The U.S. Restrict Act explained

Privacy news
4 mins
TikTok logo with a slash.

The Restrict Act is proposed legislation that was first introduced in the U.S. Senate on March 7, 2023. Find out why you should care about the Act with our short explainer.

What is the Restrict Act?

The Restrict Act’s full name is the Restricting the Emergence of Security Threats that Risk Information and Communications Technology Act. It is currently proposed legislation under consideration by Congress. (Read the full text here.)

The stated purpose of the Act is to limit national security risks by allowing the Department of Commerce to review, block, and mitigate transactions involving foreign information and communications technology (ICT) that pose undue risk. 

In other words, the Act would make it easier for the U.S. government to ban or force the sale of specific software or equipment from certain countries if it’s deemed to pose a spying risk.

What countries’ products would the Restrict Act affect?

The bill applies to technology connected to a “foreign adversary” of the U.S. Only six countries fall under this designation: China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, and Venezuela.

What types of technology are we talking about?

The Act would give the government power to scrutinize just about any technology—from internet hosting services to satellite payloads to mobile apps—as long as they are used by more than 1 million people in the U.S.

What does this have to do with TikTok? 

A lot—and the TikTok case explains why the bill has a strong support base.

Many agree that there are particular privacy risks to using foreign-owned apps like TikTok. The U.S. government’s fear is that the Chinese government could force TikTok to provide sensitive data it’s collected on American users or use TikTok’s content recommendation algorithm to spread misinformation or propaganda. The U.S. has tried to get TikTok to store its U.S. users’ data on domestic servers, and it’s tried to force TikTok’s parent company ByteDance to sell the platform—both to no avail. A ban is the last resort. And legally, it’s not straightforward to do so. A few years back, President Donald Trump wanted to ban the app but didn’t have the authority to remove it from the App Store or Google Play. The Restrict Act is meant to give the government clear power to ban any app that could threaten Americans’ security.

Supporters of the bill want the government to have this power.

Are people raising objections?

Yes. There are various concerns surrounding the bill:

  • The bill covers a broad range of technologies, while giving the government the power to intervene under broad circumstances, such as where they see “undue or unacceptable risk to the national security of the United States or the safety of United States persons.”
  • The Act could give the government too much power to ban apps and services that allow people to communicate, such as TikTok, thereby limiting freedom of expression. It could give the government too much leeway to control and censor information.
  • Some media articles have raised an alarm over whether using a VPN to access services banned in the U.S. could be interpreted as illegal based on the Act. This is based on sections describing services “designed or intended to evade or circumvent the application of this Act” as being covered under the Act. (More on that next.)

So … does the Restrict Act make it punishable to use a VPN?

First off, it’s important to note that the Restrict Act has yet to pass into law. But the bill as written is vague, covering a lot of ground with broad language. The sections that could be alluding to VPNs describe services “designed or intended to evade or circumvent the application of this Act” as being in violation of the Act. It is unknown how this will be interpreted as far as consumer VPNs go. 

Media articles have reported that a spokesperson for Mark Warner, one of the leaders behind the bill, explicitly said that “the punishments in the bill would not be used against ordinary citizens.”

This is the media statement from Warner:

Under the terms of the bill, someone must be engaged in ‘sabotage or subversion’ of American communications technology products and services, creating ‘catastrophic effects’ on U.S. critical infrastructure, or ‘interfering in, or altering the result’ of a federal election, in order to be eligible for any kind of criminal penalty … To be extremely clear, this legislation is aimed squarely at companies like Kaspersky, Huawei, and TikTok that create systemic risks to the United States’ national security—not at individual users.

We will continue to keep a close eye on the bill’s development and assess its potential impact on VPN use, and encourage everyone to stay informed and take steps to protect their privacy online

Vanessa is an editor of the blog.