Protecting Americans' Sensitive Data From Foreign Adversaries

The order revokes Executive Orders 13942 (TikTok), 13943 (WeChat), and 13971 (Chinese-developed apps) and directs the Director of OMB and all agency heads to promptly rescind any rules, regulations, guidelines, or policies implementing those orders. Personnel positions, committees, and task forces created under those orders must also be abolished. The Secretary of Commerce is directed to conduct ongoing evaluations of connected software applications that may pose undue risk to national security or critical infrastructure, and to take action under the existing ICTS supply chain framework as warranted.

Separately, the order sets up a parallel reporting process: the Director of National Intelligence must provide threat assessments and the Secretary of Homeland Security must provide vulnerability assessments within 60 days, feeding into two Commerce Department reports — one due within 120 days recommending protections for sensitive U.S. personal data, and one due within 180 days recommending additional executive and legislative actions on risks from foreign-adversary-linked connected software applications.

Technology companies — particularly those with ties to foreign adversaries such as China — whose products were subject to the revoked orders. U.S. persons whose personal, health, and genetic data may be collected by connected software applications, and federal agencies previously tasked with enforcing the revoked app bans.

Companies like TikTok and WeChat that faced bans under the prior orders are no longer subject to those restrictions. Enforcement activity tied to the revoked orders halts immediately. The longer-term question of how the U.S. will regulate foreign-linked apps is deferred to the report-and-recommendation process the order sets in motion.

The order runs in two tracks. The first is immediate: agencies rescind implementing rules and abolish enforcement bodies. The second is sequential: the DNI and DHS produce assessments at 60 days, which feed the Commerce Secretary's 120-day data-protection report and 180-day connected-software report, both delivered to the National Security Advisor. Commerce's ongoing evaluation authority under EO 13873 remains live throughout. There are no explicit penalties for missing the report deadlines, and the order explicitly requires consistency with the Administrative Procedure Act for any rulemaking that follows.