When we published our article on the collateral damage caused by IP-based blocking during LaLiga broadcasts in Spain, we highlighted a reality that too often goes unnoticed: measures adopted to combat online piracy can end up harming thousands of legitimate services and users that have no connection whatsoever with the infringing activities they are intended to prevent.
Our analysis showed how court-ordered mass IP blocking also affected legitimate services hosted on shared infrastructures, compromising the availability of websites, applications and digital services that were entirely unrelated to the dispute.
This debate remains highly relevant. It has now gained a new dimension following a recent judgment of the Court of Justice of the European Union (CJEU), which establishes important case law regarding the role of Virtual Private Networks (VPNs) in the context of copyright protection.
Although the ruling does not address the LaLiga case or the IP blocking measures applied in Spain, it provides valuable legal guidance that should be taken into account in any discussion about Internet governance and the limits of network blocking measures.
The Anne Frank Fonds judgment
On 9 July 2026, the CJEU delivered its judgment in Case C-788/24 (Anne Frank Fonds), following a request for a preliminary ruling submitted by the Supreme Court of the Netherlands concerning the interpretation of Directive 2001/29/EC on copyright in the information society.
The dispute arose from the online publication of a scholarly edition of Anne Frank’s manuscripts. The defendants made these manuscripts available on the Internet but implemented geo-blocking to prevent access from the Netherlands, where copyright protection remained in force. However, that geo-blocking could be circumvented by using a VPN.
The judgment is available through the CJEU’s official InfoCuria portal.
The Court concluded that a geographical restriction based on an IP address may still qualify as an effective technological measure even if mechanisms such as VPNs make it technically possible to bypass it.
In other words, the mere fact that a technical measure can be circumvented does not mean that it loses its legal effectiveness.
VPNs are part of a legitimate Internet
One of the most significant aspects of the judgment is that the CJEU does not consider VPNs to be inherently suspicious technology, nor does it hold VPN providers liable simply because some users employ their services to circumvent geographical restrictions.
This distinction is particularly important.
VPNs are an essential component of today’s Internet. Businesses, public administrations, universities, research institutions and millions of citizens rely on them every day to protect communications, safeguard privacy, enable remote working and securely connect to digital infrastructures.
Treating a general-purpose technology as inherently problematic because it can be misused by some individuals would be as disproportionate as questioning email simply because it can also be used to send spam.
The judgment helps avoid precisely this kind of oversimplification.
But the European debate goes far beyond VPNs
The CJEU’s ruling does not endorse every form of IP-based blocking.
Nor does it suggest that copyright enforcement measures may indiscriminately affect third parties.
Still less does it imply that collateral damage is an acceptable consequence.
The Court answers a much narrower legal question: whether the existence of VPNs prevents geo-blocking from being regarded as an effective technological measure. Its answer is no.
The principles of proportionality, necessity, and respect for fundamental rights remain essential requirements under European Union law.
When one IP address does not represent a single service
The experience documented during the blocking measures associated with LaLiga broadcasts illustrates a technical reality that is often overlooked in legal debates.
The Internet is not built on a one-to-one relationship between services and IP addresses.
Today, it is common for a single infrastructure to host hundreds or even thousands of different domain names, independent services, business applications, public administration platforms and civil society initiatives.
Blocking one IP address may therefore render unavailable a large number of perfectly legitimate services that merely happen to share the same infrastructure.
When technical enforcement measures fail to take this reality into account, collateral damage ceases to be an exception and becomes an inherent feature of the blocking system itself.
Net neutrality and the right of access to the Internet
At the guifi.net Foundation, we believe that protecting copyright is fully compatible with defending an open Internet.
The challenge is not to choose one objective over the other. Rather, it is to ensure that enforcement measures are proportionate, technically appropriate and fully respectful of the other rights and freedoms protected under European law.
Net neutrality is one of the cornerstones of this model. It requires that network operators do not discriminate against Internet traffic based on its source, destination, content or application, except in the limited circumstances expressly provided for by law.
When large-scale blocking measures end up affecting services that are unrelated to the intended targets, this principle is inevitably placed at risk.
At the same time, the right of access to the Internet is also undermined. Today, Internet access is an essential prerequisite for exercising many other fundamental rights, including access to information, freedom of expression, economic activity, education, research and democratic participation.
When a legitimate service becomes unavailable because of enforcement measures aimed at someone else, the consequences are not merely technical. They also affect rights, opportunities and public trust in the digital infrastructure on which our societies increasingly depend.
Building a resilient Internet requires more precise measures
The CJEU judgment does not resolve the broader debate on mass IP blocking.
However, it does reinforce one fundamental idea: general-purpose technologies such as VPNs are a normal part of the Internet ecosystem and should not, in themselves, be treated as a legal problem.
The same principle should also guide discussions on blocking measures.
In an Internet built upon shared infrastructures, any intervention affecting connectivity should be highly targeted, transparent and proportionate.
Fighting piracy is both legitimate and necessary. But so too is preserving an Internet that remains open, neutral and resilient, serving as a shared infrastructure for the benefit of everyone.
This is perhaps the main lesson to be drawn both from the blocking measures experienced during LaLiga broadcasts and from the CJEU’s latest case law: the protection of one set of rights should never come at the expense of the rights of others.