Protecting Americans' Data from Foreign Adversaries Act (2024)

• Law: Protecting Americans' Data from Foreign Adversaries Act (PADFAA), enacted as Division I of the National Security Act of 2024 (Public Law 118-50)
• Passed: April 24, 2024
• Vote: House 353–36; Senate 79–18
• Signed by: President Biden

Congress slipped two surveillance expansion bills into one national security package and rushed it through in days. One was the TikTok ban. The other was this — a law that gives the FTC authority to regulate which private companies you are allowed to share your data with and what counts as "sensitive" enough to trigger federal oversight. The TikTok ban got the headlines. This one got the power.

Your location data. Your health records. Your text messages. Your financial information. Under PADFAA, the federal government now has standing authority to regulate transfers of all of it — with the scope of "regulated transfers" defined by administrative rulemaking, not by Congress.

How It Passed

PADFAA was passed in the same bill as PAFACA — the TikTok ban. Both were tucked into a foreign military aid and national security supplemental package that included funding for Ukraine, Israel, and Taiwan. The package was assembled under urgent national security framing. It passed the House 353–36 and the Senate 79–18 in the same votes that passed the TikTok ban.

There was no standalone hearing on PADFAA's specific provisions. There was no public markup of the data broker definitions. There was no committee testimony from civil liberties organizations about the FTC rulemaking authority being handed over. The bill moved as a package — vote for Ukraine aid and Israel security or be accused of abandoning US allies — and PADFAA rode along.

The FTC's authority to define "data broker" and "entity of concern" through future rulemaking means Congress did not actually set the scope of the law. It handed the scope to an agency and moved on. Whatever the FTC decides those terms mean — through notice-and-comment rulemaking that will receive a fraction of the attention the original bill got — that is the law you live under.

What It Does To You

PADFAA prohibits "data brokers" from knowingly providing "sensitive personal data" of US persons to any "foreign adversary country" or any "entity of concern" tied to those countries.

Sounds targeted. It is not.

Sensitive personal data is defined to include: precise geolocation data, biometric identifiers, genetic information, health and medical data, financial account information, government ID numbers, and — this is the one to watch — personal communications. If you send a message, an email, or a social media post to anyone connected to a covered country, you may be creating a "transfer of sensitive personal data" under this law.

An "entity of concern" is any company at least 25% owned by a foreign adversary country, any company headquartered there, or — critically — any person subject to the jurisdiction of those countries. China has a national security law requiring Chinese citizens anywhere in the world to cooperate with Chinese intelligence. Under a broad reading, any Chinese national living in the United States could be an "entity of concern."

A "data broker" is not defined in the statute with precision. The FTC defines it through rulemaking. The FTC's existing guidance on data brokers already covers companies that buy, sell, or aggregate consumer data — but the rulemaking authority here is open-ended. The FTC could, by rule, extend the definition to cover software platforms, analytics services, cloud storage providers, or communication apps that handle covered data and have any connection to covered countries.

The FTC enforces this through civil penalties. No notice to individual users. No individualized suspicion. No warrant. The government monitors the data flows of private companies and sanctions those that transfer covered data improperly.

Rights It Strips

Your right to private communications. Personal communications are listed as sensitive data. If your communications app transfers your messages in ways that touch a covered country or entity — through a server, a third-party vendor, a parent company — you are potentially inside the scope of this law. You will not be told. No one will ask for your consent.

Your right to international relationships without surveillance. Americans have family members, business partners, colleagues, and friends in China, Russia, Iran, and other covered countries. Under PADFAA, routine transfers of data connected to those relationships become a regulated activity subject to federal oversight. The government does not need a warrant to determine that a data flow is impermissible. It needs an FTC rule and an enforcement action.

Your right to know what law you're living under. Congress set the framework. The FTC writes the substance. The definitions of "data broker," "sensitive data," and "entity of concern" will be shaped by administrative rulemaking — not by a vote in Congress. When those rules expand the law's reach in ways that affect your behavior, there will be no congressional vote to hold members accountable for.

The principle that surveillance requires probable cause. PADFAA regulates data transfers across the board — any data broker, any covered transfer, regardless of whether there is any individualized reason to believe wrongdoing occurred. This is category-level surveillance authority dressed as a prohibition on foreign data sharing.

Documented Harms

The law is recent and enforcement is still developing. But the structural harms are already visible.

The combination of PADFAA and PAFACA in a single package means that a vote for Ukraine aid was also a vote to expand FTC data oversight authority and a vote to ban TikTok. Members who voted YES on the package may not have fully evaluated each component. That is by design. Rushed national security packages are a recurring mechanism for slipping surveillance expansions past public scrutiny.

Legal scholars and civil liberties organizations — including the Electronic Frontier Foundation and the ACLU — raised specific concerns about PADFAA's definitions at the time of passage. Their core argument: once the federal government has standing authority to regulate "transfers of sensitive personal data" to a broad category of entities, that authority is a surveillance and control mechanism that can be expanded through administrative action without returning to Congress.

The FTC already uses its existing data broker authorities aggressively. PADFAA hands the FTC a new, broader authority that extends into communications data — the most sensitive category of all. Enforcement actions under this authority, once they begin, will create precedents that define the law's reach in ways that were never explicitly debated in Congress.

Who Pushed This

The national security establishment. The same intelligence community officials who drove the TikTok ban drove PADFAA. The argument is the same: Chinese entities are accessing American data at scale, and that access enables surveillance, manipulation, and coercion. That concern may be legitimate. It does not justify handing the FTC open-ended rulemaking authority over all US data transfers without a real public debate.

Data privacy advocates who wanted more. Some privacy advocates supported PADFAA as a limited step, while noting it was insufficient as a comprehensive privacy law. The problem: a limited step that hands the FTC broad definitional authority is not limited. It is a foundation. Future rulemaking can build on it in directions that no one in this debate explicitly endorsed.

The same bipartisan consensus that passed TikTok. 353–36 in the House, 79–18 in the Senate. The 36 House NO votes and 18 Senate NO votes are the clean records on this package. Every YES vote was a vote for the entire package — including both surveillance expansion laws — bundled with foreign aid.

Key Votes

• House: 353–36. The 36 NO votes include members who opposed the entire package for varied reasons. On this specific law's surveillance expansion provisions, they are the ones to watch.
• Senate: 79–18. The same 18 senators who voted against the TikTok ban package voted against this.

These votes were cast on a combined bill. Any member who supported the package owns PADFAA, the TikTok ban, and the FTC authority expansion — all of it, in one vote.

Why This Matters for We The Citizens

PADFAA is the quieter but potentially more consequential half of the April 2024 national security package. The TikTok ban received enormous attention because users felt it immediately. PADFAA received almost no attention because its effects will unfold through FTC rulemaking over the coming years — slowly, without headlines, through regulatory actions that most citizens will never see.

This is exactly how surveillance infrastructure gets built. Not in one dramatic vote, but through a series of smaller grants of administrative authority, each framed as targeted and limited, each providing a foundation for the next expansion.

The FTC's forthcoming rulemaking on "data broker" and "entity of concern" definitions will determine the real scope of this law. We The Citizens should be tracking those rulemakings, documenting who is influencing them, and connecting the administrative outcomes back to the congressional vote that created the authority in the first place.

Voter accountability here is about the package vote: who voted to rush a combined surveillance expansion through Congress under national security urgency framing, and who had the principle to vote no on a bill that bundled legitimate foreign aid with illegitimate grants of administrative surveillance authority.

See also: Bad Laws Overview