Two separate site-blocking proposals now circulating in the US Congress represent fundamentally different views on how to balance copyright enforcement with internet infrastructure and privacy. Understanding the distinction matters for anyone operating hosting, VPN, or ISP services—or relying on them.
The Two Competing Approaches
Rep. Darrell Issa's ACPA (Aiding and Abetting Counterfeiting and Piracy Act) and the bipartisan DEFEND IP Act take markedly different regulatory stances. The ACPA casts a wider net by treating VPN services as potential vectors for copyright infringement liability, whereas DEFEND IP explicitly carves out VPN providers from blocking obligations. This seemingly technical distinction has enormous implications for how site-blocking regimes would actually function.
The ACPA grants broad liability protections to Internet service providers—the traditional network operators—when they comply with blocking orders. DEFEND IP, conversely, applies the blocking requirement to a wider range of entities, including smaller ISPs and certain infrastructure operators, but with the explicit exemption that VPN services cannot be compelled to participate in blocking schemes.
VPN Regulation and Technical Reality
The inclusion or exclusion of VPNs from site-blocking liability represents a philosophical fork in the road. VPN services by design encrypt traffic and often operate across multiple jurisdictions, making transparent traffic inspection for copyright enforcement technically difficult and operationally invasive. The ACPA's approach would effectively require VPN providers to maintain some form of content inspection or user-activity logging to comply with blocking orders—which directly contradicts the no-logs privacy model that legitimate VPN operators advertise and maintain.
DEFEND IP's exclusion of VPNs sidesteps this problem entirely. It acknowledges that VPN providers occupy a different regulatory category—more akin to privacy infrastructure than ISPs. By exempting them, the bill avoids forcing a technological trade-off between copyright enforcement and user privacy at scale.
ISP Liability Frameworks and Compliance Cost
The breadth of ISP liability protections differs meaningfully. The ACPA provides what amounts to safe harbour for ISPs that implement blocking measures as directed. This creates a clear compliance pathway: follow the order, gain immunity. DEFEND IP spreads responsibility across a broader base of operators but offers less comprehensive liability protection, potentially raising the compliance bar and legal risk for smaller infrastructure providers.
For hosting operators and infrastructure companies, this distinction affects operational liability. Broader liability protections in one bill versus narrower scope in another change the calculus of whether to implement blocking systems and how aggressively to monitor traffic. Smaller hosting providers and VPS operators may find themselves in an awkward position under DEFEND IP—potentially subject to blocking obligations without the same legal shields as larger ISPs.
Jurisdictional Implications
Both bills assume US jurisdiction over services and operators. However, offshore hosting, VPN, and infrastructure providers operating outside US borders could be affected indirectly. If either bill passes, US-based payment processors, CDN providers, or upstream transit providers might face pressure to implement blocking at scale, which would then affect the availability of services globally. Offshore providers serving US users would need to evaluate their exposure to future enforcement actions.
The VPN exemption in DEFEND IP also signals recognition that not all infrastructure categories should be treated identically. Privacy-focused services—whether VPN, anonymous hosting, or domain registration with WHOIS privacy—occupy a different regulatory space than general-purpose ISPs. That distinction, if codified, could create more stable operating conditions for privacy infrastructure providers in the longer term.
What's at Stake
These bills remain in early circulation and may not pass in their current form. However, they reflect congressional intent to expand copyright enforcement tools while grappling with the technical reality of how modern infrastructure operates. The fact that two different approaches are being tested suggests lawmakers are unsure whether to treat VPNs as neutral infrastructure or as potential circumvention tools.
For infrastructure operators, the key takeaway is that site-blocking legislation is inevitable in some form, and the regulatory framework—particularly around VPN services and ISP liability—will shape operational requirements for years to come. Monitoring both bills and their evolution is prudent for anyone operating privacy services, hosting platforms, or ISP infrastructure.
