A Republican site-blocking bill is doing something US copyright fights usually avoid: naming virtual private networks in the operative text.

US Bill Would Force VPNs to Block Piracy Sites. Here’s Why That’s a Bigger Deal Than It Sounds.

Rep. Darrell Issa (R-Calif.) introduced H.R. 10364, circulating as the American Copyright Protection Act of 2026. The measure would let copyright holders ask federal courts to declare a website a “foreign piracy site,” then obtain blocking orders served on broadband providers, DNS resolvers, and VPN services with at least 100,000 monthly users or subscribers in the United States.

That last clause is why r/Piracy and r/law lit up, and why the short version on X is blunt: they want you to pay for media even through a tunnel.

Site blocking is not new. Europe has been doing versions of it for years. What is new for Washington is treating the VPN as just another pipe that can be ordered shut.

What the bill actually does

Issa chairs the House Judiciary subcommittee that covers courts, intellectual property, AI, and the internet. At a June 30 hearing he framed the problem as speed. He asked whether blocking could happen “at the speed of sound” or “at the speed of light,” especially for live sports and day-of-release leaks.

The circulating text, which Public Knowledge shared with reporters after the official file was slow to appear on Congress.gov, builds a two-step process.

Step 1: Declare the target.
A copyright owner petitions a court. The judge decides, on a preponderance of the evidence, that an online location is a foreign site primarily designed for piracy.

Step 2: Serve the pipes.
With that declaration in hand, the owner seeks a separate order requiring covered “service providers” to take commercially reasonable steps to stop US users from reaching the site.

Covered providers, as written, include:

Broadband internet access services (your ISP)
Domain name resolution services (public and private DNS)
Virtual private networks above the 100,000 US-user threshold

Explicitly excluded:

Root nameserver operators
Top-level domain registries
Premises Wi-Fi at airports, libraries, restaurants, retail stores, and similar spots

Providers would generally have about 14 days to object. Judges could shrink that window for time-sensitive material, including pirated live sports and content posted within 24 hours of official release. Once an order lands, the reported compliance window is in the 14-to-30-day range, with an obligation to block access “from the United States.”

This is not a criminal ban on using a VPN. It is a civil, court-driven duty on large VPN companies that serve the US market.

Why VPNs were added

Earlier discussion drafts talked about ISPs and DNS resolvers. The version that surfaced last week puts “virtual private networks” in the definition of service provider. TorrentFreak noted that the VPN category did not appear in the 2025 draft language it reviewed.

The political logic is obvious. If you only block at the ISP and at popular DNS resolvers, a user switches to a commercial VPN and the block evaporates. European courts in France, Spain, and Italy have already pulled VPNs and public DNS into blocking regimes for that reason. Italy’s Piracy Shield even fined Cloudflare over its 1.1.1.1 resolver. The US bill is catching up to that model.

Rightsholders argue foreign pirate sites sit outside easy US jurisdiction. Critics hear SOPA. The 2012 bills died after a revolt over DNS blocking. In 2026 the Supreme Court, in Cox Communications v. Sony Music Entertainment, also refused to make ISPs liable merely because some customers infringe. Site-blocking bills try for the same result through a new court procedure. FADPA and Block BEARD drafts are on a separate track. Issa’s text is the one that named VPNs out loud.

Why Reddit and X treated it as “site-blocking 2.0”

Privacy and piracy communities do not agree on much. They agreed this week that putting VPNs on a blocking roster changes the product.

A consumer VPN sells three promises:

Your ISP cannot see the destinations you visit.
The destination site sees the VPN’s address, not yours.
Geographic and network blocks can be walked around.

Order the VPN itself to refuse certain destinations and promise number three is no longer a feature. It becomes a compliance checkbox. The tunnel still hides you from the ISP. It no longer hides the destination from the VPN operator’s blocklist.

That is the “pay for media even through a tunnel” line. It is not a legal analysis. It is a product analysis. People buy VPNs for streaming libraries, travel, censorship, workplace nosiness, and, yes, pirate sites. A statute that forces the large US-facing brands to honor Hollywood block lists splits that market.

If anything like this became law, large US-market VPNs would ship blocklists. Smaller or offshore services under the 100,000-user line would market themselves as unblocked until they grew or Congress lowered the threshold. Technical users would move to self-hosted WireGuard and resolvers outside the order. That is what happened in the UK and parts of the EU. Blocking became a speed bump, not a wall.

None of that requires endorsing piracy. It is how networks behave when you push enforcement to the middleboxes.

The overblocking problem is not theoretical

DNS and IP blocks are blunt.

A pirate site often shares:

A CDN anycast address with legitimate customers
A cloud IP that rotates hourly
A domain that later gets recycled
A nameserver used by unrelated sites

Italy’s Piracy Shield has already produced documented collateral damage, including a multi-hour Google Drive outage after an IP was swept into a sports block. A single US court order against a global DNS resolver can have side effects far outside the United States.

Issa’s text nods at overblocking with designated judges and a public list of orders. That is better than an automated sports dashboard with no hearing. It is still a preponderance standard, often against a foreign site that will not appear. Default judgments against empty chairs are how blocking lists grow. A 14-day objection window is thin if you run a global resolver or a VPN with millions of configs. For live sports, the window shrinks further. Speed is the feature. Process is the cost.

Who would have to comply

The 100,000 monthly US users test is the hinge.

Most household names clear it without trying. A privacy-purist service that refuses to count US users, or a tiny boutique VPN, might sit outside the duty until it succeeds. That creates a perverse incentive: stay small, stay offshore, or stop advertising to Americans.

Root servers and TLD registries were carved out for a reason. Breaking .com resolution or the DNS root to punish a pirate forum is the 2012 nightmare scenario. Premises Wi-Fi was carved out so a coffee shop is not treated like Comcast. Those carve-outs are sensible. They also show the bill’s authors know blocking can hit the wrong layer of the stack.

What the bill does not do:

It does not criminalize installing a VPN.
It does not, as written, require VPNs to log customers.
It does not automatically apply to every obfuscated or self-hosted tunnel.
It does not guarantee that a block will work.

What it does do is convert the largest commercial VPNs into enforcement partners for a specific class of copyright claims.

How this fits a wider 2026 pattern

This is not happening in a vacuum.

Utah’s SB 73 tried to keep age-verification duties in force even when a user masked location with a VPN, then hit an enforcement freeze.
UK and EU officials have described VPNs as a “technical problem” for age gates and pirate streams.
Italy, France, and Spain already issue blocking orders that reach resolvers and, in some cases, VPN apps.

The US version arrives after a decade of streaming fragmentation. Live sports leaked onto pirate streams while official apps multiplied and prices rose. Rightsholders want a fast button. Users who already pay for three services and still miss a game see a different villain. Both can be true. Pirate sites are a commercial injury. DNS and VPN blocking is also an infrastructure risk. Pretending only one sentence matters is how you get SOPA-style blowups.

What to watch next

H.R. 10364 was referred to the House Judiciary Committee. Introduction is not passage. Most bills die in committee. This one has a chair as sponsor, entertainment-industry support, and a live-sports lobby that wants same-day relief. That combination gets hearings.

Watch four markers:

Committee markup. If the VPN clause survives the first amendment fight, it is intentional, not a drafting accident.
The 100,000-user number. Lobbyists will try to move it down (catch more VPNs) or up (spare mid-size privacy brands).
Safe harbors for overblocking. Infrastructure groups will demand damages or automatic delisting when a block hits a legitimate service.
State copycats. Even a failed federal bill becomes a template. Utah already proved states will write VPN language of their own.

If you run a VPN, the homework is ugly but clear: know your US monthly active count, know which servers are US-facing, and decide whether you will build a court-order pipeline or shrink the US product.

If you use a VPN, the near-term change is zero. No order exists. No app update is required this week. The medium-term change is cultural. The era of assuming a commercial VPN is a neutral pipe is ending in statute books, even when the statutes fail.

The honest bottom line

Issa’s bill is site blocking with extra hops. Courts declare a foreign pirate site. ISPs, DNS companies, and large VPNs are told to get in the way. The legal standard is preponderance, the timeline is built for kickoff, and the political argument is that tunnels should not be a copyright-free zone.

Whether that is good policy depends on what you think a VPN is.

If a VPN is just another access provider that happens to encrypt the last mile, putting it on the same list as an ISP is consistent. If a VPN is a privacy tool whose value is not inspecting or refusing destinations, the bill asks the company to stop being that tool for a growing list of URLs.

Reddit called it site-blocking 2.0 because version 1.0 stopped at the ISP. Version 2.0 follows the user into the tunnel. That is the whole fight. Everything else is legislative furniture.