Verifying claims about the RESTRICT Act and VPN use for restricted apps or sites

A bill in Congress called the RESTRICT Act has made headlines in recent months over claims that it could result in a ban on the popular social media app TikTok.

But some people online say the legislation could have a broader impact. A viral video on TikTok and some viral tweets claim the bill would make it illegal to use a virtual private network, or VPN, to access restricted apps or websites.

Several VERIFY readers also asked how the RESTRICT Act would affect VPN use.

THE QUESTION

Would the RESTRICT Act make it illegal to use a VPN to access restricted apps or websites?

THE SOURCES

• RESTRICT Act
• Rachel Cohen, communications director for U.S. Sen. Mark Warner (D-Va.)
• Willmary Escoto, U.S. policy analyst for the nonprofit Access Now
• Electronic Frontier Foundation, a nonprofit focused on defending civil liberties in the digital world

THE ANSWER

The RESTRICT Act does not explicitly ban VPNs or impose criminal penalties on people who use them. 

One of the bill’s sponsors says it would be used to punish companies – not individual users accessing a potentially-banned app like TikTok. But some experts say the bill’s broad language leaves room for doubt about the types of technology and users it would impact.

WHAT WE FOUND

The “Restricting the Emergence of Security Threats that Risk Information and Communications Technology Act,’’ or the ‘‘RESTRICT Act,” was introduced in the Senate on March 7, 2023. 

The bill would give the Secretary of Commerce broad authority to “identify, deter, disrupt, prevent, prohibit, investigate, or otherwise mitigate” any “transaction” by information, technology, or communications companies that are owned or could be influenced by foreign adversaries.

If the bill does become law, it does not guarantee that apps owned by foreign countries, such as TikTok, would be banned for all users in the U.S. But it is a possibility, as VERIFY previously reported. 

More from VERIFY: No, the U.S. has never placed a total ban on a foreign app

The RESTRICT Act does not explicitly ban VPNs or impose criminal penalties on people who use them. In fact, the bill’s text never includes the words “virtual private network” or “VPN.”

A virtual private network (VPN) is an encrypted connection over the Internet from a device to a network that prevents unauthorized people from eavesdropping on the traffic. People use VPNs for a variety of reasons, including protecting their data from hackers or accessing streaming services in other countries. 

A spokesperson for U.S. Sen. Mark Warner (D-Va.), who introduced the bill, said the legislation is aimed “squarely at companies like Kaspersky, Huawei and TikTok that create systemic risk to the United States’ national security – not at individual users.”

“The threshold for criminal penalty in this bill is incredibly high – too high to ever be concerned with the actions of someone [who is] an individual user of TikTok or a VPN,” Rachel Cohen, Warner’s communications director, said.

But some experts say the bill’s broad language leaves room for doubt about the people and types of technology it would impact. 

“While the RESTRICT Act does not explicitly outlaw the use of VPNs, it is drafted broadly enough to raise concerns that using a VPN to access TikTok or other services restricted in the US under the Act could result in severe consequences,” Willmary Escoto, a U.S. policy analyst for the nonprofit Access Now, said in an email.

Experts with the Electronic Frontier Foundation, which has voiced opposition to the bill, also said it “can be read as criminalizing common practices like using a VPN to get a prohibited app, side-loaded installations, or using an app that was lawfully downloaded somewhere else.”

Many people who have raised concerns about certain types of VPN use becoming illegal are referring to Section 3 of the bill, Escoto said. 

Cohen said that, under the terms of the bill that are outlined in this section, “someone must be engaged in ‘sabotage of subversion’ of American communications technology products and services, creating ‘catastrophic effects’ on U.S. critical infrastructure, or ‘interfering in, or altering the result’ of a federal election, in order to be eligible for any kind of penalty.”

Escoto said this is “questionable” considering a “catch-all” in the text of the bill, which says its terms could apply in cases where technology “otherwise poses an undue or unacceptable risk to the national security of the United States or the safety of United States persons.” 

She also expressed concerns about the section of the bill that outlines penalties for violating the act. It says in part that, “No person may engage in any transaction or take any other action with the intent to evade the provisions of this Act.”

“This language could be interpreted to criminalize a wide range of activities, including using a VPN to access restricted sites,” Escoto said.

The civil penalties for violating the act include a fine of up to $250,000 or “an amount that is twice the value of the transaction that is the basis of the violation,” whichever is greater. 

Criminal penalties include a fine up to $1 million, up to 20 years in prison, or both.