Two U.S. Site-Blocking Bills Compete Over VPN Rules and ISP Liability

For more than a decade after the SOPA protests, pirate site blocking was a subject U.S. lawmakers preferred to avoid.

That changed last month, when two site blocking bills were introduced in Congress within ten days of each other.

The first, introduced by Rep. Darrell Issa, is the American Copyright Protection Act (ACPA) which would allow courts to order ISPs, DNS resolvers, and VPNs to block foreign pirate sites.

The second is the DEFEND IP Act, introduced by Reps. Zoe Lofgren and Ben Cline in the House, with Senators Thom Tillis, Chris Coons, Marsha Blackburn, and Adam Schiff leading in the Senate. It merges Lofgren’s FADPA and the Senate’s Block BEARD proposal into the unified bill TorrentFreak reported on in April.

At first glance, both bills look fairly similar. They use federal courts to target foreign pirate sites only, and both leave the technical blocking measures up to the providers. The differences are in the details, however, starting with which intermediaries can be ordered to block.

Who Has to Block?

Under the ACPA, any broadband provider, DNS resolver, or VPN with 100,000 or more monthly users or subscribers in the United States can be named in a blocking order. Smaller services are exempt, as well as root nameservers and top-level domain registries.

The DEFEND IP Act takes a different approach. It covers broadband providers with at least 50,000 subscribers, which effectively means that more smaller ISPs are covered. DNS resolvers, however, only qualify if they are public and have more than $100 million in annual revenue.

VPNs are left out altogether. The DEFEND IP Act explicitly excludes services that exclusively provide VPN connections or similar encrypted routing, as well as DNS services that only work through encrypted protocols, such as DoH.

That makes VPNs the clearest difference between the two U.S. blocking bills. A VPN provider with 100,000 American users could be ordered to block pirate sites under Issa’s bill, while it would not be targeted by Lofgren’s version.

The ACPA wasn’t always this broad in scope. The discussion draft that we covered last year exempted any ISP with 1% or less of the U.S. broadband market. That excluded pretty much every provider with fewer than 1.2 million customers. The introduced bill dropped that exemption, adding smaller ISPs and VPNs as blocking intermediaries.

What is a Pirate Site?

Both bills rely on a three factor test to decide if a foreign site can be blocked. A site qualifies if it is primarily designed for infringement, if it is marketed to promote infringement, or if it has little legitimate use. The bills describe that requirement differently.

The DEFEND IP Act requires that a site has “no commercially significant purpose or use” beyond copyright infringement. The ACPA, on the other hand, settles for a site that has only limited commercially significant purpose beyond providing access to infringing material. That is a lower bar.

There is a second difference that’s more subtle. The ACPA targets sites that provide access to pirated material, which covers linking and indexing sites as well as hosts. The DEFEND IP Act refers to sites designed for the purpose of infringing, which is less explicit about sites that only link to content hosted elsewhere.

Both bills also let rightsholders act before any infringement takes place. The ACPA covers operators who will violate a right, not only those already doing so. DEFEND IP does something similar for live events, allowing a site to be targeted when a transmission will likely infringe, and it lets courts issue designations ex parte, without hearing the site operator first.

The Liability Shield

The largest difference between the two bills has little to do with blocking itself. It relates to what happens to the piracy liability of ISPs and other providers after a site has been declared a pirate site.

The ACPA includes a broad liability shield, which covers every service provider the bill applies to, whether it was ordered to block anything or not.

“A service provider, whether or not named in an order issued under section 1604(d), shall not be liable for monetary relief for any claim of direct or secondary infringement of copyright arising from the service provider having provided or enabled, or continuing to provide or enable, access to a foreign piracy site, unless the service provider acted or is acting in active concert with the foreign piracy site to infringe the exclusive rights of any copyright owner,” the bill reads.

This means that, once a court has declared a site a pirate site, no copyright holder can win damages from a provider for carrying traffic to it, unless that provider is actively working with the site. This provision takes effect on the day the bill is signed, which is six months before the rest of the law.

The shield has expanded quite a bit since last year. Issa’s early discussion draft only protected providers that were named in an order, only against the rightsholder that obtained the order, and only for activity after the order was issued. The introduced bill dropped these limits.

The DEFEND IP Act takes a different approach. It protects providers that implement an order in good faith, and it shields them from claims by the blocked site. There’s no piracy liability shield. In fact, the text specifies that nothing in the bill affects the DMCA’s safe harbors or the principles of secondary liability.

Liability was a key point of contention in site-blocking discussions last year. In May 2025, Senator Chris Coons told a Senate hearing that progress was finally being made, but that Internet providers wanted something in return.

“It finally feels like we’re making some real progress here on site blocking after years. One of the key roadblocks to getting a final deal is whether ISPs should benefit from immunity, both prospectively and retrospectively,” Senator Coons said.

The MPA’s Karyn Temple responded that site blocking laws elsewhere had not led to lawsuits against ISPs, so there was little to protect them from.

“ISPs have not routinely been sued for enforcing site blocking regimes. So, you know, I think in our experience, we don’t think that this is a provision that is necessary at all,” Temple replied.

Sixteen months later, the bill Coons co-sponsors has no piracy-damages shield, while Issa’s has a broad one.

Who Pays?

Site blocking costs money, and both bills allow providers to recover some expenses from rightsholders. How much differs between the two proposals.

Under the DEFEND IP Act, reimbursement is at the court’s discretion and only direct compliance costs can be claimed. Capital expenditures, infrastructure, overhead, and attorneys’ fees are excluded.

“Upon motion by a service provider subject to an order issued under this subsection, the court may order the petitioner that sought the order to pay reasonable costs directly incurred by the service provider to comply with the order,” the bill reads.

The ACPA is more generous. If a provider documents its costs, the court must order reimbursement. It can’t deny it, but the amount can be reduced. These costs can also include overhead that’s linked directly to the order, such as the salary costs of specialized staff for the time they spend on it.

The ACPA requires rightsholders to post a bond for each site blocking order, to cover any provider that is wrongfully enjoined. DEFEND IP doesn’t have this requirement.

Overblocking is treated differently too. Under the ACPA, the operator of a legitimate site that gets blocked by mistake can claim up to $250,000 in compensation, provided the rightsholder caused the error. DEFEND IP allows site operators to ask the court to fix an order, without offering compensation.

A Public Blocklist?

Transparency is a key element to inform the public on site-blocking, but it is often lacking. In most countries, the public has no official way to find out what is blocked. The U.S. bills do offer transparency, at least on paper.

The ACPA requires the Copyright Office to keep a public registry of all active blocking orders. In addition, rightsholders must also file a notice of each case at the Copyright Office, which is then published in the Federal Register.

The DEFEND IP Act requires courts to notify the Register of Copyrights whenever an order is issued, amended, or rescinded, and those notifications are published on the Copyright Office website. Since courts can amend orders when a site moves to a new domain, those updates should be added to the public record as well.

How useful either registry will be depends on what the orders contain. The bills don’t require domain names and IP addresses to appear in the published version. As TorrentFreak noted last year, publishing orders without those details creates a transparency illusion. The public sees that something is blocked but without further detail, which makes it hard to check for overblocking.

The two bills also differ on who handles the blocking requests. The ACPA sends everything to a roster of district judges picked by the Judicial Conference. DEFEND IP leaves cases with any appropriate district court.

Finally, it’s worth noting that two of the sponsors have limited time. Issa retires at the end of the year and Tillis’s term ends in January, so their bills have to move before the session closes. Whether the two will be merged, or one will simply overtake the other, has yet to be seen.

—

The full text of the ACPA (H.R. 10364) is available on Congress.gov, as is the DEFEND IP Act (H.R. 10575).