RESTRICTAct: 20 years in prison for using a VPN [pdf]

The Act applies to ICTS entities that are held in whole or in part by, or otherwise fall under the jurisdiction of a country or government that is designated under the Act as a "foreign adversary" of the United States, and has more than one million active users or units sold in the United States.[1][2] The initial text of the Act classifies China (including Hong Kong and Macau), Cuba, Iran, Russia, and the Nicolás Maduro regime of Venezuela as foreign adversaries.[1][2]

It would be unlawful for any person to violate any order or mitigation measure issued under the RESTRICT Act, with civil penalties of up to $250,000 or "twice the value of the transaction that is the basis of the violation with respect to which the penalty is imposed", whichever is greater, and criminal penalties of up to $1 million and up to 20 years imprisonment.