'VPNs at Risk': Tech Coalition Pushes Back on Piracy Blocking Duties for VPNs

A report from the Internet Infrastructure Coalition (i2Coalition) warns that poorly targeted regulation forcing VPNs to block pirate sites will weaken core security infrastructure and create harmful side effects for lawful users. The report highlights French court orders that compelled NordVPN, CyberGhost, Surfshark, ExpressVPN and Proton VPN to block 203 sports-streaming domains at Canal+’s request and notes additional orders and pending appeals, including pauses while France’s Cour de cassation weighs related DNS cases. In the U.S. context it contrasts two competing bills: the American Copyright Protection Act, which would empower courts to order ISPs, DNS resolvers and VPNs to block foreign pirate sites, and DEFEND IP, which explicitly excludes services that only offer VPNs. i2Coalition’s membership spans major cloud and VPN providers and includes a VPN Trust Initiative with ExpressVPN, NordVPN and Surfshark.

The report urges policymakers to “target the right layer,” focusing obligations where meaningful knowledge and control actually exist rather than imposing duties on general-purpose infrastructure. It stresses that consumer VPNs and corporate networks share protocols like OpenVPN and WireGuard, so network-level interventions cannot reliably distinguish lawful from illicit uses - citing reported Russian protocol blocks as an example. Citing the U.S. Supreme Court’s Cox ruling, the report argues that liability based on possible misuse would push providers toward user terminations and heavy-handed interventions. It recommends precise, proportionate rules, independent audits, cooperation with legal processes and early involvement of technical experts; it notes the report does not yet analyze pending U.S. legislation in depth but will continue to follow developments.