That new anti piracy bill contains a 100k subscriber threshold that accidentally exempts shady free VPNs

There’s a bizarre quirk in the text of Representative Darrell Issa’s, American Copyright Protection Act that Gizmodo highlighted and it reveals how out of touch the drafting team was with how consumer VPNs actually function.

Under the proposed rules, network intermediaries including commercial VPNs would have to comply with court ordered DNS and IP blocks against foreign piracy domains but only if the provider maintains at least 100,000 monthly active users in the US.

If a provider sits below that 100k subscriber mark, they are completely exempt from the enforcement mandate.

The practical outcome of that arbitrary cutoff is wild:

1. Established providers get stuck with compliance overhead: Paid, audited, transparent zero log providers like Mullvad, Proton, and Nord easily clear 100k US users, meaning they would bear the full administrative burden of maintaining dynamic court ordered blocklists.
2. Shady free VPNs operate completely untouched: The endless sea of unverified, ad supported, data harvesting free VPN apps that flood the mobile app stores, many of which have been repeatedly flagged for operating out of untraceable shell companies fall well below individual subscriber thresholds or simply refuse to track user metrics altogether.

So if the goal of the bill is to stop users from routing around domain blocks, its actual mechanics end up giving users a direct incentive to switch away from transparent, independently audited paid providers and move toward unvetted free VPNs that sit outside the law's reach.