Would the RESTRICT Act criminalize the use of VPNs? Here’s what to know about the bill

As Congress contemplates a potential ban on the popular social media app TikTok, some Americans are already considering ways around such a prohibition. But would, for example, using a virtual private network to access TikTok result in a long prison sentence and hefty fines? Not exactly. Let’s take a deeper look at the legislation in question.

A federal bill that could ban TikTok is stoking confusion and inspiring misleading claims.

The Restricting the Emergence of Security Threats that Risk Information and Communications Technology Act, or RESTRICT Act, aims to mitigate national security threats posed by technology controlled by foreign adversaries, like TikTok.

The bill, introduced in March by Sens. Mark Warner, D-Va., and John Thune, R-S.D., is focused on threats from foreign adversaries. But some social media users, politicians and political pundits claim everyday Americans will also be targeted.

An April 11 Instagram reel claimed the RESTRICT Act would allow the United States government to "charge you with a felony and $1 million for having a VPN."

This post was flagged as part of Meta’s efforts to combat false news and misinformation on its News Feed. (Read more about our partnership with Meta, which owns Facebook and Instagram.)

Tulsi Gabbard, an independent who was once a Democratic representative for Hawaii, made a similar claim, saying the RESTRICT Act criminalizes the use of VPNs, with severe penalties for violators.

However, these claims lack context about the RESTRICT Act’s scope and how the measure could change as it progresses through Congress.

The RESTRICT Act, Senate Bill 686, would give the commerce secretary broad power to regulate technology owned or controlled by six countries that have adversarial relationships with the U.S.: China, Cuba, Iran, North Korea, Russia and Venezuela.

Under this legislation, the Commerce Department would have the authority to "identify, deter, disrupt, prevent, prohibit, investigate and mitigate transactions" involving information and communications technology products and services linked to a foreign adversary "that pose an undue or unacceptable risk to U.S. national security or the safety of U.S. persons."

The bill does not mention TikTok, and its passage does not guarantee the social media app will be banned.

Warner and Thune have shared concerns that TikTok, which is owned by the Chinese company ByteDance, could share user data with China and threaten national security in the U.S. But unlike other legislation aimed at restricting TikTok, Warner and Thune’s bill takes a broader approach that doesn’t single out any particular app or technology.

"We need a comprehensive, risk-based approach that proactively tackles sources of potentially dangerous technology before they gain a foothold in America, so we aren’t playing Whac-A-Mole and scrambling to catch up once they’re already ubiquitous," Warner said when announcing the bill.

The bill was introduced in the Senate and has been referred to the Committee on Commerce, Science and Transportation. It has not yet been debated or voted on. Besides Warner and Thune, two dozen senators from both parties had sponsored the bill, as of April 19.

The White House also endorsed the bill when it was introduced, calling it "a systematic framework for addressing technology-based threats to the security and safety of Americans."

Some of the bill’s critics claim that if the RESTRICT Act becomes law, it would make using a VPN illegal. This is misleading.

A VPN provides an encrypted connection over the internet from a device to a network. This connection allows for the transmission of sensitive data by preventing unauthorized people from eavesdropping on the traffic.

Corporations have long used VPNs to let employees securely access company data and resources, especially if employees are working remotely. People also can use VPNs to skirt content restrictions and access movies or TV shows that aren’t available on streaming services in their country but are offered in other locations.

The words "virtual private network" or "VPN" are not mentioned anywhere in the 55-page RESTRICT Act.

However, some data privacy and national security experts are concerned that if the measure becomes law, TikTok could be banned and any attempts to evade the ban, such as by using a VPN, would be made unlawful.

Featured Fact-check

Social Media

stated on October 4, 2024 in social media posts

FEMA, FAA are “blocking” delivery of Starlink devices and supplies to North Carolina’s hurricane-hit areas.

The penalties provision of the bill states that it is unlawful for "a person to violate, attempt to violate, conspire to violate or cause a violation of" any regulation, mitigation measure or prohibition issued under the RESTRICT Act.

"A person who willfully commits, willfully attempts to commit, or willfully conspires to commit, or aids or abets in the commission of" an unlawful act described in the bill could face, upon conviction, a fine of up to $1 million, 20 years of imprisonment, or both.

"That provision of the bill could be used to criminalize the use of a VPN to access TikTok with up to 20 years in prison and $1 million in fines," said Ashley Gorski, senior staff attorney with the American Civil Liberties Union’s National Security Project.

The Instagram post takes this concern out of context, though, purporting that simply having a VPN would lead to a felony charge and a $1 million fine under the RESTRICT Act.

Warner and Thune have both repeatedly rebutted the claim that their measure would criminalize VPN usage. In a co-authored opinion column for The Wall Street Journal, the lawmakers said the criminal penalties in their bill "are targeted at corporations and executives who conspire to evade a mitigation order or ban — not everyday Americans."

Warner’s spokesperson also told PolitiFact the claim was "absolutely not accurate. Full stop." Thune’s spokesperson concurred, saying the claim was "unequivocally untrue."

However, it’s difficult to say what the RESTRICT Act will be used for or how it will be enforced, said Sarah Philips, campaigner for Fight for the Future, a nonprofit advocating for digital rights.

"A bill with little precedent, and no cases to compare to, means that we have to rely on a plain reading of the bill. And that language is unbelievably vague," Philips said. "This is why we see an uptick of frustration and fear across the internet."

An Instagram post claimed the RESTRICT Act would allow the U.S. government to "charge you with a felony and $1 million for having a VPN."

The bill, which has not yet been voted on, aims to mitigate national security threats posed by technology controlled by certain foreign countries. The bill does not mention "virtual private networks" or "VPNs."

Some experts worry the bill could ban TikTok and criminalize attempts to circumvent such a ban, such as by using a VPN to access TikTok. But the bill’s sponsors said the measure’s criminal provisions are aimed not at individual people, but at corporations and executives.

The bill does not criminalize simply having a VPN. The claim contains an element of truth but ignores critical facts that would give a different impression. We rate this claim Mostly False.