BuildNot yet confirmed elsewhere1 publisher3 min readPublished
Two site-blocking bills in Congress split over whether VPNs can be ordered to block
Rep. Darrell Issa's ACPA would let courts order VPNs with 100,000 or more US users to block foreign pirate sites, a class the rival DEFEND IP Act excludes. Whichever text advances will decide whether VPNs and smaller DNS resolvers can be ordered to block alongside broadband ISPs.
The Engineer · Build desk
What happened
- Issa's ACPA and the DEFEND IP Act, led by Reps. Zoe Lofgren and Ben Cline with four Senate co-leads, were introduced within ten days of each other last month.
- DEFEND IP reaches public DNS resolvers only above $100 million in annual revenue and leaves out DNS services that run exclusively over encrypted protocols such as DoH.
- The ACPA discussion draft had exempted any ISP with 1% or less of the US broadband market, which left out nearly every provider under 1.2 million customers.
- The ACPA would let a site be blocked if it has only limited commercially significant use beyond infringement, where DEFEND IP requires none, a lower bar by TorrentFreak's account.
Why it matters
- exposure Under the ACPA, a VPN with 100,000 US users would have to choose and run its own blocking method whenever a court names it, a duty DEFEND IP keeps off single-purpose VPNs.
- cost Regional ISPs with 50,000 to 99,999 subscribers carry blocking orders only if DEFEND IP passes, so the bill that spares VPNs puts the compliance work on smaller broadband networks.
- decision Under DEFEND IP, a resolver operator's exposure follows choices it controls: serving only encrypted DNS, or staying at or under $100 million in revenue, keeps it outside the definition.
Both texts send orders through federal courts, reach only foreign sites and leave the technical blocking method to the provider that receives the order [4]. A named operator chooses the method and implements it [4]. Who can be named is set by each bill's definition of 'service provider' [6][10].
Issa's text uses one list and one number. Section 1601(6)(B) of H.R. 10364 says the term "includes providers of broadband internet access services, providers of domain name resolution services, and virtual private networks, but excludes root nameserver operators and top level domain registries" [6]. Subsection (C)(i) removes any entity serving "fewer than 100,000 monthly users or subscribers in the United States" [7]. An ISP, a resolver and a VPN all face the same floor [5].
H.R. 10575 tests each service type separately. Broadband providers are covered from 50,000 subscribers [8]. Resolvers are tested on revenue [9]. Section 502A(a)(6)(B) then excludes an entity that "exclusively provides virtual private network services or similar service that encrypt and route user traffic through intermediary servers" [10].
Run one operator of each kind through both texts and the exposure moves in opposite directions. A regional ISP with 50,000 to 99,999 subscribers is exempt under the ACPA and covered under DEFEND IP [16]. A free public resolver with 100,000 US users and revenue of $100 million or less is covered under the ACPA and outside DEFEND IP [18]. A VPN with 100,000 US users splits the same way as that resolver, and TorrentFreak calls the VPN treatment the clearest difference between the two bills [11].
The word "exclusively" sets the edge of both DEFEND IP carve-outs [10]. In our view, they protect single-purpose services only. An ISP that also sells a VPN product stays covered as a broadband provider. A resolver above the revenue line that answers unencrypted queries as well as DoH does not get the encrypted-DNS exclusion [19]. We think that is a defensible drafting choice. It keeps the carve-out from becoming a loophole for any large operator that bolts an encrypted product onto a covered one.
The ACPA's single count is simpler to read and harder to apply. The quoted exclusion clause does not say how a resolver or VPN would establish its number of monthly US users [7]. For a broadband provider, subscribers are a billing record. For a free resolver, the user count is a figure the operator would have to build before it knew whether it was in scope.
The ACPA also got wider on its way to introduction. TorrentFreak reports the introduced bill dropped the draft's market-share exemption and added smaller ISPs and VPNs as blocking intermediaries [13]. Against the draft's effective cutoff of about 1.2 million customers, the 100,000 floor is one twelfth the size [17].
What to watch
- Whether markup of H.R. 10364 keeps VPNs and the single 100,000-user floor, or moves toward DEFEND IP's separate tests for each service type.
- Whether either bill spells out how a resolver or VPN counts monthly US users, the figure that sets ACPA coverage.
- Whether DEFEND IP's VPN and encrypted-DNS exclusions, and their 'exclusively' wording, survive as the House and Senate versions move.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption
- Insufficient
- Hype gap0
- Incentives
- Insufficient
- Confidence66
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Two pirate site-blocking bills, the ACPA from Rep. Darrell Issa and the DEFEND IP Act from Reps. Zoe Lofgren and Ben Cline, with Senators Thom Tillis, Chris Coons, Marsha Blackburn and Adam Schiff leading in the Senate, were introduced in Congress within ten days of each other last month.
- [2]
The ACPA, introduced by Rep. Darrell Issa, would allow courts to order ISPs, DNS resolvers, and VPNs to block foreign pirate sites.
- [3]
The DEFEND IP Act merges Lofgren's FADPA and the Senate's Block BEARD proposal into one bill.
- [4]
Both bills use federal courts to target foreign pirate sites only, and both leave the technical blocking measures up to the providers.
- [5]
Under the ACPA, any broadband provider, DNS resolver, or VPN with 100,000 or more monthly users or subscribers in the United States can be named in a blocking order; smaller services are exempt, as are root nameservers and top-level domain registries.
- [6]
ACPA (H.R. 10364) section 1601(6)(B): the term 'service provider' "includes providers of broadband internet access services, providers of domain name resolution services, and virtual private networks, but excludes root nameserver operators and top level domain registries."
- [7]
ACPA section 1601(6)(C)(i): the term 'service provider' excludes "any entity that provides services to fewer than 100,000 monthly users or subscribers in the United States."
- [8]
The DEFEND IP Act (H.R. 10575) defines a broadband provider as one that provides broadband internet access service to not fewer than 50,000 subscribers.
- [9]
Under the DEFEND IP Act, DNS resolvers only qualify as service providers if they are public and have more than $100 million in annual revenue.
- [10]
DEFEND IP Act section 502A(a)(6)(B) says 'service provider' does not include "an entity that provides domain name system resolution functions or services exclusively through encrypted DNS protocols" or "an entity that exclusively provides virtual private network services or similar service that encrypt and route user traffic through intermediary servers"; TorrentFreak cites DoH as an example of an encrypted protocol.
- [11]
TorrentFreak calls VPNs the clearest difference between the two bills: a VPN provider with 100,000 American users could be ordered to block pirate sites under Issa's bill but would not be targeted by Lofgren's version.
- [12]
The ACPA discussion draft exempted any ISP with 1% or less of the U.S. broadband market, which according to TorrentFreak excluded pretty much every provider with fewer than 1.2 million customers.
- [13]
The introduced ACPA dropped the discussion draft's market-share exemption, adding smaller ISPs and VPNs as blocking intermediaries.
- [14]
Both bills use a three-factor test: a foreign site qualifies if it is primarily designed for infringement, if it is marketed to promote infringement, or if it has little legitimate use.
- [15]
The DEFEND IP Act requires that a site has "no commercially significant purpose or use" beyond copyright infringement, while the ACPA requires only "limited commercially significant purpose or use"; TorrentFreak calls the ACPA standard a lower bar.
- [16]
Broadband ISPs with 50,000 to 99,999 subscribers would be covered by the DEFEND IP Act but exempt under the ACPA.
- [17]
The ACPA's coverage floor of 100,000 is one twelfth of the discussion draft's effective cutoff of about 1.2 million customers.
- [18]
A public DNS resolver with 100,000 or more monthly US users and annual revenue of $100 million or less would be covered by the ACPA but not by the DEFEND IP Act.
- [19]
Because the DEFEND IP exclusions apply only to entities that 'exclusively' provide VPN or encrypted-only DNS services, a broadband provider that also sells a VPN, or a qualifying public resolver that also answers unencrypted queries, is not excluded by those clauses.
Sources
1 independent publisher whose own reporting we read for this story.
- Two U.S. Site-Blocking Bills Compete Over VPN Rules and ISP Liability
torrentfreak.com
1 article · October 10, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.