Executive Overview
The debate over online piracy and digital intermediary liability in the United States has entered a volatile new phase. Last week, Representative Darrell Issa formally introduced the American Copyright Protection Act (H.R. 10364), a sweeping legislative proposal designed to empower rightsholders with a robust judicial framework for compelling internet service providers, domain name resolution systems, and—crucially—Virtual Private Network (VPN) providers to block access to designated "foreign piracy sites."
While earlier discussion drafts of the legislation targeted traditional broadband providers and DNS operators, the final statutory text surfaced online via digital rights advocacy group Public Knowledge and Ars Technica, revealing a significant expansion in scope. Under the current parameters of the bill, major VPN services boasting upwards of 100,000 monthly active users or subscribers in the United States could soon find themselves legally obligated to implement systemic blocks against targeted platforms.
This legislative maneuver marks a watershed moment in American copyright enforcement, bridging a long-standing gap between U.S. policy and aggressive European enforcement models seen in jurisdictions like France and Spain. However, the bill introduces profound technical ambiguities. Most notably, H.R. 10364 mandates that covered intermediaries take "all commercially reasonable steps" to prevent users from accessing targeted foreign piracy sites "from the United States," yet it leaves the precise engineering and architectural implementation entirely undefined.
As lawmakers wrestle with the ghosts of past failures—such as the infamous 2012 Stop Online Piracy Act (SOPA) battles—Rep. Issa’s parting legislative push faces both an uncertain clock and emerging bicameral competition on Capitol Hill. With Representative Issa set to retire at the end of the current congressional session, the American Copyright Protection Act represents a high-stakes, last-ditch effort to reshape the architecture of the American internet.
Detailed Chronology: From Discussion Drafts to H.R. 10364
The trajectory of the American Copyright Protection Act reflects a calculated, iterative refinement by its congressional sponsors, shifting from a narrow ISP-centric focus to an all-encompassing intermediary net.
The June Discussion Draft: A Narrower Scope
When initial details regarding Rep. Issa’s anti-piracy framework first emerged in mid-2024 through industry previews and legislative discussion drafts, the proposed remedies were comparatively conventional. Designed to offer copyright holders an alternative path around traditional, protracted litigation, the early blueprint focused overwhelmingly on the foundational infrastructure of the internet:
- Broadband Internet Access Providers (ISPs): Entities delivering raw connectivity to consumer endpoints.
- Domain Name System (DNS) Resolvers: Services translating human-readable web addresses into machine-readable IP addresses.
At this juncture, privacy-centric intermediaries such as VPN providers were notably absent from the statutory text. Civil liberties advocates assumed that the legislative framework would maintain a strict demarcation between plain-text network operators and encrypted tunneling services, recognizing the unique encryption and privacy architectures inherent to commercial VPN infrastructure.
The Unveiling of H.R. 10364
The formal filing of H.R. 10364 in September transformed the landscape. Although the text was initially shielded from immediate public inspection upon its introduction, leaks facilitated by public interest organizations revealed that the definition of a "service provider" had been substantially broadened.
The finalized statutory language explicitly incorporates VPN providers into the enforcement mechanism, placing them alongside traditional ISPs and DNS resolvers. Root nameserver operators and top-level domain (TLD) registries remain explicitly excluded from the mandate, but the inclusion of commercial VPNs signals a legislative consensus that modern anti-piracy enforcement cannot effectively bypass encrypted network conduits if it hopes to stem sophisticated illicit streaming and downloading networks.
Following the initial leak, the formal text of H.R. 10364 was officially posted to Congress.gov, allowing legal scholars, privacy advocates, and technical architects to dissect the mechanics of the proposed law.
Technical & Legal Architecture: How the ACPA Operates
The operational mechanics of the American Copyright Protection Act establish a clear, albeit controversial, pathway for rightsholders seeking to neuter what they define as "foreign piracy sites."
[Rightsholder]
│
▼ (Petitions Federal Court)
[Federal Court Review] ──(Weighs Technical Feasibility)──► [Declares "Foreign Piracy Site"]
│
▼ (Issues Blocking Order)
[Intermediary Providers: ISPs, DNS Resolvers, VPNs (>100k US Users)]
│
▼ (14-30 Day Compliance Window / Fast-Track for Live Events)
[Implementation of Blocks "From the United States"]1. The Judicial Threshold
Under the statutory framework, a copyright holder must first petition a federal court and secure a formal judicial determination that a specific domain or online platform qualifies as a "foreign piracy site." Once this declaration is secured, the petitioner can request a targeted blocking order directed at specific service providers.
2. Defining the Intermediary Net
The bill draws a firm line based on scale, exempting smaller boutique operations to prevent undue regulatory burdens on startups and niche technological services. The statutory definition explicitly excludes:
- Any entity providing services to fewer than 100,000 monthly users or subscribers within the United States.
Conversely, major domestic and international VPN providers boasting large American customer bases fall squarely within the crosshairs of the mandate.
3. The Compliance Mandate and Ambiguity
Once a blocking order is finalized, covered providers are granted a compliance window typically ranging from 14 to 30 days. During this period, the provider must execute "all commercially reasonable steps to prevent users or subscribers from using its systems or networks to access the foreign piracy site from the United States."
This requirement introduces a major technical quandary for VPN operators. Because a commercial VPN routes traffic through global server arrays spanning dozens of jurisdictions, the phrase "from the United States" can be interpreted in fundamentally different ways:
- Server-Specific Blocking: A VPN provider could configure its U.S.-based servers to block the targeted domain while leaving its international servers untouched. Under this interpretation, an American subscriber connected through an Amsterdam or Toronto server could still access the site, whereas a Canadian user routing their traffic through a New York server would be blocked.
- IP-Address-Based Blocking: Alternatively, a provider could block access for any user authenticating from an American IP address, regardless of which global server they select. While technically viable without necessarily requiring the logging of individual user browsing activity, this approach imposes broader architectural modifications on the VPN’s global routing logic.
Crucially, the statute explicitly prohibits judges from prescribing or requiring specific technical methods of compliance. The choice of implementation is left entirely to the discretion of the provider, shielding the courts from engineering decisions but leaving VPN operators vulnerable to legal liability if their chosen method is deemed legally insufficient by rightsholders.
4. Fast-Track Injunctions for Live Sports and Leaks
Recognizing the economic realities of modern digital distribution, H.R. 10364 includes an expedited mechanism for time-sensitive material. Federal courts possess the authority to shorten statutory compliance deadlines upon a showing of good cause.
This fast-track enforcement is specifically tailored to combat the unauthorized streaming of live sports broadcasts—events whose commercial value evaporates rapidly once the match concludes. Furthermore, the time-sensitive carveout applies to motion pictures and television programs leaked online within 24 hours of their initial authorized release in the United States.
Supporting Context, Metrics, and Global Precedents
The inclusion of VPN providers in U.S. site-blocking legislation does not occur in a vacuum. It mirrors a broader, aggressive international trend wherein rightsholders and courts across Western democracies have sought to compel encrypted network intermediaries to assist in copyright enforcement.
The European Blueprint: France and Spain
For years, U.S. policymakers looked to European jurisprudence with a mixture of admiration and caution. However, recent rulings in countries like France and Spain have directly influenced American legislative drafting.
- French Jurisprudence: Courts in Paris have repeatedly ordered popular commercial VPN providers to block designated pirate sites, aggressively dismissing arguments that strict "no-log" privacy policies render such technical blocks impossible. French courts have maintained that privacy architectures do not grant immunity from intermediary liability mandates.
- Spanish Precedents: Similarly, Spanish courts have issued landmark injunctions ordering major providers like ProtonVPN and NordVPN to block access to unauthorized football streaming domains, setting a legal precedent that transnational VPNs operating within national borders must comply with domestic intellectual property protection orders.
The Scale of the American VPN Market
While precise market penetration metrics fluctuate, industry analyses suggest that tens of millions of American consumers utilize commercial VPN services for privacy, security, and geo-spoofing purposes. By setting the statutory threshold at 100,000 monthly U.S. users, the American Copyright Protection Act deliberately captures virtually all major commercial players—including industry heavyweights like NordVPN, ExpressVPN, Surfshark, and Proton—while sparing small-scale open-source or enterprise tunneling tools.
Official Statements and Industry Reactions
The introduction of H.R. 10364 has sharply polarized digital rights advocates, technology coalitions, and intellectual property conglomerates.
Civil Liberties and Consumer Advocacy Opposition
Digital rights organizations have mobilized rapidly against the bill, warning that the inclusion of VPNs fundamentally undermines digital security and user privacy.
- Public Knowledge: The advocacy group, which helped bring the full statutory text to light, has argued that forcing VPNs to implement state-level filtering creates dangerous architectural precedents that could be weaponized beyond copyright enforcement, paving the way for broader censorship and surveillance creep.
- Re:Create Coalition: In formal opposition statements, Re:Create underscored that the ACPA threatens the open internet by deputizing private infrastructure providers to act as content police, warning of severe collateral damage to legitimate web traffic and user privacy rights.
Rightsholders and Entertainment Conglomerates
Conversely, traditional entertainment and sports broadcasting lobbies have championed the legislative push. Representatives from the Motion Picture Association (MPA) and major sports leagues have emphasized that modern piracy operations rely heavily on encrypted tunnels and rapid domain-hopping to evade traditional ISP-level DNS blocks.
While major rightsholder organizations adopted a measured public posture immediately following the bill’s introduction—waiting for Rep. Issa’s office to release its comprehensive press packages—their private lobbying efforts have consistently pushed for intermediaries of all stripes to be held accountable for facilitating access to infringing material.
Future Outlook: Legislative Hurdles and Bicameral Competition
As the American Copyright Protection Act of 2026 makes its way through the legislative machinery of the 119th Congress, its ultimate fate remains fraught with uncertainty.
The Retirement Clock
The most pressing obstacle facing H.R. 10364 is political timing. Representative Darrell Issa is set to retire at the conclusion of the current congressional term. If the bill fails to secure passage before the gavel drops on the current session, it will die in committee, requiring an entirely new sponsor to champion the text in subsequent congresses—a notoriously difficult feat for sprawling, controversial tech legislation.
Bicameral Competition on Capitol Hill
Compounding the legislative friction is internal competition within Congress itself. H.R. 10364 is not the sole anti-piracy site-blocking vehicle under development. Legislative efforts led by Senator Thom Tillis and Representative Zoe Lofgren are concurrently advancing a separate, unified bicameral site-blocking bill designed to forge a broader consensus across both chambers.
This dynamic evokes memories of the fractured legislative battles of the SOPA/PIPA era, where competing bills, intense industry lobbying, and fierce civil liberties pushback ultimately gridlocked congressional efforts. However, unlike the broad internet-wide uprisings of 2012, today’s legislative environment is characterized by targeted, surgical provisions aimed at high-traffic intermediaries and live-sports streaming networks.
Conclusion
The American Copyright Protection Act represents a bold, aggressive attempt to modernize U.S. copyright enforcement for an era defined by encryption, VPNs, and real-time digital streaming. By dragging commercial VPN providers into the statutory enforcement net, Rep. Issa has drawn a definitive line in the sand regarding intermediary responsibility.
Whether this legislation can navigate the treacherous waters of congressional timing, technical ambiguity, and fierce civil liberties opposition remains to be seen. What is certain, however, is that H.R. 10364 has permanently elevated the stakes in the ongoing war over the architecture of the modern internet.
