The trade body for internet infrastructure companies has published a report arguing against turning neutral network services into instruments of copyright enforcement, as courts in Europe and lawmakers in Washington consider doing exactly that.
VPNs at Risk was published by the Internet Infrastructure Coalition, known as i2Coalition, on Global Encryption Day, and follows last year's DNS at Risk. The coalition's members include Amazon, Cloudflare and Google; its VPN Trust Initiative counts ExpressVPN, NordVPN and Surfshark among its founding members.
Its central argument is that duties imposed at one level of the network tend to move to another. "Obligations imposed at one layer of the Internet can migrate to another," the report says, as users find other technical paths around court-ordered restrictions.
It argues that lawmakers should instead target the layer where control actually sits. "Obligations should therefore reflect what an intermediary can reasonably know, control, and address," the report says. The further an intervention moves from the activity being regulated, the greater the risk to unrelated users.
Two bills before Congress bear on the question. The American Copyright Protection Act, introduced by Representative Darrell Issa, would let courts order internet providers, DNS resolvers and VPNs to block foreign pirate sites, and would name VPN providers with 100,000 or more monthly US users or subscribers. The DEFEND IP Act, introduced days later by Representative Zoe Lofgren and Senator Thom Tillis, explicitly excludes services that only offer VPNs. Both remain pending.
In Europe the duties are already live. In May 2025 a Paris court ordered NordVPN, CyberGhost, Surfshark, ExpressVPN and Proton VPN to block 203 pirate sports streaming domains at Canal+'s request, and further orders followed.
On 30 September the Paris Court of Appeal stayed an appeal by NordVPN, Proton and CyberGhost against a similar order sought by the football league LFP, pending the Cour de cassation's ruling in related DNS blocking cases. A week later the Paris court refused beIN's request for daily penalties against VPN providers and Cloudflare, which had not fully blocked the targeted sites.
"They don't change our broader concern about the implications of extending blocking obligations to VPN providers," said Christian Dawson, the coalition's executive director, of the French cases.
The report also points to this year's Supreme Court ruling in the Cox case, which held that continuing to provide an internet service while knowing some customers may misuse it is not by itself enough for contributory copyright infringement. Dawson was careful about how far that reaches: "we aren't suggesting that the ruling automatically determines the outcome of every VPN case."
The report suggests providers build trust through independent audits, cooperation with legitimate legal processes and voluntary schemes such as the VPN Trust Initiative's Trust Seal. Russia's reported blocking of OpenVPN and WireGuard is cited as evidence of how hard it is to separate consumer from corporate use at the network level.
The coalition's own test deserves to be applied to the bill that prompted it. Obligations, the report says, should reflect what an intermediary can reasonably know. The American Copyright Protection Act would attach its obligations to VPN providers with 100,000 or more monthly American users.
A virtual private network is sold on the proposition that the provider knows as little as possible about who is using it and from where. The threshold asks each provider to establish how many Americans it has, monthly, among the people it has undertaken not to look at.
This newspaper regards the drafting as elegant. A provider that genuinely cannot tell falls below the threshold. A provider that can tell has demonstrated the very capability that made it worth regulating.
The Department of Unnecessary Research has drawn the operational conclusion for the industry. Independent audits, the report notes, are one route to trust. An audit confirming that a provider has no idea how many American users it has would also confirm that the Act does not apply to it.
The exemption, in other words, is the product.