US bill on VPNs and piracy sites: what H.R. 10364 says and what it means for Russia

A bill introduced in the US Congress would let courts order large VPN services to shut off access to piracy sites for users in the United States. We read the text itself.

What the bill says

H.R. 10364 is called the American Copyright Protection Act of 2026. It adds a new chapter to US copyright law, titled “Foreign Piracy Site Blocking”: how to shut off access to piracy sites run from abroad. There are two steps, and both go through a court.

1. The site is declared a piracy site. A copyright owner goes to a federal court and has to show that the site infringes its rights; that the site’s operator and domain registrar were notified; that the operator is outside the United States or could not be found there; and that the site mainly exists for this. The court decides by a “preponderance of the evidence”, the usual civil standard.
2. The court issues an order to services. The copyright owner names the services without which access to the site from the United States cannot be cut by a commercially significant amount. Each named service gets at least 14 days to object. The court weighs the burden on the service, technical feasibility, and the risk of harming other sites and their users.

What the order itself says:

• the service takes “all commercially reasonable steps” to prevent its users from reaching the site from the United States;
• it gets 14 to 30 days from the day it receives the order. The court may change deadlines, including for live broadcasts and premieres that leak within the first 24 hours;
• the order lasts no longer than 12 months;
• the court does not set the method: the text explicitly bars an order from prescribing or forbidding specific techniques — the service chooses;
• the copyright owner posts a bond in case the order turns out to be wrong, and the court may make the copyright owner reimburse the service’s direct costs of implementing it.

The US Copyright Office has to keep active orders in a public registry. If an order hits an unrelated site by mistake, its operator or a user can ask the court to fix it and, if the error was the copyright owner’s, recover up to $250,000 from it. The law would take effect six months after enactment.

Which services it covers

A court can bind three kinds of services: broadband providers, DNS services (which turn a site’s name into an address) and VPNs. Root nameserver operators and top-level domain registries are excluded explicitly. And two more exclusions:

• services with fewer than 100,000 monthly users or subscribers in the United States;
• places that simply give internet access to guests and staff: airports, libraries, universities, restaurants, shops.

⚠️ There is no “US companies only” clause in the text. The threshold counts users in the United States, not the country where the service is registered. How a US court would enforce an order against a service from another country, the bill does not say.

The duty only arises for a service named in a specific order, and only for a specific site. A service is not obliged to watch other orders or to shut anything off in advance — the text says so explicitly.

VPNs on this list are new. TorrentFreak wrote on 21 September that the Issa draft it had reported on in June 2025 covered only broadband providers and DNS services.

How a VPN service would comply

The text does not say, and on purpose: the service chooses the method. TorrentFreak pointed to two obvious readings of “access from the United States”:

• shut the site off on its own servers in the United States — then it does not open for anyone connected through a US server, wherever that person connects from;
• shut the site off for everyone connecting from a US IP address, whichever server they use.

Which reading services would pick, if the bill passes, nobody knows yet.

Where it stands

• Introduced on 14 September 2026 by Republican Darrell Issa of California and referred the same day to the House Judiciary Committee. According to the bill’s page at Congress as of 23 September, nothing else has happened, and there are no cosponsors.
• No press release. We found none on Issa’s website on 23 September; TorrentFreak also wrote on 15 September that his office had not issued one.
• It is not the only one. According to CNews, Representative Zoe Lofgren introduced a similar bill in January 2025, and Senator Thom Tillis proposed his own in the summer of 2025.
• It is a long way from law. The text has to pass the committee and both chambers of Congress and be signed by the President. It can change at every step, including the list of services, the threshold and the deadlines.

It has happened before: France

Ordering a VPN service to shut off a site is not an American invention. In May 2025, TorrentFreak reported, a Paris court acting on a Canal+ case ordered NordVPN, CyberGhost, ProtonVPN, ExpressVPN and Surfshark to shut off access for users in France to about 200 addresses of pirate sports streams — until the end of the English Premier League season. The court treated VPNs as “technical intermediaries” able to help the rights holder.

The French order and the US bill share one thing: they do not ban VPNs, they put them next to broadband providers. A VPN becomes one more point through which a court can shut off a specific site for people in its own country.

What it means if you are in Russia

• Directly — nothing. The bill is about access from the United States, about US court orders and about sites a court has declared piracy sites. And it has not passed.
• It is not a VPN ban. The text forbids neither using a VPN nor offering one. It adds a duty for large services to carry out specific court orders.
• Indirectly — possibly, through a US server. If a service picks the first reading and shuts sites off on its US servers, a site named in an order stops opening through those servers for everyone, including people connecting from Russia. This is only about sites a court has declared piracy sites.
• The law is not the only rulebook. A service can forbid things on its own without any law — torrents, for example (we do). That goes in its terms, and they are worth reading.

What to look for when choosing a service

The news is a good reason to reread the rules of the service you use. Here is what to find in its documents rather than in its ads:

1. What is recorded and for how long. Not a one-line “we keep no logs”, but a list: what data, why and for how long. If there is no policy with such a list, that is an answer too.
2. Which law the service works under and when it hands data over. This is usually one line in the privacy policy. The law it is written under tells you more than the flag on the home page.
3. What it does on a rights-holder complaint. Whether torrents are allowed, what happens to the account after a complaint, and whether you will be warned.
4. Who is behind it and how to reach them. A support address, the personal data operator, documents with a revision date.

How it works at Mayak

Only what our documents say:

• We do not record the contents of your traffic or the sites you open. There are technical logs: for example, the IP address and time of requests to our servers are kept for 90 days. The full list with retention periods is in the Privacy Policy.
• The policy is written under Russian Federal Law No. 152-FZ on personal data. We do not disclose personal data to third parties except where expressly required by law — upon a lawful request from authorised bodies. That is exactly what it says.
• Torrents and other file sharing are not allowed. Rights-holder complaints arrive at our addresses; on a justified complaint access is suspended, but we try to write to you and sort it out first. More in the help centre.
• We make no promises about how the bill would affect us. It has not passed, and the text can still change.

What we checked

• The text of the bill. On 23 September 2026 we read the introduced version in full on the US Government Publishing Office website (govinfo.gov). The deadlines, threshold, exclusions and amounts in this article come from there.
• Its status. The introduction date, committee, cosponsors and date of the last update were checked against the bill’s page at Congress (congress.gov) through Congress’s official API: the web page itself did not load for us.
• A press release. We went through the list of releases on Issa’s website on 23 September — nothing about the bill.
• Reports. TorrentFreak of 15 and 21 September 2026 and of 16 May 2025 (France), CNews of 16 and 22 September 2026. What comes from the outlets rather than from the bill’s text is labelled as such.
• Our own rules. From our Privacy Policy and help centre as of 23 September 2026.

What we do not know

We try to make sure nothing more can be read out of our text than it contains.

• Whether the bill passes, and in what form. We make no forecasts.
• How services would comply: on their US servers or by US IP addresses.
• How a US court would enforce an order against a service from another country. The text does not say a word about it.
• Whether something similar appears in other countries. We know about France; we have not checked other countries.
• The legal side. We retell the text of a bill; we do not give a legal assessment.

Short answers

Will the US ban VPNs? No. The bill forbids neither using a VPN nor offering one. It obliges large services, on a court order, to shut off access from the United States to specific piracy sites.

Has the US VPN law passed? No. It was introduced and referred to a committee on 14 September 2026; as of 23 September nothing else had happened.

Which VPNs would it affect? Those with at least 100,000 monthly users in the United States — and only if a court names the service in an order about a specific site.

How much time would a service get? 14 to 30 days from the day it receives the order. For live broadcasts and premieres the court can shorten that.

Does it affect users in Russia? Not directly: it is about access from the United States. Indirectly — if a service shuts off sites named in orders on its US servers: then those sites will not open through them for anyone.

What are “commercially reasonable steps”? Those are the words of the text. The bill does not say which steps, and bars the court from choosing them: the service chooses the method.

Does it concern Mayak? The bill has not passed, and we make no promises. What we record and when we hand data over is written in our policy, and torrents are not allowed with us without any law — more above.