Technology and cybersecurity

Executive Order 14034: Protecting Americans' Sensitive Data From Foreign Adversaries

President: Joseph R. Biden Jr.

Revoked proposed app-specific bans and directed a criteria-based review of connected software applications controlled by foreign adversaries, centered on sensitive-data and national-security risk.

Status: In effect.

Is Executive Order 14034 still in effect? Yes. In effect within the ICTS and data-security framework.

A phone containing personal-data icons sits behind a shield, opposite servers, a hooded figure and a globe.
Connected-software and data-security risks, illustrated symbolically; not evidence of a particular breach or an application's legal status. EO Explained · site-generated editorial illustration · not documentary evidence.

What does Executive Order 14034 do?

Commerce was to evaluate connected-software risks against the order’s criteria and recommend safeguards after consulting other agencies.

Administration position: The order’s findings and policy rationale were the Biden administration’s positions. This guide distinguishes them from implementation records and judicial rulings.
SignedJune 9, 2021
Lead officialsCommerce, Attorney General, Homeland Security and intelligence agencies
Express timingCommerce recommendations within 120 days; threat and vulnerability reports within 60 days

Before and after

Before the order

Earlier orders targeted named applications such as TikTok and WeChat, while the broader ICTS supply-chain rule was still developing.

After the order

Commerce continued ICTS reviews under EO 13873 and this order. EO 14117 and Justice’s Data Security Program later added transaction controls for bulk sensitive data; Justice still identifies EO 14034 as an active supply-chain authority.

Who had to do what

Agency / officeActionTiming / position
CommerceEvaluate connected-software risks using stated criteriaOngoing
Commerce and agenciesRecommend safeguards and further executive action120 days
Homeland Security and JusticeProvide threat and vulnerability assessments60 days

What happened next

EO 14034 signed.

EO 14117 added a bulk-data transaction framework.

Justice’s Data Security Program rule took effect.