens’ personal and sensitive data transferred abroad or accessed by a foreign government is–rightly or wrongly–viewed as a national security threat. The U.S. isn’t alone in this view either, as the EU has taken issue with data transfer mechanisms from Europe to the U.S., striking down several frameworks over the years.

In the EU-US relationship, the countries are friendly with each other, and still, Europe wants to have guarantees on how their citizens’ data is handled. For the more complicated American-Chinese relationship, The U.S. will not waver in the lines they draw in the sand over American data.

Regardless of which border it crosses, protecting citizens’ data from outside nations is a focus for many governments now that data has become so invaluable. The EU has tried to accomplish that by granting its data protection law, the GDPR, and extraterritorial reach but has still struggled to actually alter corporate behavior. Without a strong federal law, the U.S. is in a tough spot to do the same, which is why states like Montana have resorted to drastic, somewhat knee-jerk measures like banning TikTok.

Long-Term Solution or Band-Aid?

The ban has already caused public outrage, mainly for two reasons:

a) it’s arguably unconstitutional as a violation of Montanans’ First Amendment rights, and

b) it’s a short-term solution for a much bigger problem.

Until definitive proof that the Chinese government is or can, in fact, access Americans’ data from TikTok, the app will remain a boogeyman of sorts. TikTok has already sued the state over the bill, kicking off a legal battle that may be resolved sooner rather than later, given the straightforward nature of the case and Montana’s stance as the lone state to ban the app.

Silicon Valley’s Big Tech conglomerates have had plenty of similar concerns and proven cases of massive amounts of mishandled data, yet have not even drawn suggestions of an absolute reaction such as a ban. That disproportionate response does make TikTok “good” or absolve its own data protection compliance, but it demonstrates an industry-wide data problem within social media.

At the end of the day, a single-state ban will not move the needle when it comes to national security and privacy. The core challenges of data security will endure even if TikTok is banned.

In all likelihood, Montana’s ban won’t stand up through the courts, which will lead to an even more confounding situation regarding TikTok’s very existence within the country.

If American regulators genuinely want to prioritize American users’ personal data protection, they should tackle the issue holistically and systematically across various social media platforms, which would simultaneously handle any TikTok-centric concerns.