The American Copyright Protection Act of 2026 (ACPA) would compel ISPs, DNS providers, and VPNs to block access to foreign piracy sites under a standard court-issued order that would take effect in 14 to 30 days. A special provision targets "time-sensitive events" such as live sports or shows, allowing a judge to shorten the deadline as long as the first instance of piracy occurs within 24 hours of the content going live.
Blocking at the ISP and DNS level is relatively straightforward for most users who rely on their provider's default DNS. The bill also covers third-party DNS services like Google DNS and Cloudflare's 1.1.1.1, which would have to ignore certain resolution requests from U.S. users. Small ISPs and services with fewer than 100,000 monthly users are exempted, as are root DNS and top-level domain providers. The legislation does not specify a mandated blocking method, raising the possibility that providers may take a heavy-handed approach to avoid liability. It also makes no mention of protecting or nullifying encryption.
The most significant ambiguity involves VPNs and how the law defines "from the United States." The bill does not clearly state whether a connection originates from a U.S. subscriber abroad, a VPN endpoint located in the U.S., or a user inside the country routing through a foreign VPN. Additional questions arise around multi-hop VPNs, shared IPs, carrier-grade NAT, and roaming users. These technical complexities have led to speculation about how the law would be enforced in practice without overreaching.