The DEFEND IP Act to Stop Piracy: VPNs Get Free Pass

Lawmakers in Washington are once again trying to police the internet, but their latest effort fundamentally misunderstands how modern internet traffic works.

Senator Thom Tillis and Representative Zoe Lofgren recently introduced the DEFEND IP Act (Deterring Extraterritorial Foreign Exploitation of Networks Damaging Intellectual Property). Backed heavily by Hollywood lobbying groups like the MPA and RIAA, the bill is designed to force major internet service providers (ISPs) and massive DNS resolvers (like Google and Cloudflare) to block access to “foreign digital piracy sites” via court orders.

On paper, this sounds like a formidable anti-piracy wall. In reality, it’s a technological sieve. The architects of this bill have left a glaring backdoor wide open: virtual private networks (VPNs) like Surfshark are explicitly exempt.

The Fatal Flaw: The VPN Loophole

Unlike a competing bill (the ACPA introduced by Rep. Darrell Issa), the DEFEND IP Act deliberately excludes VPN providers from its blocking mandates. The legislation’s language gives a free pass to any entity that “exclusively provides virtual private network services or similar service that encrypt and route user traffic through intermediary servers.”

By exempting VPNs, lawmakers have essentially built a multi-million-dollar wall but left the front gate completely unlocked.

How Surfshark and Other VPNs Instantly Defeat the Bill

If the DEFEND IP Act passes, tech-savvy users—and anyone motivated enough to spend a few dollars a month—will bypass these restrictions with a single click. Here is exactly why the bill’s approach is technologically toothless against a standard commercial VPN like Surfshark:

1. Bypassing ISP Blocks: The bill forces ISPs (with over 50,000 subscribers) to block traffic to known pirate sites. However, when you connect to a VPN like Surfshark, your device creates a heavily encrypted tunnel directly to the VPN server. Your ISP can only see that you are sending encrypted data to a Surfshark server; they have absolutely no visibility into the final destination (the blocked website). If they can’t see what you’re accessing, their court-ordered blocks are entirely useless.
2. Bypassing DNS Filtering: The bill also targets major public DNS resolvers, forcing them to stop translating pirate web addresses into IP addresses. But commercial VPNs operate their own private, encrypted DNS servers. When a user is connected to Surfshark, their DNS requests never go to Google, Cloudflare, or their ISP. They are handled internally by the VPN, cleanly side-stepping the government’s DNS blockade.
3. Location Spoofing: Because the bill targets foreign digital piracy sites, a user can simply use their VPN to route their traffic through a server in a country where the site isn’t blocked, effectively rendering US jurisdiction irrelevant to their browsing session.

Censorship Infrastructure for Nothing

Digital rights groups like Public Knowledge have rightly pointed out that the DEFEND IP Act builds an “expansive infrastructure for censorship” rather than addressing the root causes of piracy. But perhaps the most damning critique of the bill isn’t just that it risks collateral damage to the open internet—it’s that it won’t even work.

The lawmakers have created a system that will inevitably result in endless, expensive court battles to issue blocking orders that anyone can bypass by simply toggling their Surfshark app to “On.” In their rush to appease rights-holders, Congress has drafted a 2010s-era solution for a 2026 internet, ignoring the reality that encryption and proxy routing make localized site-blocking virtually impossible to enforce.