Introduction

On December 27, 2024, the U.S. Department of Justice (“DOJ”) issued the Final Rule implementing President Biden’s February 28, 2024 Executive Order on “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern” (the “EO”). The Final Rule solidifies a new national security regulatory regime focused on protecting bulk U.S. sensitive personal data and government-related data from countries of concern, including the People’s Republic of China (“PRC” or “China”), and represents the latest step in the U.S. government’s whole-of-government effort to “de-risk” with respect to China. The Final Rule marks the first time that U.S. persons will be categorically prohibited from engaging in certain transactions that may result in foreign access to bulk U.S. sensitive personal data and government-related data. It also provides that certain other transactions will be “restricted,” meaning they are prohibited unless the U.S. business first implements a range of security requirements, which in some cases will be onerous or costly. The Final Rule accordingly could have wide-ranging implications for U.S. companies across various industries. The Final Rule takes effect 90 days after publication in the Federal Register, which is set for January 8, 2025, although certain compliance requirements will not take effect until 270 days following publication.

In parallel with the release of the Final Rule, on January 3, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (“CISA”), which is part of the U.S. Department of Homeland Security (“DHS”), released the final security requirements (the “Security Requirements”). The Security Requirements set forth the measures that U.S. persons must satisfy in order to engage in restricted transactions, and are incorporated by reference into the Final Rule.

Importantly, as we discussed in our analysis of the Advance Notice of Proposed Rulemaking (“ANPRM”) and our analysis of the Notice of Proposed Rulemaking (“NPRM”), the Final Rule is a national security regulation designed to address identified risks to U.S. national security—not a privacy regulation designed to protect privacy or other individual interests. Consequently, while the Final Rule regulates transactions involving personal data, many of the concepts and definitions diverge materially from those in existing privacy regimes. The Final Rule stems from the U.S. government’s increasing unwillingness to tolerate foreign adversary access to U.S. personal data. As DOJ explained in the preamble to the Final Rule, “[t]his rule will prevent . . . foreign adversaries from legally obtaining [bulk U.S. sensitive personal data or government-related data] through commercial transactions with U.S. persons, thereby stemming data flows and directly addressing the national security risks identified in the [EO].” DOJ cited examples such as (1) the ability of journalists to track the movements of U.S. President Joe Biden, U.S. Vice President Kamala Harris, and now President-Elect Donald Trump through their bodyguards’ use of a fitness app; and (2) the ability to track U.S. government personnel movement through the purchase of location information and digital advertising data—that demonstrate the U.S. national security risks associated with foreign adversary access to commercially available data. Finally, DOJ made a particular point of explaining that certain data that is anonymized or depersonalized presents U.S. national security risks, especially with respect to the ability of adversaries to use “bulk human genomic data[] to enhance military capabilities that include facilitating the development of bioweapons.”

On January 6, 2025, the U.S. Food and Drug Administration (FDA) issued its Draft Guidance on the Labeling of Plant-Based Alternatives to Animal-Derived Foods. The draft guidance outlines FDA’s recommendations for naming plant-based egg, seafood, poultry, meat, and dairy products (other than milk[1]) in compliance with FDA’s naming requirements for non-standardized foods. The draft guidance expressly “excludes animal proteins produced by microflora,” such as those produced using precision fermentation. Interested stakeholders should provide comments on the draft guidance by May 7, 2025, after which point FDA will begin work on the final guidance.

I. FDA’s Naming Requirements for Non-Standardized Foods

The Federal Food, Drug, and Cosmetic Act (FDCA) and FDA’s implementing regulations require that the labels of non-standardized foods (i.e., foods for which FDA has not issued a standard of identity) bear the common or usual name of the food or, if there is no such name, an accurate description of the food or a fanciful name commonly used by the public.[2] The draft guidance notes that while many plant-based alternatives are foods for which no common or usual name has been established, manufacturers should look to FDA’s general principles for identifying common or usual names when selecting names for these foods.[3] For example, appropriate names should describe the basic nature of the food, should be uniform among identical or similar products, and should adequately distinguish between classes or subclasses of a product. Against this backdrop, the draft guidance provides specific recommendations for naming plant-based alternatives.

II. FDA’s Recommendations

The draft guidance’s primary recommendation—and one that could pose implications for many currently-marketed plant-based products—is that the statement of identity for plant-based alternatives should identify the specific plant source(s) from which the food is derived (e.g., “soy chicken,” “black bean mushroom veggie patties,” “chickpea and lentil-based fish sticks”). The draft guidance notes that, while general terms like “plant-based” can help convey that a product is not animal-derived, such terms do not, by themselves, adequately distinguish a food from other plant-based alternatives and therefore do not provide consumers with sufficient information to make purchasing decisions. Thus, while terms like “plant-based” can be used as part of a product’s name, the draft guidance recommends that such terms be accompanied by language that identifies the specific plant source(s) in the product (e.g., using “plant-based soy-bacon” instead of just “plant-based bacon”).