Montana is banning TikTok. But can the state enforce the law and fend off lawsuits?

NEW YORK (AP) — TikTok is challenging Montana’s first-of-its kind law that makes it illegal for people to use the social media app in the state, marking the second lawsuit since the ban was adopted.

Montana Republican Gov. Greg Gianforte signed the law Wednesday expecting a legal fight would follow. The law scheduled to take effect Jan. 1, 2024 also faces questions over whether it can be enforced.

Five TikTok users sued the state last week saying the law was unconstitutional. TikTok made similar arguments in its lawsuit Monday in federal court in Missoula.

Montana’s rules are more far-reaching than restrictions on TikTok in place elsewhere, which include bans on government-issued devices in nearly half the states and within the U.S. federal government.

There are 200,000 TikTok users in Montana and 6,000 businesses that use the video-sharing platform, according to company spokesperson Jamal Brown.

Here’s what you need to know:

WHY IS MONTANA BANNING TIKTOK?

Proponents of the law in Montana claim the Chinese government could harvest U.S. user data from TikTok and use the platform to push pro-Beijing misinformation or messages to the public.

That mirrors arguments made by a bipartisan group of lawmakers in the U.S. Senate, as well as the heads of the FBI and the CIA, all of whom have said TikTok could pose a national security threat because its Beijing-based parent company ByteDance operates under Chinese law.

Critics have pointed to China’s 2017 national intelligence law that compels companies to cooperate with the country’s governments for state intelligence work. Another Chinese law, implemented in 2014, has similar mandates.

TikTok says it has never been asked to hand over its data, and it wouldn’t do so if asked.

WHAT DOES TIKTO ARGUE IN THE LEGAL CHALLENGE?

The lawsuit filed Monday by TikTok, which is owned by Chinese tech company ByteDance, says the new law violates the Constitution’s right to free speech. It says the law is based on unfounded speculation that the Chinese government could access users’ data.

“The state cites nothing to support these allegations,” the company’s attorneys wrote. “The state’s bare speculation ignores the reality that (TikTok) has not shared, and would not share, U.S. user date with the Chinese government.”

Emily Flower, spokesperson for the Montana Department of Justice, said the legal challenges were expected. She said the Chinese Communist Party was using TikTok as a tool to spy on Americans by “collecting personal information, keystrokes, and even the locations of its users.”

The case could serve as a testing ground for the TikTok-free America many national lawmakers have envisioned.

HOW DOES MONTANA PLAN TO BAN TIKTOK?

The law will prohibit downloads of TikTok in the state and fine any “entity” — an app store or TikTok — $10,000 per day for each time someone accesses TikTok, “is offered the ability” to access it, or downloads it.

That means Apple and Google, which operate app stores on Apple and Android devices, would be liable for any violations. Penalties would not apply to users.

The statewide ban won’t take effect until January 2024. It would be void if the social media platform is sold to a company that is not based in “any country designated as a foreign adversary” by the federal government.

The governor indicated he wants to expand the bill to other social media apps in order to address some of the bill’s “technical and legal concerns.” But the legislature adjourned before sending him the bill, which meant he couldn’t offer his amendments.

Montana Attorney General Austin Knudsen has pointed to technology used to restrict online sports gambling apps as a way to curtail TikTok from operating in the state. Those violations can be reported by anyone. And once the state verifies a breach has taken place, it sends a cease-and-desist letter to the company involved, said Kyler Nerison, a spokesperson for Knudsen’s office. He said different companies use different methods for compliance and it’s up to them “to not allow their apps to work in Montana and other states where they are not legal.”

SO, COULD THE TIKTOK BAN WORK?

Cybersecurity experts say that, other than avoiding the fine, there’s nothing incentivizing the companies involved to comply and it will be extremely difficult — if not impossible — to adequately enforce the law.

For one, the U.S. doesn’t have anything equivalent to the type of control countries like China have on what their citizens access on the web. Compounding that, internet service providers are out of the picture.

Before the Montana law passed, lawmakers rewrote portions of the bill to let them off the hook after a lobbyist for AT&T said during a February hearing the legislation was “not workable” to put into effect.

COULD TECH COMPANIES BLOCK IT?

Apple and Google have not spoken out against the law. But a representative for TechNet, the trade group that counts the two tech giants as its members, has said app stores don’t have the ability to “geofence” apps in different states and it would be impossible to prevent TikTok from being downloaded in Montana. The group has also said the responsibility should be on an app to determine where it can operate, not an app store.

Telecoms analyst Roger Entner, of Recon Analytics, says he believes the app stores could have the capability to enforce the law, but it would be cumbersome to implement and full of loopholes. Apple and Google’s address-linked billing could be bypassed with prepaid cards and IP geolocation easily masked by using a VPN service, which can alter IP addresses and allows users to evade content restrictions, said mobile security expert Will Strafach, the founder of Guardian, which makes a privacy protection app for Apple devices.

Oded Vanunu, head of products vulnerability research at the cybersecurity firm Check Point, agreed it would be difficult for app stores to isolate a single state from downloading an app. He suggested it would be more feasible for TikTok to comply since it controls the software and can “adjust the settings based on the geographical location or IP addresses” of users.

COULD TIKTOK BLOCK ITSELF?

When users allow TikTok to collect their location information, it can track a person to at least 3 square kilometers (1.16 square miles) from their actual location. If that feature is disabled, TikTok can still collect approximate location information – such as the region, city or zip code in which a user may be located – based on device or network information, like an IP address.

But similar to the app stores, cybersecurity experts note that any enforcement measures the company implements could be easily bypassed with a VPN and efforts to use IP geolocating might lead to other issues.

David Choffnes, the executive director of the Cybersecurity and Privacy Institute at Northeastern University, said cell providers may use the same types of IP addresses for multiple states, which could mean someone who is not in Montana could incorrectly be blocked from using TikTok.

___

AP Technology Writer Frank Bajak contributed to this report from Boston.