Smart Bulletin No. 037

TikTok Ban; Micro-Purchasing Implications

UPDATE:

Business Line(s) Affected

Purchase, Integrated

Introduction

This Smart Bulletin is effective upon issuance and provides operational guidance primarily focused on micro-purchasing in relation to the requirements of Public Law 117-328 Division R, the “No TikTok on Government Devices Act” of the Consolidated Appropriations Act of 2023, OMB Memo M-23-13[PDF, 4 pages], No TikTok on Government Devices Implementation Guidance,” and Federal Acquisition Circular (FAC) 2023-04, Federal Acquisition Regulation (FAR) Case 2023-010, subject: “Prohibition on a ByteDance Covered Application.”

Public Law 117-328 at Division R (“the Act”) requires the Director of the Office of Management and Budget in consultation with the Administrator of General Services, the Director of the Cybersecurity and Infrastructure Security Agency, the Director of National Intelligence, and the Secretary of Defense to develop standards and guidelines for agencies which require the removal of TikTok software installed on Federal Information Technology (IT). TikTok is owned and operated by ByteDance Limited, a Chinese company.

OMB Memo M-23-13 mainly addresses requirements for agencies to identify the use of TikTok, remove any instances of its use either within an agency or by agency contractors, ensure contracts requiring the use of IT do not involve the use of this prohibited technology, and provide a timeline for these actions to be completed, assuming no exception for authorized use is applicable.

FAR case 2023-010 is an interim final rule that became effective upon the June 2, 2023, date of publication. In summary, it addresses contract clause requirements to implement the TikTok ban on formal contracts. It also states that the prohibition is applicable to actions within the simplified acquisition threshold, including micro-purchases.

Summary

Every year, organizations participating in the GSA SmartPay program use purchase cards to obtain approximately $23 billion in products and services in support of their missions through approximately 19 million purchase transactions.

The Act addresses TikTok and any successor application or service that is developed or provided by ByteDance Limited and prohibits their use by “executive agencies” as defined in 41 U.S.C § 133.2 and in all IT as defined in 40 U.S.C. § 11101(6). Exceptions to this prohibition are addressed in OMB memo M-23-13. Purchases made at or below the micro-purchase threshold are subject to the Act unless an exception is granted in accordance with the OMB memo (i.e., for national security, law enforcement, or security research activities).

This prohibition is narrow (e.g., affecting social media or advertising services; purchases of services that require the use of IT on which TikTok may be present), and it is not anticipated to affect many purchase cardholder micro-purchase transactions.

It is important to note that the definition of IT used for this ban encompasses not only IT owned or operated by agencies but also “used by a contractor under a contract with the executive agency that requires the use” of that IT, whether expressly or “to a significant extent in the performance of a service or the furnishing of a product” (M-23-13 at 1-2). That definition does not, however, “include any equipment acquired by a federal contractor incidental to a federal contract.”

Action

GSA SmartPay Purchase cards shall not be used for purchases that require the use of TikTok or require vendor use of IT that contains TikTok unless an exception is granted in accordance with Office of Management and Budget Memorandum M-23-13. Based on a Center for Charge Card Management review, agency purchase cardholders rarely acquire media services or make purchases through TikTok. As a result, very few purchase card transactions (primarily social media advertising and advertising services) are expected to be impacted by this prohibition.

However, agencies which routinely purchase social media and advertising services within the micro-purchase threshold using a purchase card may want to consider issuing a policy placing limits on buying these services on the open market to help manage this risk. As a best practice, agencies may also consider issuing policy emphasizing the security benefits of using existing government online shopping sites as the first source of supply for high-risk products and services, such as GSA Advantage!, Fed Mall, GSA Global Supply, category-managed solutions, agency-specific vehicles, etc. The expectation is that the cognizant contracting office will ensure the required TikTok prohibition is incorporated into the contracts underlying these offerings.

Note that this ban is different from the Section 889 ”covered technology” prohibition, as follows:

• No contractor representations are required;
• The prohibition is narrowly focused on the use of a single “app” (TikTok) in the performance of government work and
• The prohibition applies to devices used in the performance of government work, regardless of ownership. But it does not apply to personally-owned cell phones not used in the performance of a government contract or work or to technology incidental to the performance of such work.

Note that the statutory basis for this ban is separate and distinct from the Section 889 covered technology prohibition. Searching for a TikTok representation in the System for Award Management (SAM) or related SAM search tools is not relevant. Similarly, neither TikTok nor ByteDance Limited currently appears on the Excluded Parties list in SAM.