Federal bill would force VPN providers, ISPs, and DNS services to block foreign piracy sites

A week and change ago, the U.S. Congress saw yet another anti-piracy bill introduced, H.R. 10364, or by its full name, the American Copyright Protection Act of 2026 (ACPA). It would require internet service providers, DNS resolving services, and virtual private networks, or VPNs, to block foreign websites or services hosting pirated content. The full text for the bill is now public, and it stands out due to its targeting of foreign services and affecting connections "from the United States." That gets complicated pretty quick when VPNs and content delivery networks (CDNs) are in play.

In ACPA, a standard blocking order needs to be court-issued, but would apply in 14 to 30 days. There's a special case seemingly targeted at live-streaming of sports events and shows, or "time-sensitive events" in legal parlance, which can shorten the blocking deadline as a judge sees fit, so long as the first leak of copyrighted material appears within 24 hours after going live.

Blocking at the ISP and DNS level is relatively straightforward. The vast majority of users utilize their ISP's DNS, so not resolving a given domain if it's in the blocklist for its customers is simple enough. Some people, like yours truly, rely on external DNS servers like Google DNS, Cloudflare's 1.1.1.1, OpenDNS, or NextDNS. These too could ignore specific DNS resolution requests from incoming users in the States, the accuracy of geolocation notwithstanding.

Small ISPs and services with less than 100,000 monthly users and public networks are exempted, as are root DNS and top-level domain (TLD) providers. However, the bill does not specify an exact means of blockage, and it's possible that service providers, out of fear of liability, may well take a heavy-handed approach. It also makes no mention of protecting or nullifying encryption.

When it comes to people using VPNs to bounce their connection through another location, things get tricky, as the bill does not clearly state what "from the United States" means, and even the definition of "foreign" can get fuzzy. Determining those might well be an exercise in quantum superposition, since any of the below scenarios can be argued to technically fulfill a criteria. We conjured up a handful of possibilities, though we're sure creative techies can come up with many more:

1. A connection to a VPN originates from the U.S.
2. A VPN's endpoint resides in the U.S.
3. A VPN's registered subscriber is a U.S. person, but they are currently outside the U.S.
4. The user uses a VPN to a foreign country, but connects to a website that's behind a CDN — does the CDN endpoint count as a destination?
5. Same, but the actual website is on U.S. soil despite being accessed from outside; is it "foreign" if the endpoint is?
6. For multi-hop VPNs, which hop or hops count towards determining a destination, especially if the traffic passes through the U.S. at some point?
7. A U.S. citizen in a boat in international waters using Starlink (a U.S. satellite ISP) counts as foreign?
8. A U.S. citizen goes abroad and uses roaming; are they considered foreign due to their physical location, or within the U.S. because they are using stateside infrastructure?

Additional legal questions can be raised with other technological factors. The use of shared IPs in hosting services, or CGNAT implementations, can create obfuscation of the concepts of "destination" and "origin." Is a DNS provider using Oblivious DoH, where the server responds to a request but doesn't know who made it and vice versa, liable? How does Apple's iCloud Private Relay feature, which hides a connection's source and destination from each other, sit within the legal framework? And with encrypted DNS, how much is the ISP liable, since they can't see which domain the user requested?

The neutrality of third-party service providers has come under fire in jurisdictions like France and Spain, where rulings mostly went against claims of neutrality. Some were forced to often enable large-scale blocking, an action likely to trigger more than a few false positives. A Spanish court ruled against Cloudflare and RootedCON for their part in providing CDNs, resulting in mass IP blockings. Over in France, a court found that VPNs do have to comply with blocking orders despite their job as "technical intermediaries."

For what it's worth, ACPA is only one of multiple bills sitting in Congress in the "introduced" state, and currently appears to have no sponsors, scheduled hearings, or even markup. If foreign activities are any indication, though, broad legislation like this may have substantial unintended consequences.

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.