Once More With Feeling: Banning TikTok Doesn’t Do Much If We Don’t Regulate Data Brokers And Pass A Privacy Law

notion image

from the it's-the-corruption,-stupid dept

While it seemed like our national policy hysteria over TikTok had waned slightly in 2024, it bubbled up once again last week upon rumors that the White House is supporting a “welcome and importantnew bill that would effectively ban TikTok from operating in the United States.
The bipartisan bill (full text) — which moved forward last week in spite of TikTok’s ham-fisted attempt to overload Congress with phone calls from users — sponsored by Reps Mike Gallagher and Raja Krishnamoorthi, prevents all ByteDance-controlled applications from enjoying app store availability or web hosting services in the U.S., unless TikTok “severs ties to entities like ByteDance that are subject to the control of a foreign adversary.” Basically, the bill wants ByteDance to divest TikTok, preferably to an American company.
You’ll recall the Trump administration’s big “solution” for TikTok was basically cronyism: to force the company to sell itself to Walmart and Oracle. That is: companies controlled by Trump’s cronies, with their own track records of bad behavior and privacy violations. You’ll also recall that Facebook has been very busy sowing congressional angst for years about TikTok for purely anti-competitive reasons.
The bill applies to any company owned by ByteDance, whether or not anybody has actually proven any sort of meaningful connection to Chinese intelligence (we’re working off of vibes here, man). There’s also some murky language in the legislation that curiously excludes companies that deal in reviews, a nice treat for whatever company successfully lobbied for that exemption:
To be very clear: TikTok certainly isn’t without surveillance, national security, and notable privacy concerns. And the authoritarian Chinese government is, without question, an oppressive genocidal shitshow.
But banning TikTok, while refusing to pass a privacy law or regulate data brokers (which traffic in significantly greater volumes of sensitive data at much greater collective scale), winds up mostly being a performative endeavor driven more by anti-competitive intent (and a desire to control the flow and scope of modern news, information and propaganda) than any desire for serious reform.
A lot of the congressional opposition (especially on the GOP side) to TikTok comes largely from the belief that white owned and controlled American companies are owed, by divine right, access to the massive ad revenues Chinese-owned TikTok enjoys. For Luddites and policy nitwits like Tommy Tuberville, I strongly doubt the thinking extends much further than that.
I also think Republicans very much don’t like the idea of a company that could potentially traffic in propaganda that isn’t theirs. They’ve worked very hard for several years to scare feckless U.S. tech giants away from policing race-baiting political propaganda online (a cornerstone of modern GOP power), and their inability to control TikTok presents an obvious concern for entirely self-serving reasons.
But even lawmakers who sincerely believe that banning TikTok makes meaningful inroads on national security or consumer privacy generally don’t seem to understand the size and scope of the problem we’re dealing with.
You could ban TikTok with a patriotic flourish from the heavens immediately, but if we fail to regulate data brokers, pass a privacy law, or combat corruption, Chinese (or Russian, or Iranian) intelligence can simply turn around and buy that same data (and detailed profiles of American consumers) from an unlimited parade of different data brokers, telecoms, app makers, marketing companies, or services.
And they can do that because the U.S. has proven to be, time and time again, too corrupt to do the right thing or hold giant corporations (domestic or otherwise) accountable for privacy abuses. The result has been the creation of an historically massive, planet-wide, data monetization and surveillance machine that fails — over and over and over again — to meaningfully protect public safety and consumer privacy.
Congress has repeatedly made it very clear that making money is significantly more important than consumer welfare and public safety, as the scandal over sensitive abortion clinic location data makes clear. The U.S. government is also disincentivized to act, because it’s found exploitation of this privacy-optional nightmare to be a super handy way to avoid having to get warrants for domestic surveillance.
The Biden administration does appear to at least recognize the threat, as evident by their recent executive order trying to slow the flow of data broker data to problematic governments.
But it’s not enough. Congress needs to pass a privacy law for the internet-era with teeth that applies to all companies that operate in the U.S., foreign or domestic. It needs to adequately staff and fund the FTC so it can actually address the problem at the scale it’s operating at. And it needs to close the privacy loopholes that lets government surveillance efforts exploit the dysfunction.
But Congress won’t do that because Congress is comically, blisteringly corrupt. We’ve defanged our regulators for decades under the pretense it fostered an innovative, free market renaissance that never happened. When discussing our failure to meaningful protect U.S. consumer (and industry privacy), this corruption just isn’t mentioned–as if it’s simply somehow not relevant to the problem at hand.
Countries that care about national security make fleeting efforts to combat corruption, and don’t support NYC real estate conmen with fourth grade reading levels for the most powerful office in the land.
Countries that care about consumer privacy pass privacy laws, regulate data brokers, and generally hold corporations (and executives) meaningfully accountable for failing to secure consumer data. T-Mobile has been hacked eight times in five years due to comically lax security and privacy standards, and I’ve yet to see Congress lift so much as an eyebrow.
The myopic hyperventilation about TikTok (and TikTok only!) is mostly a distraction. A distraction from the GOP’s ongoing quest to turn the internet into a propaganda dumpster fire. A distraction from our failures on consumer protection. A distraction from Congressional corruption. A distraction from the fact that we’ve lobotomized our regulators in exchange for Utopian promises never actually delivered.
Banning an app that may not even be popular five years from now — but doing absolutely nothing about the corruptive rot that enabled its privacy abuses — is a hollow performance that simply doesn’t strike at the heart of the actual problem.
notion image

from the free-speech-is-weird-in-texas dept

Can the 5th Circuit ever do anything not crazy? You may recall that Texas, like so many states, passed a law, HB 1181, that required age verification for adult content sites. This law also required nonsense “health warnings” to be plastered on those sites, which did not come from any actual health experts. The Free Speech Coalition sued over the bill and won a quick injunction. The court deemed it to be obviously unconstitutional, siding with multiple other courts (including the Supreme Court) which have all found age verification requirements to access speech to be unconstitutional under the First Amendment.
Soon after that, though, the 5th Circuit removed the injunction blocking the law with no explanation at all (which seems to be how the 5th Circuit rolls…). This allowed Paxton to sue Pornhub’s parent company Aylo for allegedly violating the law.
Now, we finally have the full 5th Circuit ruling and it is incredibly problematic. It could have been worse because it could have allowed the mandated fake health warnings, but (thankfully) it kept those enjoined. However, it went against a ton of other courts in saying that age verification is, like, totally constitutional. The majority opinion claimed that they could use the much lower “rational basis” test to determine the constitutionality of age verification restrictions, rather than strict scrutiny.
The court leans heavily on the 1968 case Ginsberg v. New York. This case allowed for the restrictions on the sale of “obscene” material to children. The court insists that more recent cases don’t apply here, including Ashcroft v. ACLU and Brown v. Entertainment Merchants Association. In Ashcroft v. ACLU, the court rejected a bill to restrict access to content “harmful to minors.” In Brown v. Entertainment Merchants Association, the court rejected a bill limiting kids’ access to violent video games. The court insists that these cases don’t apply here, since the material is “obscene.”
The Ashcroft case seems almost directly on point. COPA included age verification regarding harmful content to minors and the Supreme Court rejected it. Yet the 5th Circuit now says that the reason was because the Supreme Court only applied “strict scrutiny” in the Ashcroft case, because it was only asked about strict scrutiny, and not which test should apply. If only it had applied rational basis review, according to the majority, it would have found COPA fine.
And thus, because the 5th Circuit has decided rational basis is the proper standard, it can effectively ignore Ashcroft.
The 5th Circuit also has to bend over backwards to ignore the US v. Playboy case. The case involved another part of the Communications Decency Act, forcing adult TV channels to block access or scramble content during certain hours to protect kids from access, which was also found unconstitutional. But the 5th Circuit says that’s different because… scrambling video signals is not age verification.
And thus, the court says it can ignore a whole series of Supreme Court rulings trying to block access to adult content and magically apply rational basis review, which, it says, “we do that easily.”
85-year-old Judge Patrick Higginbotham, who talks up the importance of the First Amendment, vigorously dissents on this part:
As Higginbotham rightly notes, contrary to the majority decision, the bill impacts not just “obscenity” (in which case Ginsberg could apply) but plenty of perfectly legal speech as well:
The majority says (in passing, without much explanation) that all adult content should be automatically considered “obscene” when viewed by a minor. The dissent points out that you can’t just say that.
And thus, he says, strict scrutiny must apply (and everyone admits the bill cannot pass strict scrutiny).
As the dissent notes, the idea that Ginsberg makes it okay to apply rational basis review in this case flies in the face of what Ginsberg itself said and what the Supreme Court has said over the past 50 years.
Indeed, the dissent points out how there are no recent cases that suggest Ginsberg could possibly apply here.
The dissent also points out how HB 1181 looks an awful lot like the section of the Communications Decency Act that was tossed out as unconstitutional in Reno v. ACLU.
The majority opinion also rejected the idea that Section 230’s preemption section voids this law. Under Section 230, it says that no state law that seeks to hold service providers liable for third party speech is valid. And this law clearly does that. But the majority disagrees by creating the most convoluted explanation for how section (c)(1) of Section 230 works.
The whole point of (c)(1) is that you cannot hold a service provider liable as the publisher of third-party speech placed on their platform. But the 5th Circuit is reinterpreting that to say it only applies to defamatory content, and not “offensive material.” Yet that’s not what any other court has said.
The 5th Circuit even admits that in a previous case, Doe v. Myspace, the very same 5th Circuit already said that 230 broadly immunizes platforms against any laws that would hold them liable for 3rd party speech. Indeed, the majority opinion admits this “complicates the analysis.” But instead of following that precedent, this 5th Circuit panel says it’s different because… now (it claims) 230 only applies to harm from content directly, not harm from complying with the law.
The dissent again points out how fundamentally bonkers this reading is and is clearly at odds with the MySpace ruling where the court said directly that it protects against “all claims stemming from their publication of information created by third parties.”
The majority decision just ignores that.
Even more to the point, the dissent notes that in Doe, the court said that mandated age verification violates 230’s preemption clause.
The majority gets one thing right: keeping the injunction on the mandatory health warnings, and rejecting the claims that the Zauderer case allows such mandatory disclosures. We’ve discussed the problems of how courts have been looking at Zauderer before, and at least here, the 5th Circuit seems to understand at least some of the limits of Zauderer.
As a reminder, Zauderer allows for mandatory disclosures over (1) commercial speech related to (2) advertising if and only if (3) the mandated speech is uncontroversial.
And thankfully, the panel recognizes that the mandatory warnings about “the harms” of porn are highly controversial and says Zauderer does not apply. It points out that both sides presented “credentialed and persuasive experts” that the mandated warnings are accurate, but also that they’re not. And given that:
And thus, the 5th Circuit actually gets this one bit right, but really messes up the age verification (and 230 parts). I would guess that the Free Speech Coalition is likely to ask the Supreme Court to hear an appeal, but who knows. It could be yet another highly consequential internet regulation bill that the Supreme Court needs to strike down…