OMB Memorandum M-23-13, "No TikTok on Government Devices" Implementation Guidance (Feb. 27, 2023), directs federal agencies to remove TikTok from federal devices and sets instructions and deadlines for doing so. The memorandum's own scope centers on agency-managed information technology; it is the downstream implementing regulation, FAR 52.204-27, that explicitly extends the prohibition to contractor and employee-owned (BYOD) devices used in contract performance. As of July 2026, a third layer applies: DOJ's Office of Legal Counsel concluded that TikTok, as currently operated by the TikTok USDS Joint Venture, may no longer meet the statutory definition of a covered application at all, a question neither M-23-13 nor the FAR clause answers on its own terms. In practice, all three now operate together: M-23-13 sets the underlying agency policy and named statutory exceptions, the FAR clause is the mechanism that pulls personally owned BYOD devices into scope for federal contractors, and the OLC opinion determines whether TikTok currently falls within either.
What M-23-13 itself covers
M-23-13 implements Section 102 of Division R of the Consolidated Appropriations Act, 2023 (the No TikTok on Government Devices Act) and instructs agencies to identify and remove the covered application from information technology, with narrow exceptions limited to national security, law enforcement, and security research activities. The memorandum is addressed to agency heads and focuses on agency-owned and agency-managed technology as its primary implementation vehicle.
How BYOD scope is actually established
The BYOD-specific language — extending the prohibition to "employee-owned devices that are used as part of an employer bring your own device (BYOD) program" — appears in the FAR clause (52.204-27) and its Federal Register preamble, which was issued to implement the statute and OMB guidance for procurement contracts. This means personally owned devices become subject to the prohibition primarily through the contractual FAR clause flowing down to a contractor's BYOD program, rather than through a provision literally written into M-23-13's own text. This clause has not been amended and remains active in the FAR and in existing contracts — see below for what it does and doesn't still reach.
What changed: the July 2026 OLC opinion
On 16 July 2026, DOJ's Office of Legal Counsel issued 50 Op. O.L.C. __, Application of the No TikTok on Government Devices Act to the TikTok USDS Joint Venture, memorializing advice first given unconditionally on 10 March 2026. OLC concluded the Act reaches only applications developed or provided by entities in which ByteDance Limited holds a controlling ownership stake, not any stake at all. The TikTok USDS Joint Venture, established 22 January 2026 with American and allied investors holding 80.1% and ByteDance retaining 19.9%, falls outside that definition on OLC's reading. OLC did not address M-23-13 or FAR 52.204-27 directly; both remain in force, unamended, and agencies retain full discretion to prohibit TikTok on their own systems for independent reasons.
Agency-level compliance record
The Treasury Inspector General for Tax Administration's review of IRS compliance with M-23-13 and the FAR implementation found gaps specifically involving personally owned devices under the IRS's BYOD program, and recommended the IRS coordinate with OMB to confirm its BYOD policies aligned with the Act. This oversight history illustrates that the BYOD question is treated as a live compliance issue by federal watchdogs, not a settled technicality. This finding predates the OLC opinion and reflects a period when TikTok's ownership structure was different; it is evidence of enforcement gaps generally, not evidence about TikTok's current status under the Act.
This entry restates publicly available technical and policy sources and asserts nothing beyond them. It is not legal or compliance advice. BYODPolicy.org is not affiliated with, endorsed by, or accredited by NIAP, NIAP-CCEVS, or any government body.