That threshold, buried in the bill’s text, redraws the entire picture. It captures the paid privacy providers most Americans have heard of and use, and it leaves the free VPN apps, many of them owned by Chinese companies according to recent industry research, effectively outside the law’s reach. The result, if the bill passes as written, is a regulatory framework that hits the services designed for privacy and skips the ones that already were the biggest privacy problem on the market.
What the 100,000-Subscriber Threshold Actually Does
A VPN provider that clears 100,000 monthly US subscribers becomes a “covered service” and must comply with judicial blocking orders. Providers below that line sit outside the coverage entirely. That carves out the ecosystem of free and freemium VPN apps that dominate App Store and Google Play download charts, including several flagged in recent research as being owned or operated by Chinese-linked entities.
NordVPN’s Laura Tyrylyte put it directly in a public comment: the measure “primarily target[s] reputable, paid VPN providers, leaving free VPN services largely untouched.” If the stated goal of the ACPA is to stop foreign piracy, the mechanics push users away from audited, transparent providers and toward the ones that operate on ad revenue and undisclosed data sales.
The Low Evidentiary Bar and the 14-Day Clock
The court process moves fast. A copyright holder petitions a designated federal judge, and the court decides whether a target qualifies as a “foreign piracy site” using a “preponderance of the evidence” standard, the lowest evidentiary threshold in US civil law. Covered service providers then have 14 days to object before the blocking order takes effect. The bill also allows expedited timelines for time-sensitive material, with live sports specifically cited.
Public Knowledge’s Meredith Rose warned that the standard would force providers “to disrupt traffic from targeted websites simply accused of copyright infringement.” Re:Create’s Brandon Butler called the bill a measure that “violates American due process, First Amendment rights, and American ingenuity.”
The $250,000 “Oops” Clause
The bill includes a provision that lets a wrongly blocked website claim up to $250,000 in damages. That number implies the drafters know the framework will make mistakes. The precedents from Europe suggest they will not be rare. In Italy, innocent websites remained blocked for an average of 320 days under a similar expedited system. In Spain, more than 500,000 websites were wrongly blocked during LaLiga matches under a court order covering live sports, precisely the category the ACPA singles out for expedited treatment.
For a small independent site, $250,000 does not offset a year offline. For a large piracy site the framework is aimed at, it is a rounding error.
Choose a VPN That Publishes Who Owns It
Why the Loophole Matters for Everyone Who Isn’t a Copyright Lawyer
A regulation that only reaches paid, audited VPN providers with 100,000+ US subscribers hits the small set of services that already do the things regulators say they want VPNs to do: disclose ownership, publish independent no-logs audits, operate under a jurisdiction the public can verify. The free VPN category, which sits above 13 million monthly US downloads according to recent industry data, is what remains untouched. That is the market where the tracker-heavy apps, the shell-company ownership structures, and the aggregated ad-tech data sales actually live.
If the ACPA passes as drafted, the incentive for a US consumer changes. Staying with a transparent paid provider means using a service subject to a fast-moving blocking regime. Switching to a free VPN means using a service that isn’t. The security tradeoff is the opposite of what the bill’s supporters describe.
Where NordVPN Fits
The reason NordVPN keeps landing near the top of most credible best VPN comparisons is that it satisfies the checks the ACPA implicitly assumes matter: disclosed corporate ownership under Nord Security, headquartered in Panama outside the Five, Nine, and Fourteen Eyes intelligence alliances, and a no-logs policy audited multiple times by independent firms. The bill treats the transparent providers as the regulated category. The market currently rewards them the same way.
NordVPN Basic at $3.49 per Month
NordVPN’s Basic plan is available at $3.49/month, which works out to $94.23 billed once for 27 months of service (24 + 3 free). That is a 69% discount off the standard rate, with annual renewal at $139.08/year, cancelable at any time. The plan covers up to 10 devices with apps for Windows, macOS, Linux, iOS, Android, browsers, and router installation. Every plan is backed by a 30-day money-back guarantee, refunded through 24/7 chat support within 5 to 10 business days.