When the deal securing TikTok's future in the United States closed on January 22, 2026, the headline was ownership: a new US-based joint venture, TikTok USDS Joint Venture LLC, would run the app, with ByteDance reduced to a sub-20% stake. The less-noticed structural fact is more consequential. The deal did not just change who owns TikTok — it cleaved the product in two. The algorithm, US user data, and content moderation went to the US venture. The commerce engine — TikTok Shop, advertising, and marketing — was routed to a separate, ByteDance-controlled entity reportedly named TT Commerce & Global Services LLC, to which US employees in those functions were reassigned in early January 2026.
That separation deserves scrutiny, because it sits in tension with the very law the deal was meant to satisfy.
The strongest case for the divestiture
The security worry behind the Protecting Americans from Foreign Adversary Controlled Applications Act (PAFACA) was not frivolous, and it is worth stating plainly. In TikTok, Inc. v. Garland, the Supreme Court's January 17, 2025 per curiam opinion upheld the law under intermediate scrutiny, finding it directly served the government's substantial interest in preventing China from collecting the personal data of tens of millions of US TikTok users and from covertly shaping what they see. A foreign-adversary government with leverage over a recommendation system used by roughly 170 million Americans is a legitimate thing to regulate.
A divestiture remedy is also genuinely more proportionate — and more speech-protective — than the outright ban PAFACA otherwise mandated. It keeps the app online, preserves the creator economy built on top of it, and changes the locus of control without silencing anyone. On a pro-speech, pro-innovation view, a forced change of ownership is a far better outcome than an empty app store. The September 25, 2025 executive order Saving TikTok While Protecting National Security leaned on exactly this logic, determining that a framework in which ByteDance holds less than 20% and all recommendation models touching US data are retrained and monitored by trusted security partners amounted to a "qualified divestiture."
What the separation leaves behind
Here is the problem. PAFACA's qualified-divestiture test is not satisfied by an equity percentage. As the Congressional Research Service summarizes the statute, a transaction qualifies only if the President determines that, afterward, the foreign adversary will have "neither control nor any operational relationship" with the application — including no cooperation on the algorithm or data-sharing.
The commerce carve-out strains that standard. TikTok Shop is not a peripheral feature; it is one of the most data-rich, behaviorally-targeted layers of the entire platform. Advertising and marketing are precisely the functions that turn engagement data into revenue and into precise audience inference. If those operations continue under a ByteDance-controlled entity that maintains an ongoing commercial relationship with the US app — sharing global product interoperability, ad infrastructure, and commerce tooling — it is hard to characterize the arrangement as the foreign adversary having no operational relationship with the app. It is a different operational relationship, relabeled and re-papered into a new LLC.
The security critique sharpens the point. Writing for the Atlantic Council, Kenton Thibaut argues the restructuring "largely shifts visible forms of control from Beijing to other actors without eliminating the underlying vulnerabilities," noting that ByteDance "has preserved control over its most valuable intellectual property" through algorithm licensing. If the recommendation engine is licensed rather than transferred, and the commerce-and-ads layer stays in-house, the divestiture has changed the org chart more than the data flows.
Ownership is the wrong lever
None of this is an argument for the ban. It is an argument that nationality-of-owner is a brittle proxy for the harm regulators actually care about. A 19.9% equity line and a freshly incorporated commerce subsidiary are exactly the kind of structure a sophisticated firm can engineer to clear a bright-line ownership threshold while leaving the substantive relationships intact. Regulation keyed to corporate structure invites corporate restructuring as the compliance strategy.
Conduct-based rules are harder to game and more durable. Enforceable data-minimization and data-localization obligations, independent and auditable algorithm monitoring, transparency reporting, and security certifications attach to what the platform does with data — not to who holds the cap table. Those obligations would bind TikTok Shop and the ad stack as much as the feed, regardless of which LLC the employees report to. They also generalize: the same data practices that worried Congress about TikTok run through the broader US ad-tech and data-broker ecosystem, which a one-company ownership remedy leaves entirely untouched.
A fragile foundation
There is a final reason for caution. As Lawfare's Alan Rozenshtein has detailed, the bridge to this deal was built on executive non-enforcement — a promise that the Justice Department simply would not enforce PAFACA's penalties (up to $5,000 per user) during successive pause windows. Courts have generally declined to protect companies that rely on promised non-enforcement rather than a clear statement that conduct is lawful. A divestiture whose central premise — a clean severance of the foreign adversary from the app — is undercut by a retained commerce arm, and whose interim legal cover rested on prosecutorial discretion, is more fragile than the closing-day press releases suggested.
The better path was always proportionate, conduct-based regulation that survives a corporate reshuffle. The commerce/social-media split is a useful reminder of why: when you regulate the box on the org chart, the box just moves.