As legislative efforts to clamp down on online piracy increasingly turn their crosshairs toward core network infrastructure, the digital privacy industry is pushing back. Coinciding with Global Encryption Day, the Internet Infrastructure Coalition (i2Coalition)—an influential trade group representing major tech and privacy firms including Amazon, Cloudflare, Google, and VPN Trust Initiative founding members ExpressVPN, NordVPN, and Surfshark—has published a comprehensive new whitepaper titled VPNs at Risk.
The report arrives at a precarious crossroads for virtual private network providers. Over the past year, copyright enforcement debates have shifted rapidly from traditional targets like file-sharing websites and domain name system (DNS) resolvers to general-purpose encryption tools. Lawmakers and rightsholders argue that VPNs can be weaponized to bypass geographical licensing restrictions, evade court-ordered domain blocks, and obscure the identities of digital infringers.
However, the i2Coalition’s new publication warns that drafting VPNs into the service of copyright enforcement threatens to destabilize neutral infrastructure, chilling lawful expression and imposing impossible administrative burdens on service providers who possess neither direct knowledge nor control over individual user actions.
From Pirate Sites to VPNs
The genesis of the VPNs at Risk report lies in a worrying trend for the privacy industry: the legal migration of blocking obligations from one internet layer to another. For years, rightsholders relied primarily on traditional website blocking mandates directed at internet service providers and DNS resolvers. When internet users found technical workarounds—often via commercial VPNs—copyright holders began taking the fight directly to VPN providers.
The most prominent testing ground for this strategy has been France. In May 2025, a Paris court issued a landmark ruling ordering major VPN providers—including NordVPN, CyberGhost, Surfshark, ExpressVPN, and Proton VPN—to block over 200 pirate sports streaming domains at the behest of broadcaster Canal+. Subsequent orders from French courts followed, illustrating a growing judicial appetite for compelling privacy infrastructure providers to police content on behalf of media companies.
These legal battles remain unresolved as they wind their way through appellate courts. On September 30, the Paris Court of Appeal paused a similar enforcement action brought by football league LFP against NordVPN, Proton, and CyberGhost, electing to await a definitive ruling from France’s Supreme Court, the Cour de cassation, regarding parallel DNS blocking disputes. Shortly thereafter, the Paris court declined a request from beIN Sports to impose daily financial penalties against VPN providers and Cloudflare for failing to achieve complete compliance with previous blocking demands.
Despite these evolving legal maneuvers, the i2Coalition’s core thesis remains unchanged. Christian Dawson, Executive Director of the i2Coalition, notes that while the group is closely monitoring the French appeals and the eventual Supreme Court outcome, these specific updates do not dilute the industry’s overarching anxiety. The fundamental danger, according to the report, is the cascading expansion of enforcement duties onto general-purpose technologies that serve vital security functions for millions of lawful users worldwide.
Target the Right Layer
Rather than lobbying for an absolute, unconditional exemption from all forms of legal oversight, the VPNs at Risk report urges lawmakers to exercise architectural precision. The authors argue that public policy should focus interventions where meaningful knowledge and direct control actually reside, rather than forcing deep intrusions into the foundational layers of the internet.
The further an enforcement mechanism moves away from the specific activity being regulated, the higher the risk of collateral damage to unrelated users, enterprises, and standard communications protocols. This principle is especially critical when dealing with VPN technology. Consumer-facing privacy apps and high-security corporate virtual private networks frequently rely on the exact same underlying cryptographic protocols, such as OpenVPN and WireGuard.
Differentiating between malicious activity and legitimate enterprise or personal security at the network layer is extraordinarily difficult. Governments that attempt to restrict or filter these protocols often create severe unintended consequences. The report highlights Russia’s aggressive blocking of standard VPN protocols as a cautionary tale of how heavy-handed network interference degrades digital infrastructure for ordinary citizens and businesses alike.
When evaluating legal liability, the i2Coalition points to broader judicial trends, such as the U.S. Supreme Court’s Cox ruling earlier this year. That decision clarified that merely continuing to provide internet access while knowing that a subset of customers might misuse the service does not automatically establish contributory copyright infringement. While the coalition does not assert that this specific ruling settles every global VPN dispute, it maintains that the underlying logic is deeply relevant.
If service providers face severe legal liability simply because their tools can be theoretically misused, they will face overwhelming financial and operational incentives to preemptively terminate accounts, restrict access, or monitor users. This dynamic would inevitably erode the fundamental privacy and security protections that virtual private networks were designed to provide. Consequently, obligations must be tethered to what an intermediary can reasonably know, control, and remediate.
To maintain trust and accountability, the VPN industry is not advocating for a complete lack of responsibility. The report emphasizes that providers can reinforce institutional credibility through independent third-party audits, constructive cooperation with legitimate legal processes, and adherence to voluntary self-regulatory standards like the VPN Trust Initiative’s Trust Seal. Furthermore, the coalition contends that lawmakers should proactively consult technical experts and infrastructure providers before drafting legislation that impacts core network architecture.
Silent on U.S. Bills
The release of VPNs at Risk comes as the United States navigates its own legislative tug-of-war over site-blocking measures, though the report notably avoids explicitly addressing pending domestic bills.
Last month, Rep. Darrell Issa introduced the American Copyright Protection Act (ACPA), a site-blocking proposal that would empower courts to compel VPN providers—specifically targeting services boasting 100,000 or more monthly U.S. users or subscribers—to block foreign pirate sites. Days later, a competing legislative vehicle, the DEFEND IP Act, was introduced by Rep. Zoe Lofgren and Sen. Thom Tillis. In direct contrast to the ACPA, the DEFEND IP Act explicitly excludes services that solely offer VPN functionality from mandatory blocking obligations.
When asked why the newly published whitepaper does not explicitly address these competing U.S. proposals, Christian Dawson explained that the current edition of the report was designed to address broader global infrastructure trends rather than cataloging every individual legislative initiative currently under consideration in Washington. The coalition intends to revisit domestic U.S. legislation in future updates as the political debate matures.
With Rep. Issa retiring at the end of the year and Sen. Tillis’s term concluding in January, time is rapidly running out for either the ACPA or the DEFEND IP Act to advance before the current congressional session draws to a close. Regardless of how the domestic legislative landscape resolves, the VPNs at Risk report serves as a timely reminder that the global debate over the boundaries of internet governance and infrastructure neutrality is only just beginning.
