Having read through the bill, here's how it works:
TikTok/ByteDance is mentioned specifically in the bill, so they have 270 days (iirc) to divest of "adversary country" influence (meaning China, Iran, Russia, N. Korea), meaning they'd have to be sold to a company based in a non-adversary country
assuming they don't comply with 1, any app store or ISP *hosting provider* would be fined if they continue to preserve access to the app
users can still use the app, but they have have network access blocked while in the US - so you'd have to use a VPN to use the app
So to circumvent it, basically use a VPN to use the app, and for updates, you'd probably need to side-load on Android or something similar. I don't know how Apple's store works well enough to know what options users have to install and update the app after the ban.
That said, there is no provision for making it illegal to use the app, the onus is entirely on companies facilitating access to the app.
Edit: I was wrong about the ISP. After a reread, it's talking about server hosting. So a server cannot be hosted in the US, nor can a server in the US distribute copies of the app, or host source code for the app.
Covered nation .— The term “covered nation” means— (A) the Democratic People’s Republic of North Korea; (B) the People’s Republic of China; (C) the Russian Federation; and (D) the Islamic Republic of Iran.
I think those phrases are important when discussing any potential "slippery slope" aspects of this bill. It's about companies/applications from specific adversary nations. It's not about just any service that annoys a US politician. The bar here is much higher, and the scope is narrow. While it does identify ByteDance and TikTok by name, it will also apply to other companies from those nations, if they are determined to present a threat to US national security.
I haven't read the entire bill, so please don't take this as advice, but in principle, I think it seems like a sensible measure. A major communication platform like TikTok makes a very effective propaganda and misinformation tool. Exactly the sort of thing that an adversary nation would use to sway political discourse, influence elections, even undermine a democracy.
Of course, any law can be abused, so paying attention to how this one is applied and enforced will be important, just as with any other.
While true, it also includes any US (or other county) company that is owned at least 20% by someone in one of those adversary countries.
The President can't just name any country an "adversary country," but it's not just companies in those countries either. So something like Epic Games could qualify since TenCent (owned by a Chinese national) owns >20% stake.
However, the law also restricts how a company or product is subject to the rule. Basically, unless they are TikTok or ByteDance (or directly affiliated with either in a legal sense), the President must:
Publicly notify Congress of the intent to classify them as an adversary company (assuming they meet the rest of the rules) at least 30 days prior to any further action
Notify the public of the change
Then the company has 90 days to appeal before the statute of limitations is up, and 270 days to comply (i.e. divest from the adversary country).
So the bill is pretty decent in preventing abuse, so I'm more worried about the precedent it's setting. We generally don't ban things here in the US, so this is a pretty big step IMO.
Does is specify ISP blocking directly in the bill?? It was my understanding that it would just prevent US based app stores (Apple, Google) from distributing the app in their stores.
I'm not even sure how ISP blocking would work, unless it was to just blackhole DNS queries to tiktok.com. Having attempted to block DNS lookups for TikTok on my own home router via PiHole, I can say that the app either hard codes IP addresses, or resolves DNS over HTTPS independently of the system DNS settings, so I doubt a DNS based ISP block would be feasible.
Here's the bill (Division H is the relevant part).
I misread "internet hosting service" in the initial section as "Internet service," so I'm guessing it doesn't obligate ISPs to block TikTok or any other service.
It does block server hosts from allowing distribution of blocked apps though. So no local mirrors of the app.
(5) INTERNET HOSTING SERVICE.—The term “internet hosting service” means a service through which storage and computing resources are provided to an individual or organization for the accommodation and maintenance of 1 or more websites or online services, and which may include file hosting, domain name server hosting, cloud hosting, and virtual private server hosting.
So this would prevent a US organization like AWS, Oracle, etc from hosting the TikTok user data as long as TikTok is owned or a subsidiary of ByteDance or another "foreign adversary".
Elsewhere in the text, they exclude "service providers" from restrictions, so it seems like ISPs are not going to block requests to TikTok.
I honestly kinda skimmed that part initially because I was more interested in how it could impact other apps. I don't particularly care about TikTok, I just wanted to know what other apps could be targeted and what the process for that looks like.