On May 29, 2026, Senator Ed Markey (D-MA) sent letters to Adam Presser, President of TikTok USDS, and to Oracle co-CEOs Clay Magouyrk and Mike Sicilia. His central allegation: the agreement that kept TikTok operating in the United States may satisfy the Protecting Americans from Foreign Adversary Controlled Applications Act's (PAFACA) technical requirements while violating its purpose. "President Trump managed to keep TikTok online only by ignoring the law's central goal and relying on vague, unproven safeguards," Markey wrote, demanding that both companies produce their underlying contracts—including the algorithm licensing agreement with ByteDance—by June 18, 2026.
That deadline has now passed with no public response. What remains is a structural question the deal's architects have not answered publicly: when ByteDance retains the intellectual property powering TikTok's recommendation engine, operates TikTok Shop through a separately controlled entity, and collects what analysts estimate could be up to half of TikTok US's profits through licensing fees and equity, what exactly was divested?
What PAFACA Actually Required
Congress passed PAFACA as part of Public Law 118-50 in April 2024. The law prohibits app stores and web hosts from distributing platforms controlled by foreign adversaries—defined as those with over one million monthly US users where a designated foreign adversary country holds 20% or more ownership—unless the company completes a "qualified divestiture." The operative word is divestiture: a genuine severing of control, not a dilution.
After multiple executive orders delaying enforcement, a deal finally closed on January 22, 2026, forming TikTok USDS Joint Venture LLC. The headline ownership structure looks American-controlled: Oracle holds 15%, Silver Lake 15%, Abu Dhabi's MGX 15%, other existing ByteDance investors 30.1%, and ByteDance itself just 19.9%—technically below the law's 20% threshold. On paper, the divestiture criteria is met.
The E-Commerce Carveout
Markey's letter targets a structural asymmetry the ownership percentages obscure. ByteDance retained full control of a separate entity managing TikTok Shop—the platform's social commerce arm—along with the advertising engine and marketing functions. These commercial operations were never included in the joint venture.
TikTok Shop is not a peripheral feature. Since its US launch in September 2023, it has rapidly become one of the country's fastest-growing social commerce platforms. On Black Friday 2024, it generated over $100 million in a single day. Market projections put it on track to capture roughly one-fifth of US social commerce by 2027. The revenues from those transactions—and the advertising revenue tied to product discovery—flow to an entity ByteDance controls outright, not to the Oracle-governed joint venture.
For users, the distinction between the social platform and the commerce layer is invisible. For regulators, it is the core of the problem. ByteDance's retained commercial entity benefits directly from how TikTok's algorithm surfaces products and runs ads—functions inextricably linked to the recommendation engine that PAFACA sought to decouple from Chinese control.
The Algorithm Licensing Question
Oracle's role as "Trusted Security Partner" is real and not merely nominal—and the strongest version of the deal's defenders deserves a fair hearing. Oracle holds authority to audit compliance, manage US user data infrastructure, and oversee retraining of TikTok's recommendation algorithm using exclusively US user data. These are substantive obligations with legal enforcement consequences. A compliance failure would expose Oracle to federal liability, creating genuine incentive beyond goodwill to actually enforce them.
But Oracle's oversight does not extend to owning the algorithm. ByteDance retains the underlying intellectual property and licenses it to the joint venture. As the Atlantic Council's analysis observed, "ByteDance retains... intellectual property rights to the algorithm," and influence operations can be conducted through design choices embedded in the model architecture—choices made before the deal closed and encoded into the algorithm's weights and training objectives. What Oracle monitors is data access and operational compliance, not the design assumptions baked into the model itself.
Markey pressed for specifics on exactly this point: How does Oracle review code received from ByteDance? What is the actual retraining process, and how is it independently verified? Has ByteDance accessed any US user data since the transition? These are the operational details that determine whether the arrangement achieves PAFACA's national security rationale or merely performs compliance with it.
The Transparency Gap That Matters
The financial structure adds a dimension beyond national security. ByteDance receives licensing fees from the joint venture for algorithm IP—fees that analysts, citing Bloomberg reporting, suggest could reach up to roughly half of TikTok US's profits when combined with ByteDance's 19.9% equity stake. That alignment creates commercial incentives for the algorithm to maximize engagement and commerce in ways that generate licensing revenue for ByteDance. Whether those incentives create an influence vector depends on contractual terms that remain undisclosed.
The June 18 deadline has passed. Neither TikTok USDS nor Oracle has released the requested contracts. Those letters carry congressional oversight authority, not subpoena power—compliance is political, not legally compelled. But that silence is itself informative. A deal genuinely designed to satisfy PAFACA's national security concerns should be able to survive scrutiny of its terms.
The precedent at stake extends beyond TikTok specifically. If a company can satisfy a statutory divestiture mandate by transferring data custodianship while retaining algorithm IP, e-commerce operations, and the bulk of commercial revenues—all held in separately structured entities—then future foreign-adversary-controlled-application mandates can be negotiated around rather than complied with. Congress passed PAFACA because it concluded that ByteDance's control posed national security risks worth legislating against. The question Markey is pressing is whether the law was actually satisfied, or simply rerouted through creative corporate structuring.