Montana governor bans TikTok. But can the state enforce the law?

The new rules in Montana will have more far-reaching effects than TikTok bans already in place on government-issued devices in nearly half the states and the U.S. federal government. There are 200,000 TikTok users in Montana as well as 6,000 businesses that use the video-sharing platform, according to company spokesperson Jamal Brown.

Here’s what you need to know:

WHY IS MONTANA BANNING TIKTOK?

Proponents of the law in Montana claim the Chinese government could harvest U.S. user data from TikTok and use the platform to push pro-Beijing misinformation or messages to the public.

That mirrors arguments made by a bipartisan group of lawmakers in the U.S. Senate, as well as the heads of the FBI and the CIA, all of whom have said TikTok could pose a national security threat because its Beijing-based parent company ByteDance operates under Chinese law.

Critics have pointed to China’s 2017 national intelligence law that compels companies to cooperate with the country’s governments for state intelligence work. Another Chinese law, implemented in 2014, has similar mandates.

TikTok says it has never been asked to hand over its data, and it wouldn’t do so if asked.

HOW DOES MONTANA PLAN TO BAN TIKTOK?

The law will prohibit downloads of TikTok in the state and fine any “entity” — an app store or TikTok — $10,000 per day for each time someone accesses TikTok, “is offered the ability” to access it, or downloads it.

That means Apple and Google, which operate app stores on Apple and Android devices, would be liable for any violations. Penalties would not apply to users.

The statewide ban won’t take effect until January 2024. It would be void if the social media platform is sold to a company that is not based in “any country designated as a foreign adversary” by the federal government.

The governor indicated he wants to expand the bill to other social media apps in order to address some of the bill’s “technical and legal concerns.” But the legislature adjourned before sending him the bill, which meant he couldn’t offer his amendments.

Montana Attorney General Austin Knudsen has pointed to technology used to restrict online sports gambling apps as a way to curtail TikTok from operating in the state. Those violations can be reported by anyone. And once the state verifies a breach has taken place, it sends a cease-and-desist letter to the company involved, said Kyler Nerison, a spokesperson for Knudsen’s office. He said different companies use different methods for compliance and it’s up to them “to not allow their apps to work in Montana and other states where they are not legal.”

SO, COULD THE TIKTOK BAN WORK?

Cybersecurity experts say that, other than avoiding the fine, there’s nothing incentivizing the companies involved to comply and it will be extremely difficult — if not impossible — to adequately enforce the law.

For one, the U.S. doesn’t have anything equivalent to the type of control countries like China have on what their citizens access on the web. Compounding that, internet service providers are out of the picture.

Before the Montana law passed, lawmakers rewrote portions of the bill to let them off the hook after a lobbyist for AT&T said during a February hearing the legislation was “not workable” to put into effect.

COULD TECH COMPANIES BLOCK IT?

Apple and Google have not spoken out against the law. But a representative for TechNet, the trade group that counts the two tech giants as its members, has said app stores don’t have the ability to “geofence” apps in different states and it would be impossible to prevent TikTok from being downloaded in Montana. The group has also said the responsibility should be on an app to determine where it can operate, not an app store.

Telecoms analyst Roger Entner, of Recon Analytics, says he believes the app stores could have the capability to enforce the law, but it would be cumbersome to implement and full of loopholes. Apple and Google’s address-linked billing could be bypassed with prepaid cards and IP geolocation easily masked by using a VPN service, which can alter IP addresses and allows users to evade content restrictions, said mobile security expert Will Strafach, the founder of Guardian, which makes a privacy protection app for Apple devices.

Oded Vanunu, head of products vulnerability research at the cybersecurity firm Check Point, agreed it would be difficult for app stores to isolate a single state from downloading an app. He suggested it would be more feasible for TikTok to comply since it controls the software and can “adjust the settings based on the geographical location or IP addresses” of users.

COULD TIKTOK BLOCK ITSELF?

When users allow TikTok to collect their location information, it can track a person to at least 3 square kilometers (1.16 square miles) from their actual location. If that feature is disabled, TikTok can still collect approximate location information – such as the region, city or zip code in which a user may be located – based on device or network information, like an IP address.

But similar to the app stores, cybersecurity experts note that any enforcement measures the company implements could be easily bypassed with a VPN and efforts to use IP geolocating might lead to other issues.

David Choffnes, the executive director of the Cybersecurity and Privacy Institute at Northeastern University, said cell providers may use the same types of IP addresses for multiple states, which could mean someone who is not in Montana could incorrectly be blocked from using TikTok.

WHAT’S GOING TO HAPPEN NEXT?

Knudsen, Montana’s attorney general, has already said he expects the law will end up in court.

TikTok spokesperson Brooke Oberwetter said in a prepared statement Wednesday that the law infringes on Montanan’s free speech rights and is unlawful.

“We want to reassure Montanans that they can continue using TikTok to express themselves, earn a living, and find community as we continue working to defend the rights of our users inside and outside of Montana,” Oberwetter said.

Oberwetter declined to say if the company will file a lawsuit but described some of the legal issues at play. She argued Montana is attempting to override U.S. foreign policy by claiming the bill addresses a national security risk. She said foreign policy and national security laws are not made at the state level.

NetChoice, a trade group that represents TikTok and other tech companies, says the bill would violate the First Amendment and “bill of attainder” laws that prohibit the government from imposing a punishment on a specific entity without a formal trial.

AP Technology Writer Frank Bajak contributed to this report from Boston.