Thirty years ago, the US Congress tried to ban porn on the Internet via the Communications Decency Act of 1996 (CDA). The legislation was introduced with the goal of preventing harm to minors who could access objectionable material through home computers. While it was signed into law by Bill Clinton, it failed miserably with a unaminous Supreme Court striking it down in Reno v. ACLU because it was a gross overreach of protected speech and violation of the First Amendment.
Reno v. ACLU be damned, on September 11, 2025, Michigan Representative Josh Schriver introduced HB 4938 as the Anticorruption of Public Morals Act in the Michigan legislature. The bill essentially seeks to ban (1) all pornography and (2) any transgender-associated content.
Notably, it does so by forcing ISPs to filter content and (perhaps the worst idea in the bill) block VPNs.
Prohibited Content
All of the content restrictions are defined as “prohibited content” under the bill that includes an itemized list along with a catchall “any other pornographic material” as one of those items. The description addressing the transgender-associated content is defined as content that:
“Is a depiction, description, or simulation, whether real, animated, digitally generated, written, or auditory, that includes a disconnection between biology and gender by an individual of 1 biological sex imitating, depicting, or representing himself or herself to be of the other biological sex by means of a combination of attire, cosmetology, or prosthetics, or as having a reproductive nature contrary to the individual’s biological sex.”
We’ve seen a lot of shots at content restrictions through age verification laws in recent years and there appears to be a path to success in passing First Amendment muster under the current Supreme Court makeup. Notably, the Michigan Anticorruption of Public Morals Act is not an age verification law – it is an outright content ban for all Michigan residents.
In the face of age verification laws, internet users in 2025 have shrugged off such laws by turning on their VPNs. The new Michigan bill aims to close the VPN loophole by requiring ISPs to block them as “circumvention tools.”
VPNs, Proxy Servers, and Encrypted Tunnels, Oh My…
Under the proposed law, “circumvention tools” are defined as “any software, hardware, or service designed to bypass internet filtering mechanisms or content restrictions including virtual private networks, proxy servers, and encrypted tunneling methods to evade content restrictions.” As part of the content restrictions, Michigan ISPs are required to both filter prohibited material and block circumventions tools.
“An internet service provider providing internet service in this state shall implement mandatory filtering technology to prevent residents of this state from accessing prohibited material. An internet service provider providing internet service in this state shall actively monitor and block known circumvention tools.”
ISPs’ duty to filter content and block known circumventions tools brings with it fines up to $500k per violation. Do we think ISPs are going to risk penalties like this by being conservative with their content filtering or VPN blocking strategies?
While the definition qualifies the restricted tools as limited to those “designed . . . to evade content restrictions,” the required technical filtering and blocking requirement on ISPs open a privacy and security minefield.
The Great Firewall of Michigan
HB 4938 is channeling its inner China with the implementation mandate for platforms and ISPs. It requires private ISPs to do the government’s bidding by spying on its citizens. It will whittle away security and privacy in the name of public morality and cries of “oh, think of the children!” Quite literally:
These measures defend children, safeguard our communities, and put families first.
Who maintains the list of known circumvention tools? No way that list won’t be overbroad because there can’t be a legitimate use of VPNs other than through violations of public morality.
Technically speaking, how do you block VPNs? Common port numbers? Easily mitigated by changing to uncommon ports. VPN server-side IPs? No way that list stays up to date. There is no silver bullet for blocking VPNs at the ISP level.
Virtually every company in the US uses VPNs, proxys, technology that could be classified as “circumvention technology.” Cloudflare, Zscaler, ZeroTeir, Tailscale, et al. will need to be whitelisted for Michigan companies to give users access to the Internet. And that’s just the big cloud providers. Will every small business and remote worker in Michigan need to whitelist their IPs for site-to-site and remote VPN access? Good luck for remote workers at home with ISPs handing out IP addresses via DHCP.
Better yet, how about we just break the encryption so that state can see into all the traffic and catch the content criminals? Because there’s really no way to be sure without inspecting every user’s traffic.
That’s where this is headed again. That’s what Congress tried in 2020 with the EARN IT Act. Or, Clipper Chips in the 90s.
Bills like this are bad ideas from the start and make technology so dangerous for individual and enterprise security and privacy.
Easier traffic inspection = no privacy online.
VPNs banned = no security on lower trust networks and a nightmare of whitelisting the “good ones.”
Of course, there’s artificial intelligence in it…
No techno-mumbo-jumbo bill would be complete without at least some AI worked in there somewhere.
HB 4938 does not disappoint with its content moderation requirements for platforms to use “artificial intelligence driven filtering technology for preemptive removal of prohibited material.”
Awesome. We can just feed AI the definition prohibited content and expect it to implement this for us.
This fails to pass First Amendment muster, right?
To anyone with an honest reading of First Amendment jurisprudence, this bill goes nowhere. And if it did, it gets struck down with no hope of becoming an enforceable law. Right?
If something like this sees the light of day, watch out for the definition of “prohibited content” to creep. Hate speech. Extreme viewpoints. Disorderly speech.
And, whoever holds power will define what is acceptable content for the masses.
Nothing was your own except the few cubic centimetres inside your skull.
-George Orwell, 1984
