Last updated: October 2026
#AFFILIATE-PLACEHOLDER-* in our code) until we join programs — at which point every affected page gets a clear, conspicuous disclosure. Full disclosure.
You turn on a VPN so the local network — the coffee shop, the hotel, the ISP — doesn't get a clean list of where you go online. Your traffic enters an encrypted tunnel and exits through a server run by your VPN provider. That puts the provider in a powerful position: it sits at the seam of your connection.
A bill now before the U.S. House of Representatives would ask some providers to use that position as a checkpoint. Here's what it actually says, in plain English.
The bill works in two court stages:
A resulting order requires each named provider to take "commercially reasonable steps" to prevent U.S. users from reaching the site — implementation due roughly 14–30 days after notice, lasting up to 12 months with possible extensions. Crucially, the bill leaves the technical method to each provider rather than prescribing a specific filter. The court must weigh technical feasibility, burden, incidental harm, and public benefit (cyber-security-in-plain-english.com).
The bill defines "service provider" to expressly include broadband providers, domain-name resolvers, and virtual private networks. Providers with fewer than 100,000 monthly U.S. users or subscribers are excluded — as are premises that merely supply connectivity on-site, like libraries, universities, restaurants, shops, and airports (cyber-security-in-plain-english.com; TorrentFreak).
So a large VPN service could be named in a U.S. order and required to stop its U.S. users from taking a specified route — while a small one stays out of scope. The bill doesn't dictate how a VPN would block: the provider could filter at its own DNS resolver, refuse to route to destination addresses, or use another method on its network. That flexibility is deliberate — but it also means "commercially reasonable" does heavy lifting, and a narrow method is easy to bypass while a broad one risks catching lawful services on shared infrastructure (cyber-security-in-plain-english.com).
Two site-blocking bills appeared within days of each other, and they treat VPNs differently on purpose (TorrentFreak):
| ACPA (H.R. 10364) | DEFEND IP Act (H.R. 10575) | |
|---|---|---|
| VPNs | Covered | Explicitly excluded if the service exclusively provides VPN connections |
| Provider threshold | 100,000 monthly U.S. users/subscribers | 50,000 subscribers (ISPs) |
| Piracy-site test | "Only limited" commercially significant purpose beyond infringement (lower bar) | "No" commercially significant purpose beyond infringement (higher bar) |
| Piracy liability shield | Yes — broad, for all covered providers from day one | No |
| Rightsholder bond | Yes | No |
| Overblocking compensation | Up to $250,000 if the rightsholder caused the error | None (court can fix an order) |
Comparison data from TorrentFreak's analysis of both bill texts.
The ACPA pairs obligations with protections: a broad piracy-damages shield for providers, mandatory cost reimbursement, bonds posted by claimants, a public registry of active orders, and rescission procedures for wrongly labeled sites. DEFEND IP is narrower — no bond, no compensation fund, but a stricter "no significant lawful purpose" test for what qualifies as a piracy site (TorrentFreak; TechNadu).
This is a bill, not a law. As of October 2026 it has been introduced and referred to the House Judiciary Committee; it has no cosponsors. Congress has flirted with site-blocking before — remember the SOPA protests that buried similar ideas more than a decade ago — and EFF has raised due-process concerns about this bill too, centered on the fact that the initial piracy-site declaration could happen without the accused site appearing in court to defend itself (the bill says a judge "may," not "shall," appoint an independent special master to test the evidence) (cyber-security-in-plain-english.com; TechNadu).
Nothing in this story creates a new blocking duty for any VPN today. Don't switch providers because a headline scared you — judge the bill on what it would actually require if enacted.
No. It was introduced in September 2026 and sits with the House Judiciary Committee. No VPN has acquired any new federal blocking duty from this bill (cyber-security-in-plain-english.com).
The bill targets foreign piracy sites, but its definition — sites with "only limited commercially significant purpose" beyond infringement — is broader than earlier drafts. Combined with shared infrastructure, that leaves room for overblocking, which is why the bill includes correction procedures and up to $250,000 in compensation for wrongful blocks caused by the rightsholder (TorrentFreak).
That's a genuine design difference. ACPA's authors consider large VPNs effective blocking points; DEFEND IP's authors deliberately carved out services that exclusively provide VPN connections or encrypted-routing services, along with DNS providers operating only over encrypted protocols like DoH (TorrentFreak).
The bill doesn't create a logging requirement. But it does make the provider's position — as a middle point that can route or refuse traffic — legally relevant. Independently audited no-logs policies and provider jurisdiction were already the things worth checking; this bill just raises the stakes (cyber-security-in-plain-english.com).