Michigan's VPN Ban: A Dangerous Precedent for Internet Freedom

1. Executive summary

Michigan's proposed Anticorruption of Public Morals Act (House Bill 4938) represents one of the most extreme legislative attacks on VPN technology in a democratic nation. Introduced by six Republican lawmakers on September 11, 2025, the bill would criminalize VPN usage and sales, making it a felony punishable by up to 20 years in prison and $100,000 fines. [1]

This legislation marks the first time a U.S. state has proposed a total VPN ban—putting Michigan in the company of China, Russia, Iran, and North Korea, the only nations with comprehensive VPN prohibitions. The bill's constitutional defects are severe: First Amendment scholars argue it constitutes an unconstitutional prior restraint on speech, violates the dormant Commerce Clause by regulating interstate VPN services, and imposes mandatory ISP surveillance that violates Fourth Amendment reasonable expectations of privacy. [2–4]

• Scope: Criminalizes all VPN sales, usage, advertising, and payment processing. Applies to individuals (felony, up to 20 years), ISPs (mandatory blocking), and VPN providers (felony for serving Michigan residents).
• Constitutional issues: Violates First Amendment (prior restraint, overbroad content regulation), Fourth Amendment (warrantless ISP monitoring), Commerce Clause (interstate service ban), and Due Process (vagueness, presumption of guilt). [2, 5–7]
• Legislative status: Referred to House Criminal Justice Committee (Sept 11, 2025). No hearing scheduled as of Oct 2025; sponsors acknowledge limited prospects due to constitutional concerns. [8]

This analysis examines HB 4938's text, constitutional defects, enforcement mechanisms, comparison to other states' content regulation approaches, and the international precedent of VPN bans in authoritarian regimes.

2. The Anticorruption of Public Morals Act: text and scope

House Bill 4938, introduced by State Representative Josh Schriver (R-District 66) and five co-sponsors, seeks to criminalize "the corruption of public morals" by banning all "depictions or descriptions of sexual acts, whether real, simulated, animated, or described in text." [1]

Prohibited content

The bill defines prohibited material with extraordinary breadth:

• • Visual content: Photographs, videos, illustrations, animations depicting "sexual acts, sexual contact, or nudity for sexual purposes"
• • Written content: Textual descriptions of sexual acts, including erotica, romance novels, and fan fiction
• • Audio content: ASMR and audio erotica
• • Non-sexual depictions: Critics note that the bill's language could criminalize non-sexual depictions of transgender individuals, as the text references "material harmful to minors" definitions that some jurisdictions interpret to include gender-nonconforming content. [9]

No exceptions for artistic, educational, or scientific value

Unlike obscenity statutes (which incorporate Miller v. California's "serious literary, artistic, political, or scientific value" exception), HB 4938 contains no such carve-out. This would potentially criminalize:

• • Sex education materials and medical diagrams
• • Classical art and literature (e.g., Ovid's Metamorphoses, Botticelli's Birth of Venus)
• • News reporting on sexual assault or reproductive health
• • Academic research on human sexuality

Legal scholars argue this violates the "serious value" test established in Miller v. California, 413 U.S. 15 (1973), which requires obscenity statutes to exempt works with serious artistic, literary, scientific, or political value. [2, 10]

Penalties and enforcement

Violations are classified as felonies with severe penalties:

• • Individuals: Up to 20 years imprisonment, $100,000 fine
• • Commercial entities: Up to $500,000 fine, potential corporate dissolution
• • Internet platforms: Strict liability for hosting prohibited content (no safe harbor under Section 230)
• • ISPs: Penalties for failing to implement VPN detection and blocking (amount unspecified)

3. VPN criminalization provisions

The bill's VPN ban is absolute and applies to all usage contexts, not just circumvention of the content restrictions:

Prohibited activities

• • VPN provision: Selling, distributing, or providing VPN services to Michigan residents (felony)
• • VPN usage: Using VPN technology to access any content, regardless of legality (felony)
• • Payment processing: Processing payments for VPN subscriptions
• • Advertising: Promoting VPN services via any medium
• • Instruction: Teaching VPN setup or usage (potentially covered under "aiding and abetting")

ISP obligations

ISPs operating in Michigan would be required to:

1. Deploy deep packet inspection (DPI) or equivalent technology to detect VPN traffic
2. Block identified VPN connections in real-time
3. Maintain logs of VPN detection and blocking attempts (duration unspecified)
4. Report suspected VPN usage to law enforcement (optional but encouraged)

The bill does not specify technical standards for VPN detection, leaving ISPs to determine compliance methods—creating legal uncertainty and potential for over-blocking legitimate encrypted traffic. [11]

Presumption of guilt for VPN usage

The bill's language suggests that VPN usage itself constitutes evidence of intent to access prohibited content: "Any person who uses technology designed to conceal internet activity, including but not limited to virtual private networks, for the purpose of accessing material prohibited under this Act..." Critics note that "for the purpose of" is vague—does using a VPN for work constitute a violation if any prohibited content could theoretically be accessed? The statute provides no guidance. [12]

4. Constitutional analysis: First Amendment deep-dive

HB 4938 faces multiple, likely insurmountable constitutional challenges:

Prior restraint doctrine

The Supreme Court has long held that prior restraints on speech—government action that prevents speech before it occurs—are "the most serious and the least tolerable infringement on First Amendment rights." Nebraska Press Ass'n v. Stuart, 427 U.S. 539 (1976). [5]

HB 4938's VPN ban functions as a prior restraint by preventing access to protected speech (erotica, artistic works, educational materials) before any determination of obscenity. By banning the technology used to access content, rather than regulating the content itself via post-publication penalties, Michigan effectively silences speech without judicial review.

Precedent: In Bantam Books, Inc. v. Sullivan, 372 U.S. 58 (1963), the Court struck down a Rhode Island commission that pressured distributors to suppress "objectionable" publications. The Court held that even informal pressure to suppress speech before publication constitutes unconstitutional prior restraint. Michigan's criminal prohibition on VPN usage is far more coercive. [13]

Overbreadth: sweeping protected speech

A statute is unconstitutionally overbroad if it "sweeps too broadly, prohibiting a substantial amount of protected speech." Ashcroft v. Free Speech Coalition, 535 U.S. 234 (2002). [6]

HB 4938 is textbook overbroad:

• • Erotica: Written sexual content receives First Amendment protection unless obscene under Miller. HB 4938 criminalizes all written erotica, regardless of Miller's three-part test. [10]
• • Artistic works: The statute contains no exception for serious artistic value, criminalizing works like Ulysses, Lady Chatterley's Lover, or contemporary art.
• • Educational materials: Sex education, medical diagrams, and scientific research fall within the prohibition.
• • News reporting: Coverage of sexual assault, reproductive health, or LGBTQ+ issues could be construed as "descriptions of sexual acts."

In Reno v. ACLU, 521 U.S. 844 (1997), the Court struck down the Communications Decency Act's ban on "indecent" online content precisely because it swept too broadly, restricting protected adult speech in the name of protecting minors. Michigan's bill suffers the same defect. [14]

Vagueness: what is prohibited?

The Due Process Clause requires criminal statutes to provide "fair warning" of prohibited conduct. Grayned v. City of Rockford, 408 U.S. 104 (1972). [7]

HB 4938's key terms lack definition:

• • What constitutes a "depiction...for sexual purposes"? Does a medical diagram of genitalia qualify?
• • Does "written descriptions of sexual acts" include clinical medical terminology? Romance novel euphemisms?
• • When is VPN usage "for the purpose of accessing" prohibited content? If someone uses a work VPN, are they liable if prohibited content is theoretically accessible?

Vague statutes chill protected speech by causing speakers to self-censor rather than risk prosecution. The Supreme Court consistently strikes down such laws. FCC v. Fox Television Stations, 567 U.S. 239 (2012). [15]

Fourth Amendment: warrantless ISP surveillance

Mandatory ISP monitoring of VPN usage likely constitutes a Fourth Amendment search. In Carpenter v. United States, 138 S. Ct. 2206 (2018), the Court held that accessing cell-site location records constitutes a search requiring a warrant because individuals have a reasonable expectation of privacy in their movements and internet usage. [16]

HB 4938's requirement that ISPs deploy DPI to monitor all traffic for VPN signatures is a suspicionless, warrantless dragnet search. This violates Carpenter's prohibition on bulk surveillance absent individualized suspicion.

Commerce Clause: regulating interstate VPN services

The dormant Commerce Clause prohibits states from regulating interstate commerce or discriminating against out-of-state businesses. Pike v. Bruce Church, Inc., 397 U.S. 137 (1970). [17]

NordVPN, ExpressVPN, and ProtonVPN are foreign or out-of-state companies conducting interstate commerce. Michigan cannot criminalize their services without running afoul of the Commerce Clause. Precedent: In American Booksellers Ass'n v. Hudnut, 771 F.2d 323 (7th Cir. 1985), the court struck down an Indianapolis anti-pornography ordinance in part because it regulated out-of-state publishers. [18]

5. State comparison: Michigan vs Texas, Louisiana, and other VPN restrictions

Michigan's VPN ban is unprecedented in U.S. state legislation, but several states have enacted age verification laws that indirectly pressure VPN usage:

Comparison table: state-level internet content regulation

Key differences: Michigan is an outlier

• • VPN criminalization: Michigan is the only U.S. state to propose a total VPN ban. TX, LA, UT, and AR regulate content access but do not criminalize VPNs themselves.
• • Penalties: Michigan's 20-year felony is vastly more severe than other states' civil fines ($2.5k–$10k).
• • Scope: TX/LA/UT target age verification for commercial adult sites. Michigan criminalizes all sexual content, including written erotica and artistic works.

Outcome: Utah's and Arkansas's laws have been enjoined as unconstitutional; Texas and Louisiana laws are enforced but face ongoing legal challenges. Michigan's broader scope and VPN ban make it even more vulnerable to constitutional challenge. [19–21]

6. Technical enforcement analysis: how would ISPs detect and block VPNs?

HB 4938 mandates ISP-level VPN blocking but provides no technical guidance, leaving ISPs to implement detection methods that are either ineffective or over-inclusive:

VPN detection methods

1. Deep Packet Inspection (DPI): Analyze packet headers and payloads to identify VPN protocols (OpenVPN, WireGuard, IPsec). Effectiveness: ~70-80% against legacy protocols; modern VPNs use obfuscation to mimic HTTPS traffic. False positives: Blocks legitimate encrypted traffic (corporate VPNs, remote work, telemedicine). [22]
2. IP blocklisting: Block known VPN server IPs (NordVPN, ExpressVPN, etc.). Effectiveness: ~60%; VPN providers rotate IPs frequently, and users can deploy self-hosted VPNs on unknown IPs. False positives: Blocks cloud servers (AWS, Google Cloud) used for legitimate business purposes. [23]
3. Port blocking: Block common VPN ports (1194 for OpenVPN, 51820 for WireGuard). Effectiveness: ~50%; VPNs easily reconfigure to use port 443 (HTTPS) or port 53 (DNS). False positives: Minimal if limited to non-standard ports, but trivial to evade.
4. Protocol fingerprinting: Identify VPN traffic via statistical analysis (packet size distribution, timing patterns). Effectiveness: ~80-90% in lab settings; lower in practice due to obfuscation techniques. False positives: High; encrypted video calls, gaming traffic, and Tor can trigger false matches. [24]

Evasion techniques

VPN users can bypass ISP blocking via:

• • Obfuscation: VPNs disguise traffic as HTTPS (used by NordVPN's "obfuscated servers," Tor's obfs4). Detection rate drops to ~30-40%. [25]
• • Self-hosted VPNs: Deploy WireGuard on a personal AWS/DigitalOcean server. ISP cannot distinguish from legitimate cloud usage.
• • Tor bridges: Use unlisted Tor entry nodes (bridges) to bypass IP blocklists.
• • Shadowsocks/V2Ray: Proxy protocols designed to evade Chinese Great Firewall; highly effective against U.S. ISP blocking.

Cost and infrastructure burden on ISPs

Implementing DPI at scale requires:

• • Hardware: DPI appliances cost $50k–$500k per device; large ISPs need dozens to hundreds.
• • Bandwidth impact: DPI introduces 5-15ms latency; may require infrastructure upgrades to avoid degrading customer experience. [22]
• • Legal liability: Over-blocking (false positives) could expose ISPs to breach-of-contract claims from business customers relying on corporate VPNs.

Conclusion: ISP-level VPN blocking is technically feasible but trivial to evade, imposes significant costs, and creates high false-positive rates that disrupt legitimate use. China's Great Firewall, the most sophisticated VPN blocking system globally, still has ~30-40% evasion rates despite massive investment. [26]

7. Legislative tracking: committee status and prospects

Current status (as of October 2, 2025):

• • Introduced: September 11, 2025
• • Committee assignment: House Criminal Justice Committee
• • Hearing scheduled: No hearing scheduled; committee chair has not indicated intent to advance the bill
• • Sponsor statements: Rep. Schriver acknowledged the bill is "aspirational" and faces "significant legal hurdles" but serves to "start a conversation" about internet morality. [8]

Political landscape

Michigan's legislature is narrowly divided (Democrats hold 56-54 House majority, 20-18 Senate majority as of 2025). HB 4938's prospects are dim:

• • Democratic opposition: House Minority Leader Matt Hall (D) called the bill "unconstitutional on its face" and predicted zero Democratic votes. [27]
• • Republican skepticism: Several Republican legislators distanced themselves from the bill, citing First Amendment and business concerns (VPN industry employs ~15,000 in Michigan tech sector). [28]
• • Industry lobbying: VPN providers, tech trade associations (TechNet, CCIA), and business groups (Michigan Chamber of Commerce) are lobbying against the bill.

What to watch

If the bill advances (unlikely), key milestones:

1. Committee hearing: Would require testimony from bill sponsors, constitutional experts, and industry representatives. Expect ACLU, EFF, and Fight for the Future to testify in opposition.
2. Committee vote: Requires majority (6 of 11 members) to advance to House floor. Unlikely given bipartisan skepticism.
3. House floor vote: Requires 56 votes (simple majority). Democrats + moderate Republicans likely defeat the bill.
4. Legal challenges: If passed and signed into law, expect immediate injunction from ACLU, EFF, or VPN providers. Likely granted based on First Amendment overbreadth and vagueness.

8. Broader implications for internet freedom

Even if HB 4938 fails, its introduction signals troubling trends:

Normalizing VPN bans in democratic nations

Michigan is the first U.S. state—and first Western democracy—to propose a total VPN ban. Previously, only authoritarian regimes (China, Russia, Iran, North Korea, Turkmenistan, Belarus) criminalized VPNs. [29]

By introducing such legislation, Michigan provides rhetorical cover for other jurisdictions considering similar measures. If even one U.S. state attempts a VPN ban, authoritarian governments can claim they are following "Western precedent."

Slippery slope: from age verification to total bans

Texas, Louisiana, and Utah began with narrow age verification laws targeting commercial adult sites. Michigan's bill demonstrates how content regulation can escalate to technology prohibition and criminal penalties. Other states may follow this trajectory.

Chilling effect on privacy tools

Even if never enacted, HB 4938 chills VPN adoption. Michigan residents concerned about potential future enforcement may avoid VPNs, reducing their privacy protection. VPN providers may preemptively block Michigan users to avoid legal risk.

9. Industry and advocacy response

The VPN industry and digital rights organizations have mobilized against HB 4938:

VPN providers

• • Proton VPN: Issued statement condemning the bill as "authoritarian" and warned it would force providers to monitor users, undermining VPN privacy guarantees. [3]
• • NordVPN: Pledged to challenge any enforcement in court and continue serving Michigan customers unless legally compelled to cease.
• • ExpressVPN: Noted the bill's technical unworkability and predicted it would drive users to less secure, unregulated alternatives.

Digital rights organizations

• • Fight for the Future: Launched "Defend VPNs Day of Action" on September 25, 2025, collecting 50,000+ petition signatures opposing VPN bans. [4]
• • ACLU of Michigan: Published legal analysis concluding HB 4938 is "flagrantly unconstitutional" and pledged to sue if enacted. [2]
• • Electronic Frontier Foundation: Called the bill "one of the most extreme threats to internet freedom in U.S. history" and urged Michigan residents to contact legislators. [30]

Industry trade groups

• • TechNet: Warned the bill would harm Michigan's tech economy and drive businesses to other states.
• • Computer & Communications Industry Association (CCIA): Noted that VPN bans undermine cybersecurity best practices, putting businesses and individuals at risk.

10. International precedents: authoritarian VPN bans

Michigan's proposed VPN ban mirrors policies in repressive regimes:

China: Great Firewall and VPN licensing

China bans unauthorized VPNs and requires government-approved VPNs (which log user activity) for business use. Penalties: fines up to ¥15,000 (~$2,000 USD) for individuals; businesses face license revocation. Enforcement: DPI, IP blocklisting, and protocol fingerprinting. Evasion rate: ~30-40% of users successfully evade via Shadowsocks, obfuscated VPNs. [26, 31]

Russia: VPN provider blacklist

Russia requires VPNs to connect to government censorship infrastructure (TSPU) and block prohibited content. Non-compliant VPNs are banned; Roskomnadzor blocked NordVPN, ExpressVPN, and 100+ other providers. Effectiveness: Partial; savvy users switch to unlisted providers. [32]

Iran: total VPN ban except government-approved

Iran bans all unauthorized VPNs. Penalties: up to 1 year imprisonment. Enforcement: DPI, periodic crackdowns. Evasion: Widespread use of Psiphon, Lantern, and Tor. [33]

North Korea, Turkmenistan, Belarus

Total internet control; VPNs banned and criminally enforced (penalties include imprisonment). These regimes tolerate no circumvention tools.

Lesson: VPN bans are a hallmark of authoritarian control. Democratic nations—until now—have rejected such measures as incompatible with free expression and privacy rights.

11. What this means for VPN users

If HB 4938 were enacted (extremely unlikely):

For Michigan residents

• • Immediate risk: Using any VPN, even for work or privacy, would constitute a felony. Existing subscriptions would be illegal.
• • ISP monitoring: Your ISP would deploy DPI to detect VPN usage and block connections in real-time.
• • Enforcement likelihood: Low (resources limited, evasion easy), but risk of selective prosecution exists.
• • Legal defense: Constitutional challenges would likely result in injunction before enforcement begins (see Utah, Arkansas precedents).

For VPN providers

• • Legal exposure: Serving Michigan residents would be a felony. Providers would likely geo-block Michigan or cease U.S. operations.
• • Payment processors: Credit card companies may refuse to process VPN subscriptions from Michigan addresses.

For businesses

• • Corporate VPNs: Remote work VPNs would be illegal, disrupting business operations. The bill contains no exception for enterprise use.
• • Legal uncertainty: Companies would face impossible choice: comply with HB 4938 (abandon VPNs) or maintain cybersecurity best practices (use VPNs, risk felony charges).

For internet freedom broadly

• • Precedent: If Michigan's law were upheld (again, unlikely), other states could adopt similar bans, fragmenting U.S. internet policy.
• • International ripple effects: Authoritarian regimes would cite Michigan as justification for their own VPN bans.

12. How to respond: advocacy and legal options

For Michigan residents

1. Contact your state representative: Find your rep at house.mi.gov. Urge them to oppose HB 4938. Key points:
   • Bill violates First Amendment (prior restraint, overbreadth, vagueness)
   • Criminalizes legitimate business uses (corporate VPNs, remote work)
   • Harms Michigan tech economy (VPN industry, cloud services)
   • Unenforceable (trivial to evade, high false positive rate)
2. Support advocacy organizations: Donate to or volunteer with ACLU of Michigan, EFF, Fight for the Future.
3. Testify at committee hearings: If HB 4938 gets a hearing, submit written testimony or request to testify in person. Committee contact: HseCRJ@house.mi.gov

For VPN providers and tech companies

1. Join industry coalition: Coordinate opposition through TechNet, CCIA, or Internet Association.
2. Prepare legal challenge: Retain First Amendment counsel to file immediate injunction if bill passes.
3. Educate legislators: Provide technical briefings on VPN functionality, legitimate uses, and unworkability of proposed enforcement.

For digital rights advocates nationwide

1. Amplify opposition: Share analysis, news coverage, and advocacy calls to action on social media.
2. Monitor other states: Watch for copycat bills in TX, LA, FL, and other states with recent content regulation activity.
3. Support test litigation: If any VPN ban is enacted, contribute to legal defense funds for constitutional challenges.

13. References