You could have read either the law or the decision, linked in the comments here, to get the answer to this question.

From the decision:

> Second, the Act establishes a general designa-

> tion framework for any application that is both (1) operated

> by a “covered company” that is “controlled by a foreign ad-

> versary,” and (2) “determined by the President to present a

> significant threat to the national security of the United

> States,” following a public notice and reporting process.

> §2(g)(3)(B). In broad terms, the Act defines “covered com-

> pany” to include a company that operates an application

> that enables users to generate, share, and view content and

> has more than 1,000,000 monthly active users. §2(g)(2)(A).

> The Act excludes from that definition a company that oper-

> ates an application “whose primary purpose is to allow us-

> ers to post product reviews, business reviews, or travel in-

> formation and reviews.” §2(g)(2)(B).