Montana took the unusual step on Wednesday of banning Chinese-owned short video app TikTok, with lawmakers of the sparsely populated western U.S. state saying they aimed to protect residents from alleged intelligence gathering by China.
TikTok, which is wildly popular with American teens and owned by Chinese tech company ByteDance, is already banned on government-issued devices in around 30 U.S. states and for employees of the country's federal agencies.
While blocking apps by geography is not unheard of, the Montana law is notable for doing so at the state level, upending a single-market approach Apple (AAPL.O) and Alphabet's Google (GOOGL.O) have long been able to use for their U.S. app stores.
Montana's ban is set to take effect on Jan. 1 2024.
HAS THIS EVER BEEN DONE BEFORE?
Sort of.
Tech companies are now well-practiced in blocking apps at the country level, mostly to comply with U.S. sanctions or for business purposes, like Apple's blocking of messaging and privacy apps in China upon government request.
Enterprising young people in affected countries have an equally long track record of skirting the bans by downloading the apps while traveling internationally or using tools like virtual private networks (VPNs), which obscure their location.
Within the United States, Pornhub recently disabled its services for IP addresses in Utah ahead of a state law that came into effect requiring adult content platforms to verify users' ages. However, that involved a website only, not an app.
Specifically for apps, Google and Apple appear to have navigated a tangle of different U.S. state rules around online gambling by leaving compliance to individual app developers, according to their app store guidance.
Google only started allowing gambling apps in its U.S. app store as of 2021, prior to which it restricted the apps in all but four countries: Brazil, France, Ireland and the United Kingdom.
Apple and Google declined to comment on how they approach state rules on gambling.
IS A STATE-LEVEL BAN EVEN TECHNICALLY FEASIBLE?
While TikTok can theoretically block IP addresses registered in Montana, app stores will have a more difficult time.
Apple and Google declined comment on the technical aspects of implementing a ban, but TechNet, a trade group funded by both companies, told Montana lawmakers in March that app stores "do not have the ability to geofence on a state-by-state basis."
"It would thus be impossible for our members to prevent the app from being downloaded specifically in the state of Montana," the TechNet representative testified.
According to cybersecurity researchers, that is likely because companies organize their app stores at the country level, meaning they have systems for shutting off downloads of a given app in some countries while keeping it accessible elsewhere.
The companies do not appear to have built such controls at a more granular level, the researchers said.
"I think it's possible but it's not possible today. It would require a bunch of code to be written," Alex Stamos, the director of the Stanford Internet Observatory and former top security officer at Facebook, said in a recent podcast.
The app stores also would need to monitor more detailed location data from users' phones than they currently use, infringing on users' privacy, Stamos said.
Even if the companies were to make those changes, TikTok-obsessed teens in Montana are likely to follow their peers around the world in learning how to use privacy tools and road trips to get the app onto their phones, said another researcher, John Scott-Railton at Citizen Lab.
"The youth of Montana are about to become America's experts in VPNs," Railton said.
