The case for blocking, stated fairly
Piracy of live sports and new releases is a real harm, and the strongest argument for site blocking is simple: foreign operators are beyond the reach of U.S. courts and ignore takedown notices, so the only chokepoint left is the network path. Rights holders say blocking is proportionate if it is court-supervised and narrowly aimed. That was the pitch behind the Foreign Anti-Digital Piracy Act (FADPA), which Rep. Zoe Lofgren introduced on January 28, 2025. Reasonable people can support a carefully bounded version of it.
The question raised by Rep. Darrell Issa's American Copyright Protection Act, H.R. 10364, introduced in mid-September 2026, is whether it is that bounded version. On the evidence available, it is not.
What the new bill reportedly does
A caveat first. When TorrentFreak reported the filing on September 15, the text was not yet online, and the outlet noted it could not confirm that provisions from Issa's earlier discussion draft survived. The most detailed account of the introduced text comes from the Electronic Frontier Foundation (October 2, 2026), and the details below are EFF's characterization. We have not independently read the bill text, because Congress.gov blocked our access.
Per EFF, the ACPA works in two steps. A copyright owner asks a court to label a foreign website a "foreign piracy site," which can happen without the site appearing to defend itself. The owner can then seek orders requiring ISPs, DNS providers and VPN providers to take "commercially reasonable steps" to block U.S. users.
EFF identifies three departures from FADPA:
- VPNs are explicitly covered. FADPA's text excluded providers offering exclusively VPN or similar encrypted routing services and barred orders requiring a provider to stop users from using a VPN. EFF says the ACPA drops those carve-outs.
- Encrypted-DNS providers lose their exemption. FADPA also excluded providers resolving DNS exclusively over encrypted protocols and limited public-resolver coverage to those with over $100 million in annual revenue. EFF says the ACPA removes the encrypted-DNS exemption.
- The piracy test is looser. FADPA's test required, among alternatives, that a site have no significant non-infringing purpose. EFF says the ACPA reaches sites with "only limited commercially significant purpose or use" beyond infringement. A site with some legitimate commerce could therefore be blocked for every American.
The ACPA does have safeguards. EFF notes it requires notice to service providers, a weighing of harm to other sites, a bond from the rights holder, a path to rescind a designation, and an optional special master. Those are real improvements on paper. But a special master is not an advocate for the accused site or for the users who lose access.
Why the VPN reach matters
VPNs are how journalists, dissidents, abuse survivors and ordinary travelers protect traffic. A VPN provider usually cannot see which sites its users visit and does not operate a catalogue of content. An order to block a named domain forces it either to build filtering it was designed not to have, or to withdraw from the U.S. market. Neither outcome targets pirates, who can switch to any provider outside U.S. jurisdiction. The burden falls on law-abiding privacy tools and their users.
That is a poor fit with a pro-speech, pro-innovation approach. A statute that conscripts tools designed for confidentiality, on the strength of an order the target never contested, goes well beyond a narrow remedy for a live-streaming problem.
What Italy's record shows
Supporters will say the safeguards fix the problems seen abroad. The Italian experience suggests caution. Italy's Piracy Shield requires registered providers to block submitted domains and IP addresses within 30 minutes, according to Cloudflare's account of its dispute with the regulator. Cloudflare is a party to that dispute, so its characterizations are advocacy. But independent measurement points the same way. A RIPE Labs write-up of a University of Twente study used a June 2025 snapshot showing 18,849 blocked domains and 10,918 blocked IPv4 addresses. It found more than 500 confirmed unrelated websites initially blocked, a count that later rose into the thousands. Blocked FQDNs often moved to IPv6 or new IPv4 addresses, which limits how durable the blocks are. The article gives no figure for how much piracy fell.
The lesson is not that Italy's system equals the ACPA. Italy's is administrative and fast, while the ACPA runs through federal courts. The lesson is that blocking at the IP and DNS layer cannot cleanly separate one pirate site from the innocent sites sharing its infrastructure, and that evasion is cheap. Cloudflare also says the regulator has since extended the system to global DNS providers and VPNs, which shows how a narrow mandate can widen once the machinery exists.
A more proportionate path
Congress can address live-event piracy without VPN mandates. It could:
- Keep FADPA's exclusion for VPN-only and encrypted-DNS providers, and cap coverage by provider scale.
- Require adversarial review, such as a court-appointed advocate for the site's likely users, before any designation made without the operator's appearance.
- Limit ex parte relief to live events that are ongoing or imminent, as FADPA's text did.
- Require published block lists and a fast, free route to challenge overblocking.
- Mandate an evidence review of blocking's actual effect on piracy before any expansion.
Issa reportedly chairs the House IP subcommittee and is retiring at the end of this term, per TorrentFreak, which leaves little time for the bill to move. The bigger risk is that its provisions become the baseline in a later negotiation with the Lofgren-Tillis effort. If they do, lawmakers should demand proof that each loosened safeguard is necessary, not merely convenient.