Michigan lawmakers introduced House Bill 4938, the “Anticorruption of Public Morals Act,” in September 2025. By early 2026, it had become one of the most discussed pieces of VPN legislation in the United States, not because it is likely to pass, but because of how far it goes.
The bill would effectively ban the sale and use of virtual private networks in Michigan. It would require internet service providers to deploy content filters, block circumvention tools, and monitor for VPN usage. Violations would be criminal offenses. Legal scholars, privacy advocates, and tech companies have lined up against it, but the bill has not been withdrawn.
What the bill actually says
HB 4938 targets what it calls “circumvention tools,” defined broadly enough to include VPNs, proxy servers, Tor, and any other encrypted tunneling method. The bill would make it illegal to sell, promote, or distribute such tools when used to access content prohibited under the act.
The bill’s primary goal is restricting access to adult content, including video, audio, AI-generated material, and written content with sexual themes. It also targets “any depiction or description of transgender people,” a provision that has drawn the most civil liberties scrutiny.
For ISPs, the bill would impose fines for failing to detect and block VPN usage. The practical implication is that internet providers operating in Michigan would need to implement deep packet inspection, the same technology used by China, Russia, and Iran to control internet traffic.
Why enforcement would be nearly impossible
The bill’s critics, including technology researchers, ISP lobby groups, and civil liberties organizations, have focused on three fundamental problems.
First, the technical impossibility. Modern VPNs use encryption protocols that are designed precisely to be indistinguishable from regular HTTPS traffic. WireGuard and OpenVPN in obfuscation mode produce traffic that no current DPI system can reliably identify. Building a filter that blocks this traffic would either require blocking all encrypted traffic (which would break banking, email, and most of the web) or accepting a high false-positive rate that would be legally contested immediately.
Second, the constitutional exposure. The Supreme Court has consistently held that the First Amendment protects access to information, not just expression. A law targeting tools that provide access to legal (if controversial) content in other jurisdictions would face immediate challenge. The ACLU of Michigan said it would file for an injunction the same week the bill passed, if it ever did.
Third, the jurisdictional reality. Most major VPN providers, including NordVPN, ProtonVPN, and Mullvad, are incorporated outside the United States. Michigan cannot criminalize companies operating in Panama, Switzerland, or Sweden. Users would simply download their VPN apps from non-US sources.
Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.
ProtonVPN’s response
ProtonVPN CEO Andy Yen published a detailed response to the Michigan bill, calling it “a danger to political discourse.” He specifically argued that the bill’s broad language around “circumvention tools” would make it illegal to use encrypted email, corporate remote access systems, and privacy browsers, not just consumer VPN apps.
Yen framed the bill as part of a global trend in which age-verification legislation is being used as a vehicle for surveillance infrastructure. “Once you build a system capable of detecting and blocking VPNs,” he wrote, “you have built a system that can be used for political censorship. The tools are the same.”
The cadre.net tech blog noted that the bill’s sponsor, in public statements, appeared to conflate VPNs with proxy servers and seemed unaware that major VPN providers are foreign companies. “The bill is a danger,” the analysis concluded, “but primarily to the technical knowledge of the committee that wrote it.”
Current status
As of June 2026, HB 4938 remains in committee. It has not advanced to a floor vote in either the Michigan House or Senate. Multiple Republican committee members have expressed reservations about the ISP liability provisions, and several technology companies have formally submitted opposition testimony.
A prediction market on Manifold Markets currently assigns a 7% probability to the bill passing with its VPN ban provisions intact before the end of the 2025-2026 legislative term. That is not zero, but it signals near-consensus among observers that the bill will either die in committee, be substantially amended before passing, or face immediate judicial block if enacted.
What this means for VPN users in Michigan
Nothing changes today. VPNs remain fully legal in Michigan and across the United States. Even if HB 4938 passed tomorrow, enforcement against individual users would require ISP-level monitoring that does not currently exist and would face injunctions before implementation.
The bill matters as a signal, not as immediate practical threat. It reflects a legislative trend in which VPN blocking is being normalized as a concept in Western democracies, starting with age-verification contexts and potentially expanding. Privacy advocates are right to take it seriously as a precedent, even if the specific Michigan bill is unlikely to survive legal scrutiny.
Michigan HB 4938 is the most aggressive anti-VPN legislation proposed in the US to date. It is also almost certainly unconstitutional, technically unenforceable, and politically underwater. But its existence matters: it normalizes the idea of legislating against VPN tools in ways that more carefully drafted bills might eventually achieve.
Keep reading: Is a VPN Legal? Country-by-Country Guide for 2026 and UK Votes to Ban VPNs for Minors as Social Media Crackdown Expands.