DOJ Clears TikTok for Agency Devices; FAR Hasn't Caught Up
The OLC opinion lifts the statutory ban, but FAR 52.204-27 still targets a ByteDance-controlled TikTok, and no agency has issued guidance on whether the new USDS venture is covered.
TL;DR
DOJ's Office of Legal Counsel issued a July 16 opinion finding the TikTok U.S. Data Security Joint Venture falls outside the No TikTok on Government Devices Act, clearing federal employees to use the app on government devices at their agency's discretion. The opinion preserves each agency's right to block TikTok, and agencies are already splitting: OPM permits it; others maintain blanket bans. For contractors, FAR 52.204-27 still defines a "covered application" as TikTok developed or provided by ByteDance or an entity ByteDance owns. ByteDance holds roughly 20 percent of the USDS venture, not a controlling stake, but the FAR hasn't been amended and no deviation has been issued.
DOJ's Office of Legal Counsel issued a slip opinion on July 16 finding that the TikTok U.S. Data Security Joint Venture, the Oracle-led entity that now runs the app's American operations, does not fall within the scope of the No TikTok on Government Devices Act. The 2022 statute banned TikTok from federal IT when the app was developed or provided by ByteDance. The OLC concluded the USDS joint venture functions independently of ByteDance, is majority-owned by American investors, and has revised both the recommendation algorithm and the cybersecurity program to address the risks that prompted the original ban.
The opinion doesn't compel agencies to permit TikTok. It explicitly preserves agency discretion to block the app for "workforce management reasons." The result, as FedScoop reported, is a split: OPM permits TikTok on government devices; others maintain outright bans. For contractors, the FAR clause at 52.204-27, unchanged since June 2023, defines a "covered application" as TikTok "developed or provided by ByteDance Limited or an entity owned by ByteDance Limited." ByteDance holds roughly 20 percent of the USDS venture, not a controlling stake. The FAR hasn't been amended, and no agency has issued a deviation addressing the mismatch.
Contracting officers and contractor compliance teams are left to interpret the clause themselves. A conservative reading treats it as still in force; a literal reading concludes the prohibition no longer attaches to the USDS version. No guidance from GSA, DOD, or NASA reconciles the two positions. Agencies that do permit TikTok also inherit records-keeping obligations under the Federal Records Act and data-collection risks the OLC opinion acknowledged but didn't claim were eliminated. The opinion notes the venture "revised" the cybersecurity program, not that it solved the underlying data-exfiltration concern.
Published ·Updated ·Deep Fathom