PRIVACY & SECURITY
Congress Wants VPNs to Block Piracy Sites: Why the Definitions Should Worry Remote Workers
On September 14, 2026, Rep. Darrell Issa introduced H.R. 10364, the American Copyright Protection Act of 2026. It went to the House Judiciary Committee, where…
✓What the bill actually proposes✓Why the definitions should worry✓Two bills, two futures
Quick Answer
H.R. 10364, the American Copyright Protection Act of 2026, was introduced on September 14 by Rep. Darrell Issa and referred to the House Judiciary Committee. It is not law. If enacted, it would let federal courts declare sites “foreign piracy sites” and order VPN services with 100,000 or more US users to block American access to them. The definitions of “foreign” and “from the United States” are fuzzy enough to worry anyone whose work depends on a VPN, especially remote workers who cross borders. A rival bill, DEFEND IP, explicitly exempts VPN-only services. HomeIPVPN your traffic runs through your own home connection, so no provider exists for a court to conscript.
- Status: introduced September 14, 2026, in the House Judiciary Committee. Not law, no new blocking duty exists yet.
- What it would do: courts name “foreign piracy sites,” then order covered VPNs to take “commercially reasonable steps” blocking US access.
- Who is covered: VPNs with 100,000+ monthly US users, plus ISPs and DNS resolvers. Public Wi-Fi, root nameservers, and domain registries are excluded.
- The worry: fuzzy location definitions plus a 14-day objection window. Remote workers living across borders should read the fine print.
What the bill actually proposes
On September 14, 2026, Rep. Darrell Issa introduced H.R. 10364, the American Copyright Protection Act of 2026. It went to the House Judiciary Committee, where it sits. That status matters more than anything else in this article: no VPN has acquired a new federal blocking duty because this story exists.
The mechanism has two steps. First, a copyright owner asks a federal court to declare an online location outside the United States a "foreign piracy site." The standard of proof is preponderance of the evidence, the same bar used in ordinary civil cases. Second, with that declaration in hand, the owner can seek a blocking order against named service providers. Those providers get 14 days to object, though a judge can shorten the window for time-sensitive material like live sports.
The covered providers are broadband companies, domain-name resolvers, and VPN services with at least 100,000 monthly US users or subscribers. That last category is the new part. Earlier drafts of this idea covered ISPs and DNS resolvers; adding VPNs goes after the workaround, since a VPN is exactly how people get around an ISP-level block.
Why the definitions should worry remote workers
Here is where it gets uncomfortable for anyone who works across borders. The bill's machinery runs on two phrases: "foreign" sites and people "in the United States." Both are fuzzier than they sound.
Consider a US-based remote worker spending three months in Portugal. She VPNs into her home connection every morning so her bank, her streaming accounts, and her employer's tools see her as home. Is she "in the United States" for purposes of a blocking order? Her traffic exits in the US. Her body is in Lisbon. The bill does not answer that cleanly, and the commentary around it has already flagged the ambiguity.
Now flip it. A provider served with a blocking order has to stop "people in the United States" from reaching a named site. How does a VPN know where you are? By your IP address, the same IP-based geolocation data that misfires constantly. When your IP address shows the wrong country, that is an annoyance. Under a blocking regime, the same misfire could decide whether you can reach a site at all. And providers get as little as 14 days to comply, which is not a lot of time to get location detection right when the underlying data is unreliable.
There is also the overblocking problem. When courts order blocks through infrastructure, the blast radius is hard to control. European site-blocking orders have taken down shared infrastructure affecting hotels, payment processors, and even a healthcare provider. A wrong block is not a theoretical risk; it is the documented history of this enforcement style.
Two bills, two futures
Congress is not speaking with one voice here. The rival DEFEND IP bill, associated with Rep. Zoe Lofgren, explicitly exempts VPN-only services from its blocking framework. So there are two live visions: one where VPNs become enforcement checkpoints, and one where they are carved out entirely. Which one survives will shape what every VPN provider operating in the US is allowed to promise you.
That split is worth watching because it tells you the debate is not settled. Lawmakers themselves disagree on whether conscripting VPNs is a good idea. Canada is having the same debate from the opposite direction: Psiphon, a VPN with 20 million users, may leave the country over a surveillance law.
What to demand from a VPN provider before a court order arrives
Whether or not H.R. 10364 becomes law, the story is a useful stress test for any VPN you trust. Ask these questions now, while the answers are still voluntary:
Where is the company incorporated, and what can that jurisdiction compel? A provider is subject to the courts where it lives. Promises in marketing copy do not survive a court order.
What does it log, and for how long? A provider that keeps no meaningful logs has less to hand over and less to get wrong under a blocking order.
How does it decide where you are? If a provider ever has to enforce location-based blocking, its method is your fate. IP geolocation alone is a shaky foundation.
What happens to your traffic if the provider is ordered to block something? You want this answered in plain language before you need it, not after.
The option that sidesteps all of it
There is a simpler architecture that makes most of these questions moot. When your VPN endpoint is your own home connection, there is no provider to serve with a blocking order, no foreign company to lean on, and no 100,000-user threshold to trip. Your traffic enters the internet from your house, under your name, on a residential IP the internet already trusts. Courts can order companies around; they cannot order your living room router to become a checkpoint for strangers.
That is the entire pitch for a home IP setup in one paragraph. If Congress ever does turn VPNs into enforcement points, the people running their own home connections will be the ones with nothing to reconfigure. And if it never happens, they still get the banking, streaming, and employer-tool consistency that trips people up when Teams reports their real location through a VPN.
Tired of trusting a provider's promises?
If you want an IP address no court order can reassign to a blocking regime, because it is yours, book a Pre-Travel Audit & Advisory session. It is 1 hour, it costs $79, and that fee comes straight off the $379 Secure Home IP VPN System session if you decide to go ahead. We will get your travel router running your home IP and test everything with you.
