Montana is banning TikTok. But can the state enforce the law and fend off a lawsuit?

NEW YORK (AP) — Montana’s first-of-its kind law that makes it illegal for residents to use TikTok in the state is already facing its first legal challenge with a lawsuit filed by five people who use the app and argue the law is an unconstitutional violation of free speech rights.

Montana Republican Gov. Greg Gianforte signed it into law Wednesday expecting a legal fight would follow. The law, which isn’t scheduled to take effect until Jan. 1, 2024, also faces a litany of questions over whether the state can even enforce the law.

The new rules in Montana will have more far-reaching effects than TikTok bans already in place on government-issued devices in nearly half the states and the U.S. federal government. There are 200,000 TikTok users in Montana as well as 6,000 businesses that use the video-sharing platform, according to company spokesperson Jamal Brown.

Here’s what you need to know:

WHY IS MONTANA BANNING TIKTOK?

Proponents of the law in Montana claim the Chinese government could harvest U.S. user data from TikTok and use the platform to push pro-Beijing misinformation or messages to the public.

That mirrors arguments made by a bipartisan group of lawmakers in the U.S. Senate, as well as the heads of the FBI and the CIA, all of whom have said TikTok could pose a national security threat because its Beijing-based parent company ByteDance operates under Chinese law.

Critics have pointed to China’s 2017 national intelligence law that compels companies to cooperate with the country’s governments for state intelligence work. Another Chinese law, implemented in 2014, has similar mandates.

TikTok says it has never been asked to hand over its data, and it wouldn’t do so if asked.

WHAT DO THEY ARGUE IN THE LEGAL CHALLENGE?

Five plaintiffs who are all TikTok creators from Montana argue the law is an unconstitutional violation of free speech rights. They also contend the state doesn’t have authority over matters of national security.

“Montana can no more ban its residents from viewing or posting to TikTok than it could ban the Wall Street Journal because of who owns it or the ideas it publishes,” the complaint said.

The people suing include one with a swimwear business, one who connects with military veterans, one who shares videos about ranch life, another who shares her outdoor adventures and one who shares humorous videos.

Emily Flower, spokeswoman for the Montana Department of Justice, said the state expected a legal challenge and it is “fully prepared to defend the law.”

TikTok has argued that the law infringes on people’s First Amendment rights. But spokesperson Brooke Oberwetter declined to comment on the lawsuit and also declined to say whether the company helped coordinate the complaint filed by the TikTok content creators.

The case could serve as a testing ground for the TikTok free America many national lawmakers have envisioned.

HOW DOES MONTANA PLAN TO BAN TIKTOK?

The law will prohibit downloads of TikTok in the state and fine any “entity” — an app store or TikTok — $10,000 per day for each time someone accesses TikTok, “is offered the ability” to access it, or downloads it.

That means Apple and Google, which operate app stores on Apple and Android devices, would be liable for any violations. Penalties would not apply to users.

The statewide ban won’t take effect until January 2024. It would be void if the social media platform is sold to a company that is not based in “any country designated as a foreign adversary” by the federal government.

The governor indicated he wants to expand the bill to other social media apps in order to address some of the bill’s “technical and legal concerns.” But the legislature adjourned before sending him the bill, which meant he couldn’t offer his amendments.

Montana Attorney General Austin Knudsen has pointed to technology used to restrict online sports gambling apps as a way to curtail TikTok from operating in the state. Those violations can be reported by anyone. And once the state verifies a breach has taken place, it sends a cease-and-desist letter to the company involved, said Kyler Nerison, a spokesperson for Knudsen’s office. He said different companies use different methods for compliance and it’s up to them “to not allow their apps to work in Montana and other states where they are not legal.”

SO, COULD THE TIKTOK BAN WORK?

Cybersecurity experts say that, other than avoiding the fine, there’s nothing incentivizing the companies involved to comply and it will be extremely difficult — if not impossible — to adequately enforce the law.

For one, the U.S. doesn’t have anything equivalent to the type of control countries like China have on what their citizens access on the web. Compounding that, internet service providers are out of the picture.

Before the Montana law passed, lawmakers rewrote portions of the bill to let them off the hook after a lobbyist for AT&T said during a February hearing the legislation was “not workable” to put into effect.

COULD TECH COMPANIES BLOCK IT?

Apple and Google have not spoken out against the law. But a representative for TechNet, the trade group that counts the two tech giants as its members, has said app stores don’t have the ability to “geofence” apps in different states and it would be impossible to prevent TikTok from being downloaded in Montana. The group has also said the responsibility should be on an app to determine where it can operate, not an app store.

Telecoms analyst Roger Entner, of Recon Analytics, says he believes the app stores could have the capability to enforce the law, but it would be cumbersome to implement and full of loopholes. Apple and Google’s address-linked billing could be bypassed with prepaid cards and IP geolocation easily masked by using a VPN service, which can alter IP addresses and allows users to evade content restrictions, said mobile security expert Will Strafach, the founder of Guardian, which makes a privacy protection app for Apple devices.

Oded Vanunu, head of products vulnerability research at the cybersecurity firm Check Point, agreed it would be difficult for app stores to isolate a single state from downloading an app. He suggested it would be more feasible for TikTok to comply since it controls the software and can “adjust the settings based on the geographical location or IP addresses” of users.

COULD TIKTOK BLOCK ITSELF?

When users allow TikTok to collect their location information, it can track a person to at least 3 square kilometers (1.16 square miles) from their actual location. If that feature is disabled, TikTok can still collect approximate location information – such as the region, city or zip code in which a user may be located – based on device or network information, like an IP address.

But similar to the app stores, cybersecurity experts note that any enforcement measures the company implements could be easily bypassed with a VPN and efforts to use IP geolocating might lead to other issues.

David Choffnes, the executive director of the Cybersecurity and Privacy Institute at Northeastern University, said cell providers may use the same types of IP addresses for multiple states, which could mean someone who is not in Montana could incorrectly be blocked from using TikTok.

___

AP Technology Writer Frank Bajak contributed to this report from Boston.