VPNs dodge a bullet — New US piracy bill targets ISPs but leaves VPNs alone

• The DEFEND IP Act is a new bicameral site-blocking bill targeting ISPs, DNS
• The bill explicitly exempts VPNs from carrying out blocking orders
• It allows copyright holders to seek court orders to block foreign platforms

Last week, privacy advocates raised alarms about a US bill that could force virtual private networks to act as piracy blocklists. Now, a newly introduced competing proposal has taken a decidedly different approach — leaving the best VPN providers completely off the hook.

Senator Thom Tillis and Representative Zoe Lofgren have jointly introduced the DEFEND IP Act (Deterring Extraterritorial Foreign Exploitation of Networks Damaging Intellectual Property). The bicameral bill merges two previous legislative drafts into a single proposal aimed at giving copyright holders the power to compel intermediaries to block foreign pirate sites.

However, Representative Darrell Issa's competing American Copyright Protection Act (ACPA) included VPNs in its scope. According to an analysis by TorrentFreak, the newly introduced DEFEND IP Act explicitly leaves them out.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

How the DEFEND IP Act spares VPNs

Under the DEFEND IP Act, court-ordered blocking would apply to broadband providers with at least 50,000 subscribers and public DNS resolvers generating over $100 million in annual revenue. This high financial threshold easily captures tech giants like Google and Cloudflare.

Yet, the proposed legislation specifically carves out an exemption for virtual private network (VPN) tools. The bill's text excludes "an entity that exclusively provides virtual private network services or similar service [sic] that encrypt and route user traffic through intermediary servers."

While the word "exclusively" leaves some room for interpretation when it comes to cybersecurity companies that bundle their VPNs with other features like antivirus software, the legislative intent to shield core VPN operations is clear.

If passed, the DEFEND IP Act would establish a two-step legal process. First, a federal court must formally classify a website as a "foreign digital piracy site." To qualify, the platform must be primarily designed for copyright infringement or intentionally marketed as a piracy destination.

Once designated, rightsholders can return to a judge to request a formal blocking order. The court would then determine if the block is "technically feasible and effective." These blocking orders would remain valid for a year, can be renewed, and apply directly to live streaming events, meaning a rogue sports broadcasting site could be blocked before a match even starts.

Digital rights advocates push back

Despite the explicit VPN exemption, digital rights groups remain staunchly opposed to the broader concept of site-blocking. Public Knowledge, an advocacy group that also opposes the competing ACPA bill, has strongly criticized the DEFEND IP Act.

"For the second time in as many weeks, rightsholders have convinced Congress to build out an expansive infrastructure for censorship rather than go after the root of the problem: operators of overseas piracy websites," Public Knowledge wrote in response to the proposal.

The group also warned of the technical consequences of the bill's DNS scope, adding: "Let us repeat: Applying blocking orders to global DNS resolvers causes global blocks."

With the current congressional term ending in January, time is running out for either proposal to become law. Both Representative Issa and Senator Tillis are leaving Congress at the end of the term, meaning neither will be around to reintroduce their respective bills next year.

For now, however, privacy-conscious internet users can breathe a sigh of relief knowing that their VPNs are excluded from this latest legislative push.