unless the bill has changed since the last time I read it, there were fines for hosting the service in US datacenters, and fines for companies allowing US data to exist in non-us datacenters. I don’t think you could interpret the bill as imposing a civil penalty to a user using a vpn and accessing it.