Build1 publisher3 min readPublished
H.R. 10364 would make VPNs and DNS resolvers block foreign piracy sites within 14 to 30 days
H.R. 10364 would require ISPs, VPNs and DNS resolvers to block foreign piracy sites within 14 to 30 days of a court order. The text leaves "from the United States" and the blocking method undefined, so each provider would pick its own test, and shared CDN addresses make any IP block spill onto other sites.
The Engineer · Build desk
What happened
- H.R. 10364, the American Copyright Protection Act of 2026, would require ISPs, DNS resolving services and VPNs to block foreign sites hosting pirated content.
- Blocking orders must come from a court and, on the standard track, would take effect 14 to 30 days after they are issued.
- For time-sensitive events such as live sports, a judge can shorten the deadline if the first leak appears within 24 hours of the event going live.
- Services with fewer than 100,000 monthly users, public networks, and root DNS and top-level domain operators are exempt.
- Tom's Hardware reports the bill is still at the introduced stage, with no sponsors, scheduled hearings or markup.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- decision A VPN operator would have to choose which U.S.-link test to enforce. Under liability pressure the safe choice is to enforce all of them at once, and that blocks more users than any single reading requires.
- exposure Sites that share a CDN or hosting address with a named service could become unreachable from the U.S. if providers enforce at the IP layer, the outcome Spain's CDN ruling produced.
- constraint To comply with a location-scoped order, an Oblivious DoH resolver or a relay service would have to start collecting the requester location its design exists to discard.
For an ISP, compliance is a lookup. Most users resolve names through their ISP's DNS, so the ISP can stop answering for listed domains on its own customer lines [7]. A public resolver has no customer line to key on. Google DNS, Cloudflare's 1.1.1.1, OpenDNS and NextDNS would have to drop queries from requesters in the States, and they would decide who is in the States by geolocating an IP address. IP geolocation is not exact [8]. Shared hosting IPs and carrier-grade NAT already blur which address is the origin and which is the destination [14].
The location test comes from the bill's scope: foreign services, reached by connections "from the United States" [5]. Tom's Hardware reports that the text does not clearly define that phrase, and that "foreign" is loose too [9]. For a VPN operator, each reading is a separate code path. A session might count because it starts in the U.S., because it exits from a U.S. endpoint, or because the account holder is a U.S. person who is abroad [10]. Multi-hop products add the question of which hop decides, especially when one leg crosses the U.S. [10]. The first reading needs the client's source address. The second needs only the provider's own server inventory. The third needs account data tied to a live session, and a minimal-logging VPN may not keep that [10].
The bill does not say how to block [11]. Tom's Hardware expects providers that fear liability to take a heavy-handed approach [12].
CDNs make a clean block harder. When a user on a foreign VPN reaches a site through a CDN, it is unclear whether the CDN endpoint counts as the destination. It is also unclear whether a site hosted on U.S. soil becomes "foreign" because its endpoint is abroad [13]. A DNS block acts on a name. An IP block acts on an address, and on shared hosting that address serves other sites as well [14]. Spain shows the result. A Spanish court ruled against Cloudflare and RootedCON for their part in providing CDNs, and mass IP blocking followed [19]. In France, a court held that VPNs must obey blocking orders even though they work as "technical intermediaries" [20].
The bill does not mention encryption, either to protect it or to override it [15]. With encrypted DNS to a third party, the ISP cannot see the domain it has been told to block [16]. An Oblivious DoH resolver answers a query without knowing who sent it [17]. iCloud Private Relay hides a connection's source and destination from each other [18]. I think the last two are the hardest cases in the bill. Both separate who is asking from what is being asked, so no single operator holds both facts. An order scoped to connections "from the United States" needs both at one point [5].
The calendar is the one part of ACPA an engineer could implement from the text alone. A 14-to-30-day window [3] is long enough to ship a blocklist change in a normal release. The live-event track, where a judge sets the deadline [4], is where a provider would need a push path outside that cycle. The 100,000-monthly-user exemption [6] adds a smaller burden. A VPN that keeps little account data still has to count monthly users to know which side of the line it sits on.
What to watch
- A sponsor, hearing or markup for H.R. 10364 would move it past the introduced stage.
- An amended text that defines "from the United States" or names a required blocking method would settle which code path VPNs and resolvers have to build.
- Any carve-out or explicit duty for encrypted DNS, Oblivious DoH or relay services such as iCloud Private Relay.