On September 16, 2026, Representative Darrell Issa introduced the American Copyright Protection Act (H.R. 10364), a bill that would let US courts order VPN providers, internet service providers and DNS resolvers to block websites declared “foreign piracy sites”. It would be the first federal law to put VPNs on the list of companies that have to enforce site blocks. The catch that’s getting the most attention: it only covers VPNs with at least 100,000 monthly US users, which leaves free and small VPNs out of scope.

The mechanism is borrowed from site-blocking systems already running in Europe. Here’s how it would work, based on reporting by TechRadar, TorrentFreak and Tom’s Hardware.

  1. A copyright holder asks a federal court to declare a website a “foreign piracy site”.
  2. The court decides using the “preponderance of the evidence” standard, the lowest bar in US civil law.
  3. The rights holder then asks for a blocking order naming specific service providers: ISPs, DNS resolvers and, for the first time, VPNs.
  4. Before naming a provider, the court has to consider whether blocking is technically feasible and effective for that provider.
  5. Providers get 14 days to object, and blocks generally take effect within 14 to 30 days.
  6. For “time-sensitive” content like live sports, the court can speed things up when piracy appears within 24 hours of a broadcast.

The bill doesn’t tell providers how to block. It leaves the method to them. And according to Gizmodo, a site blocked by mistake could claim up to $250,000 in damages.

Which VPNs would be covered?

Only “covered services”. For VPNs, that means providers with at least 100,000 monthly users or subscribers in the United States, according to Gizmodo. Smaller providers are exempt, as are root DNS servers, top-level domain operators and public networks.

In practice, the threshold targets the big paid brands: NordVPN, ExpressVPN, Surfshark, Proton VPN, Private Internet Access, CyberGhost and a handful of others with large American customer bases. Many free VPN apps either fall under the threshold or are operated from outside the US by companies that are hard to reach with a court order.

NordVPN’s public policy lead, Laura Tyrylyte, told TechRadar that such blocking measures “primarily target reputable, paid VPN providers, leaving free VPN services largely untouched.” It’s a self-interested point, but not a wrong one. Pushing users from audited paid VPNs toward free apps with weak privacy is an odd outcome for a copyright bill.

Why VPNs were added this time

This isn’t the first US site-blocking proposal of the decade. TorrentFreak notes that a 2025 discussion draft only mentioned ISPs and DNS resolvers. The version filed in September adds VPNs explicitly, following European precedent.

That precedent is real. In France, courts have ordered VPN providers to block pirate sports streams, as we covered in our article on French court orders against VPNs. In Spain, the La Liga fight produced mass IP blocking and collateral damage, with NordVPN winning a key ruling along the way. And at EU level, a study is pushing for 30-minute takedowns during live events. Rights holders have learned that blocking at the ISP level is easy to route around with a VPN, so they now want the VPN in the chain too.

The big unanswered question: who counts as a US user?

Tom’s Hardware lists a series of scenarios the bill doesn’t clearly resolve. Does a block apply based on where the VPN server is, or where the user is? Is an American subscriber travelling in Europe a US user? What about a European who connects to a New York server? Traffic through a CDN node in the US? A Starlink user at sea?

The bill’s refusal to prescribe a method makes this worse, not better. A cautious VPN could block a listed site for all users on all servers, just to be safe. That’s how you get the “heavy-handed bans” Tom’s Hardware warns about, and it’s how a law aimed at American piracy could end up changing what a VPN user in Canada, Germany or Switzerland can reach.

What critics are saying

Opposition was quick. Meredith Rose of Public Knowledge said the bill would force providers to “disrupt traffic from targeted websites simply accused of copyright infringement”, according to TechRadar. Brandon Butler of Re:Create called it a violation of “American due process, First Amendment rights, and American ingenuity.”

The low evidentiary standard and short objection window are the main targets. A court can declare a site “foreign” and “piracy” on a preponderance of evidence, and a provider has two weeks to push back. For live sports, the window can shrink to almost nothing. Rep. Issa has been clear that speed is the point: he asked whether blocking could happen “at the speed of light.”

Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.

Where the bill stands

H.R. 10364 is a bill, not a law. As of Tom’s Hardware’s reporting, it had no co-sponsors, no scheduled hearing and no markup. Most bills introduced in Congress never get a vote. But this one has an influential sponsor (Issa is a long-time member of the House Judiciary Committee, which handles copyright) and strong backing from the film, TV and sports industries, which have pushed for US site blocking for years.

It also lands at a moment when VPNs are under pressure from several directions in the US, from Utah’s age-verification law, which took effect on September 3, to Michigan’s proposed VPN ban.

What to watch next

Three signals would tell us the bill is gaining ground. First, co-sponsors, especially from the other party, since copyright enforcement has historically drawn bipartisan support. Second, a hearing in the Judiciary Committee, where rights holders and tech companies would testify. Third, a Senate companion bill. Until at least one of those happens, H.R. 10364 is a statement of intent, and a useful look at what the entertainment industry wants from VPN providers next.

What this would mean for you as a VPN user

If the bill passed in its current form, here’s what would realistically change:

For privacy and security, nothing. Blocking a list of piracy domains doesn’t require logging what you do. VPNs already filter malware and phishing domains; this would be a court-mandated blocklist on top. The risk is if providers implement it lazily, with DNS-level blocks that leak or break things.

For legal streaming, possibly a little. Over-blocking during live events is the main risk. Sites wrongly blocked could sue, but you’d still lose access for a while.

For piracy, not much. Pirate sites would move to new domains, as they do in Europe. Users would move to free or offshore VPNs that the bill doesn’t cover.

For your choice of VPN, a real trade-off could emerge. The providers with the best privacy records would be the ones forced to block. That shouldn’t push you toward sketchy free apps: those have much bigger problems, as our free vs paid VPN comparison explains. If you need a free option, ProtonVPN’s free plan is audited and has no data cap.

We’ll keep following the bill. For now, nothing changes for US users, and nothing changes at all for users outside the US.

Our take

The American Copyright Protection Act would make the largest paid VPNs enforce court-ordered piracy blocks for US users, while exempting free and small VPNs. It's early: no co-sponsors, no hearing, no vote. But the European precedent shows these laws tend to over-block, and the bill's fuzzy definition of a "US user" could affect VPN users well beyond the US. Worth watching, not worth panicking over.