What the bill does
Rep. Darrell Issa (R-CA) introduced the American Copyright Protection Act (ACPA), H.R. 10364, in mid-September 2026. It would let a copyright owner petition a designated federal judge to label a foreign website a "foreign piracy site." The court could then order service providers to take reasonable steps to stop US users from reaching it. IPWatchdog's report describes orders that can later be updated, renewed, narrowed or rescinded. The Electronic Frontier Foundation's analysis, published October 2, notes two features that separate ACPA from its sibling bill, the Foreign Anti-Piracy Act (FADPA). First, covered intermediaries include VPN providers, which FADPA excluded. Second, the definition of a piracy site is looser: a site with only "limited commercially significant purpose or use" beyond infringement, against FADPA's "no commercially significant purpose."
The strongest case for the bill
Piracy is a real harm. Offshore sites with no US presence are beyond the reach of ordinary lawsuits, and rights holders say that leaves them with nothing but whack-a-mole takedown notices. The bill is also not a blank cheque. Providers get notice and a chance to respond. Rights holders must post bonds. Wrongly blocked third parties can seek up to $250,000 in compensation, according to IPWatchdog. Congress has also long accepted that courts may order blocking of foreign sites. Section 512(j) of the Copyright Act already lets a court order a qualifying access provider to take "reasonable steps" to block access to "a specific, identified, online location outside the United States." A narrow, court-supervised version of that power is defensible in principle.
Where ACPA goes further than existing law
Section 512(j) is tied to a specific, identified online location. It also requires the court to weigh burden on the provider, technical feasibility and less burdensome alternatives. ACPA adds a standing designation process and extends it to services that do not carry the infringing content or host anything. VPNs, and DNS resolvers in particular, are neutral plumbing.
The process also has a structural gap. EFF points out that the initial decision to label a site a foreign piracy site can still be made without the site's operator appearing to defend itself. Appointing a special master is optional. A one-sided proceeding is how overbroad orders get made. The $250,000 compensation cap and the bond help, but they come after the block, and they depend on a wronged third party discovering the order, hiring counsel and proving harm.
What the foreign record shows
The bill's backers cite blocking regimes in democracies. Those regimes are also the best evidence of the risk. EFF reports that Italy's Piracy Shield blocked 510 benign websites. It also reports that Spain's system blocked more than 550,000 domains during soccer broadcasts, including those of Greenpeace and Harvard. Re:Create, quoted by IPWatchdog, puts the cost differently: innocent sites stayed blocked for an average of 320 days in Italy, and Spain's system blocked about 5.8% of popular internet traffic during LaLiga matches.
These errors were not caused by bad drafting. A mechanism that lets an accusation trigger an infrastructure-level block invites mistakes, and also deliberate abuse, since the accuser pays little for being wrong. EFF's companion piece on the separate DEFEND IP Act makes the same point: there is no way to build a blocking mechanism that does not invite both deliberate abuse and overblocking. It also notes that the bills lack penalties for bad-faith blocking.
The US already has a mild preview in the notice-and-takedown system. The Copyright Office's Section 512 study is a reminder that the system relies on counter-notices and a restoration window of ten to fourteen business days. Even there, Congress built in liability under § 512(f) for knowing misrepresentation. ACPA's blocking orders operate at a coarser level, whole domains rather than individual files, and the bill offers no comparable deterrent to careless or bad-faith petitions beyond the bond.
Why VPNs and DNS resolvers are the sharp edge
Public Knowledge's Meredith Rose warns, in the IPWatchdog report, that applying blocking orders to global DNS resolvers causes global blocks, so one US court's judgment could cut off a site for the whole world. Extending orders to VPNs adds a second problem. VPNs are used by journalists, dissidents, remote workers and ordinary people protecting their traffic on public Wi-Fi. A "commercially reasonable steps" duty to block specific destinations pushes providers toward inspecting or filtering the traffic they are built not to see. That is a privacy and security cost the bill's text does not price in. A VPN's value is that it does not know or care where you are going. Compelling it to care weakens the product for everyone.
There is also a competitiveness cost. Smaller VPN and DNS operators cannot staff court-monitoring and rapid-compliance teams the way a large ISP can. Compliance cost would favor incumbents.
A proportionate alternative
A pro-innovation approach would start from the narrower tool Congress already wrote. Keep blocking, if it is used at all, to ISP-level access providers under § 512(j) principles. Require adversarial or at least independent review before any designation, with a mandatory special master or amicus rather than an optional one. Attach real penalties for bad-faith or negligent petitions, mirroring § 512(f). Require public, searchable and time-limited orders, with automatic expiry and a fast path for wrongly blocked parties to seek relief before damages. Leave VPNs and DNS resolvers out unless sponsors can show a measured case that cheaper options have failed.
Copyright owners are entitled to a remedy against genuine foreign piracy operations. The test for ACPA is whether it delivers that remedy without turning core internet infrastructure into an enforcement arm that is unaccountable when it is wrong. On the current text, and on the Italian and Spanish record, it does not yet pass.