‘VPNs at Risk’: Tech Coalition Pushes Back on Piracy Blocking Duties for VPNs
When Rep. Darrell Issa introduced his site blocking bill last month, VPN providers made the list.
The American Copyright Protection Act (ACPA) would allow courts to order ISPs, DNS resolvers, and VPNs to block foreign pirate sites.
The competing DEFEND IP Act, introduced days later by Rep. Zoe Lofgren and Sen. Thom Tillis, does the opposite. It explicitly excludes services that only offer VPNs.
The VPN industry has a voice in U.S. blocking debates through the Internet Infrastructure Coalition (i2Coalition). In addition to representing companies such as Amazon, Cloudflare, and Google, the group runs a VPN Trust Initiative, with ExpressVPN, NordVPN, and Surfshark as founding members.
The coalition has been relatively quiet in recent site blocking discussions, but today, on Global Encryption Day, i2Coalition published a report titled “VPNs at Risk.”
Like last year’s DNS at Risk report, it warns against turning neutral infrastructure into a copyright enforcement tool.
From Pirate Sites to VPNs
Copyright enforcement is one of the reasons governments consider regulating VPNs, the report notes. VPNs can be used to bypass blocking measures and may make it harder for rightsholders to identify infringers or enforce geographic licensing restrictions.
France has been one of the prime examples of this type of regulation, i2Coalition notes. In May 2025, a Paris court ordered NordVPN, CyberGhost, Surfshark, ExpressVPN, and Proton VPN to block 203 pirate sports streaming domains at the request of Canal+.
“These cases, brought by rightsholders before French courts, illustrate how obligations imposed at one layer of the Internet can migrate to another when users find alternative technical paths around court-ordered restrictions,” the report notes.
That raises a broader question.
According to the report, the issue is not just which intermediaries can be ordered to block, but whether these measures actually reduce piracy, and what side effects they have for lawful users.
The French legal battle isn’t over either.
The report describes the decisions as “currently pending appeal,” but it doesn’t mention the latest twists. On September 30, the Paris Court of Appeal put an appeal by NordVPN, Proton, and CyberGhost against a similar order, obtained by football league LFP, on hold. It will first wait for a ruling from France’s Supreme Court, the Cour de cassation, in related DNS blocking cases.
A week later, the Paris court refused beIN’s request for daily penalties against VPN providers and Cloudflare, which had not fully blocked the targeted sites.
i2Coalition is aware of these developments but will keep the report text as is.
“We’re following those proceedings, including the pending Cour de cassation outcome. We’re keeping the text for this release, but those developments will inform future updates. They don’t change our broader concern about the implications of extending blocking obligations to VPN providers,” Executive Director Christian Dawson tells us.
Target the Right Layer
The report doesn’t ask for a VPN exemption from any and all regulation. Instead, it urges lawmakers to be precise, and to take measures where they make the most sense.
“Policymakers should consider where meaningful knowledge and control actually reside and whether an obligation can be directed toward the relevant conduct or service before moving deeper into general-purpose Internet infrastructure. The further an intervention moves from the activity being regulated, the greater the need to consider its effects on unrelated users and services,” the report reads.
Targeting the right layer is particularly important when it comes to VPNs. Consumer VPN services and corporate networks rely on many of the same underlying technologies, including protocols such as OpenVPN and WireGuard.
The report notes that Russia’s reported blocking of these VPN protocols shows how hard it is to tell the different uses apart at the network level.
When it comes to liability, i2Coalition points to the U.S. Supreme Court’s Cox ruling from earlier this year. This ruling confirmed that continuing to provide an Internet service, while knowing that some customers may misuse it, isn’t enough on its own to establish contributory copyright infringement.
The group sees the principles from this ruling as relevant to VPNs as well, but it doesn’t claim the matter is settled.
“If providers face liability merely because general-purpose services can be misused, they may have strong incentives to terminate users, restrict access, or intervene preemptively even when they have limited knowledge of the underlying conduct. Obligations should therefore reflect what an intermediary can reasonably know, control, and address,” the report warns.
“We see those principles as relevant to the debate around VPNs, but we aren’t suggesting that the ruling automatically determines the outcome of every VPN case. That would depend on the facts and legal issues presented,” Dawson notes.
VPN providers are not completely without responsibilities. According to the report, they can strengthen trust through independent audits and cooperation with legitimate legal processes. Voluntary programs, such as the VPN Trust Initiative’s own Trust Seal, can complement these efforts.
Lawmakers, in turn, should involve VPN providers and other technical experts from the start when they want to tackle a problem.
Silent on U.S. Bills
The report doesn’t apply these recommendations to the pending site blocking bills, as neither ACPA nor DEFEND IP is mentioned.
That’s notable, as ACPA would allow courts to name VPN providers with 100,000 or more monthly U.S. users or subscribers in a blocking order. That’s a position VPN companies would rather not be in.
TorrentFreak asked i2Coalition why the report doesn’t mention the two bills. Dawson says that the group is following both proposals, but that this particular report focuses on other developments.
“For this edition, we’ve focused on the developments covered in the report rather than trying to capture every pending legislative proposal. We expect to revisit US legislation in a future update as the debate develops,” Dawson says.
For now, both bills remain pending. Issa retires at the end of the year and Tillis’s term ends in January, so both bills would have to move ahead before the current session closes.
—
A copy of i2Coalition’s “VPNs at Risk” report is available here (pdf).
From: TF, for the latest news on copyright battles, piracy and more.