TikTok U.S. Joint Venture and Proposed Security Standards for Foreign-Owned Apps

TikTok announced the creation of TikTok USDS Joint Venture LLC to keep operating in the U.S. under a September 2025 executive order. Under the arrangement, ByteDance would reduce its ownership to 19.9%, with majority ownership shifting to majority-American investors; TikTok said the new entity will implement national-security safeguards including U.S.-based data protections and controls around the recommendation algorithm. The company stated that U.S. user data and algorithm security will be supported via Oracle’s U.S. cloud environment, and that the joint venture will run a cybersecurity and privacy program aligned to frameworks such as NIST CSF, NIST 800-53, and ISO 27001, with third-party auditing/certification; TikTok said similar safeguards would extend to other U.S.-available apps such as CapCut and Lemon8.

Separately, a policy commentary argued that the TikTok controversy highlights the lack of consistent U.S. standards governing foreign-owned apps—particularly around data ownership/access and algorithmic oversight—and called for clearer, enforceable requirements (e.g., upfront disclosure of who owns collected data and how users can opt out). While it does not add new incident details about TikTok’s joint venture, it frames the broader national-security and consumer-protection rationale for establishing uniform rules for foreign-based software providers operating in the U.S., citing TikTok and other China-linked apps as examples.