Tech coalition with Google and Cloudflare warns against making VPNs block pirate sites
The Internet Infrastructure Coalition (i2Coalition), a trade group whose members include Amazon, Cloudflare and Google, has published a report arguing that piracy blocking duties for VPN providers can hit far more than consumer VPN apps. The report, "VPNs at Risk", was released on 21 October, Global Encryption Day. It is run by the coalition's VPN Trust Initiative, whose founding members include ExpressVPN, NordVPN and Surfshark, so the industry is making the case on its own behalf.
"VPNs are part of the security architecture people and businesses depend on every day," said Christian Dawson, the coalition's executive director.
The report says consumer and corporate VPNs share the same plumbing
The core argument is technical. A company's remote access, a tunnel between two offices and a consumer VPN service can all run on the same protocols, such as WireGuard and OpenVPN. Measures that try to identify or block VPN traffic by protocol, port or IP address "may be less able to distinguish among different uses of the same technology", the report says. Duties placed on the data centres and cloud providers that host VPN servers can also spill over to other customers.
The second argument is about liability. The report cites the US Supreme Court's 2026 ruling in Cox v. Sony, which held that knowing some customers misuse a service is not enough on its own for contributory infringement. "If providers face liability merely because general-purpose services can be misused, they may have strong incentives to terminate users, restrict access, or intervene preemptively," it warns.
France is the report's main example of this kind of obligation spreading. In May 2025 a Paris court ordered NordVPN, CyberGhost, Surfshark, ExpressVPN and Proton VPN to block 203 pirate sports streaming domains at the request of Canal+, and more orders followed. The report describes how obligations "imposed at one layer of the Internet can migrate to another" once users find a way around a block, and notes that IP and domain blocking can also take out lawful services that share an address with the target.
The other case studies are less about piracy. India's 2022 data retention rules pushed ExpressVPN, Surfshark and NordVPN to pull their servers out of the country. Russia has reportedly blocked OpenVPN and WireGuard at the network level. The UK went the other way: after the House of Lords voted in January 2026 to ban commercial VPNs for children, the government looked at the evidence, found that children do not widely use VPNs to get past age checks, and chose a different approach.
The US bills are not in the report yet
In Washington, two competing site blocking bills are pending, TorrentFreak notes. Representative Darrell Issa's American Copyright Protection Act would let courts order ISPs, DNS resolvers and VPN providers with at least 100,000 monthly US users to block foreign pirate sites. The DEFEND IP Act from Representative Zoe Lofgren and Senator Thom Tillis explicitly excludes services that only offer VPNs. The report mentions neither. "We expect to revisit US legislation in a future update as the debate develops," Dawson told TorrentFreak. Issa retires at the end of the year and Tillis leaves the Senate in January, so both bills would have to move before the current session closes.
The report does not ask for a blanket exemption for VPNs. It asks lawmakers to identify the specific harm, show evidence that a measure would reduce it, and place obligations on whoever "can reasonably know, control, and address" the problem, consulting technical experts early. It also has a list for providers: independent audits, transparency reports and cooperation with legitimate legal processes. The coalition calls the report a living document and plans to update it as French and US cases develop.
