As legislative battles over digital piracy and site-blocking measures continue to heat up globally, the Internet infrastructure sector is pushing back against efforts to draft consumer privacy tools into the machinery of copyright enforcement. On Global Encryption Day, the Internet Infrastructure Coalition (i2Coalition) published a comprehensive new report titled VPNs at Risk, cautioning lawmakers and judicial bodies alike about the unintended collateral damage of weaponizing neutral network intermediaries.
The publication of the report arrives amid a volatile policy landscape. In the United States, competing site-blocking bills have placed virtual private network (VPN) providers directly into the crosshairs of federal lawmakers. Meanwhile, across the Atlantic, European courts have already begun testing the legal boundaries of what rightsholders can demand from general-purpose privacy services. By releasing VPNs at Risk, the i2Coalition—which represents tech giants such as Amazon, Cloudflare, and Google, alongside major VPN providers like ExpressVPN, NordVPN, and Surfshark through its VPN Trust Initiative—aims to reframe the debate around technical accuracy, intermediary liability, and the preservation of foundational internet security.
From Pirate Sites to VPNs
For years, copyright enforcement initiatives targeting online piracy focused primarily on traditional intermediaries, such as domain name system (DNS) resolvers and Internet Service Providers (ISPs). However, as rights-holders and courts have successfully implemented blocking measures against illicit streaming and downloading portals, users have increasingly turned to technical workarounds to bypass these restrictions. In response, rightsholders have shifted their focus deeper down the infrastructure stack, arguing that general-purpose privacy tools like VPNs should also be forced to comply with site-blocking mandates.
The report notes that copyright enforcement is increasingly driving governments to consider direct regulation or restriction of VPNs. Such measures are frequently justified by the argument that VPNs allow users to bypass geographic licensing restrictions, obfuscate their digital footprints, and frustrate efforts by rightsholders to identify individual infringers or enforce copyright laws.
France has emerged as a primary proving ground for this aggressive legal strategy. In May 2025, a Paris court issued a landmark ruling ordering major VPN providers—including NordVPN, CyberGhost, Surfshark, ExpressVPN, and Proton VPN—to block over 200 pirate sports streaming domains at the behest of media giant Canal+. Subsequent court orders from French judges expanded these demands, setting a controversial international precedent.
"These cases, brought by rightsholders before French courts, illustrate how obligations imposed at one layer of the Internet can migrate to another when users find alternative technical paths around court-ordered restrictions," the report observes.
This migration of regulatory obligations raises urgent questions for policymakers. According to the i2Coalition, the core issue extends far beyond the technical question of which intermediaries can be compelled to execute a block. Instead, lawmakers must evaluate whether such sweeping interventions actually reduce digital piracy, and what the severe side effects might be for lawful, everyday internet users who rely on these services for privacy, security, and remote work.
The legal battles in France remain far from resolved. Although the initial report describes the contentious decisions as pending appeal, ongoing developments have continued to complicate the landscape. On September 30, the Paris Court of Appeal temporarily suspended an appeal brought by NordVPN, Proton, and CyberGhost against a similar site-blocking order secured by the French professional football league, the LFP. The appellate court opted to wait for a definitive ruling from France’s highest ordinary court, the Cour de cassation, which is currently reviewing related DNS blocking disputes. Just a week later, the Paris court rejected a bid by beIN Sports for steep daily financial penalties against VPN providers and Cloudflare for failing to completely block the targeted domains.
Christian Dawson, Executive Director of the i2Coalition, acknowledges these rapid developments but confirms that the core text of the report remains unchanged. The organization is closely monitoring the French judicial proceedings and the pending outcome from the Cour de cassation. According to Dawson, these ongoing events will heavily inform future updates and policy positions, even if they do not alter the coalition’s foundational concern regarding the systemic dangers of extending blocking obligations to the VPN industry.
Target the Right Layer
Rather than lobbying for a blanket exemption from all forms of regulation, the VPNs at Risk report takes a more nuanced approach. It urges lawmakers to exercise precision, ensuring that regulatory interventions are directed at the actors who possess genuine knowledge of and control over the illicit activity in question.
"Policymakers should consider where meaningful knowledge and control actually reside and whether an obligation can be directed toward the relevant conduct or service before moving deeper into general-purpose Internet infrastructure," the report reads. "The further an intervention moves from the activity being regulated, the greater the need to consider its effects on unrelated users and services."
This principle of targeting the correct layer is uniquely critical when applied to consumer privacy and security technologies. Consumer-facing VPN services and secure corporate enterprise networks frequently rely on the exact same underlying cryptographic protocols, including widely adopted standards such as OpenVPN and WireGuard. Because these technologies are foundational to modern digital security across both commercial and personal spheres, attempting to filter or block specific traffic at the network level creates immense technical challenges. The report points to Russia’s aggressive blocking of standard VPN protocols as a clear demonstration of how difficult it is to separate illicit circumvention from legitimate security uses without severely degrading network functionality for everyone.
When examining the legal liability of service providers, the i2Coalition highlights the U.S. Supreme Court’s decision earlier this year in the high-profile case involving Cox Communications. In that ruling, the nation’s highest court established that the mere act of continuing to provide internet access while knowing that some customers may misuse the service is insufficient, on its own, to establish contributory copyright infringement.
While the coalition views the principles established in the Cox ruling as directly relevant to the legal debates surrounding VPN providers, it refrains from claiming that the matter is entirely settled.
"If providers face liability merely because general-purpose services can be misused, they may have strong incentives to terminate users, restrict access, or intervene preemptively even when they have limited knowledge of the underlying conduct," the report warns. "Obligations should therefore reflect what an intermediary can reasonably know, control, and address."
Dawson emphasizes that while the group sees these judicial principles as applicable to the broader debate over VPN oversight, they do not automatically dictate the outcome of every distinct legal challenge. The legal status of a provider will ultimately depend heavily on the specific facts and legal issues presented in each case.
At the same time, the report makes clear that VPN providers are not absolved of all responsibility. Companies within the sector can bolster public trust and demonstrate accountability through independent security audits, transparent operational practices, and constructive cooperation with legitimate legal processes. Voluntary industry frameworks, such as the VPN Trust Initiative’s Trust Seal program, serve to complement these accountability measures. In turn, lawmakers are encouraged to engage directly with VPN providers and technical experts from the earliest stages of the legislative process when attempting to address complex online challenges.
Despite the intense policy debates currently unfolding in Washington, D.C., the VPNs at Risk report remains notably silent regarding specific pending U.S. legislation. Neither the American Copyright Protection Act (ACPA) nor the competing DEFEND IP Act is explicitly mentioned in the text.
This omission is particularly striking given the legislative context. Introduced last month by Rep. Darrell Issa, the ACPA would grant courts the sweeping authority to name VPN providers with 100,000 or more monthly U.S. users or subscribers in site-blocking orders—a regulatory burden that the industry strongly opposes. Conversely, the DEFEND IP Act, introduced days later by Rep. Zoe Lofgren and Sen. Thom Tillis, takes the opposite approach by explicitly excluding services that exclusively offer VPNs from such mandates.
When asked why the report omits direct references to these competing U.S. bills, Dawson explained that the current edition focuses on broader structural developments rather than attempting to catalog every pending legislative proposal. The coalition is actively monitoring both proposals and anticipates returning to U.S. federal legislation in a subsequent update as the parliamentary debate evolves. With Rep. Issa retiring at the end of the year and Sen. Tillis’s term concluding in January, both bills face a tight legislative window if they are to advance before the current congressional session draws to a close.
Leave a Reply