Censorship disputes often arrive as questions of liability allocation: when material crosses a boundary it was not supposed to cross, which party in the chain of transmission pays for it. Answer “the publisher” and you get a system that polices publishers. Answer “the transit provider” and you get a system in which every platform, internet service provider, router, resolver, and tunnel operator becomes an enforcement contractor for whoever holds the underlying claim.
The Court of Justice of the European Union has now answered that question for commercial VPNs.
The Case
In Case C-788/24, referred up by the Dutch Supreme Court and decided by the Second Chamber on 9 July, the court held that a VPN provider does not itself furnish end users with access to a protected work and plays no “indispensable role” in the act of communication. Where a geographic filter fails and a work reaches an audience it was built to exclude, responsibility remains with whoever published it. The judgment places VPN operators in the same category as the platform intermediaries the court has previously declined to hold liable, including in its 2021 YouTube ruling. There is no appeal from Luxembourg.
The underlying dispute is a good illustration of how these principles get made. Anne Frank’s manuscripts entered the public domain in Belgium and roughly sixty other countries; portions remain under Dutch copyright until 2037. In September 2021 the Anne Frank Stichting, together with the Royal Netherlands Academy of Arts and Sciences and a Dutch textual research association, put a free scholarly edition on a Belgian-hosted site and geoblocked the jurisdictions where the text is still protected. The Swiss foundation holding the Dutch rights sued to take the site down.
Its theory was simple: a border that any consumer can walk through for a few euros a month is not a border at all, so the institutions were communicating the work to the Dutch public no matter what their filters did.
That argument is the general-purpose engine of intermediary liability. If the mere availability of circumvention renders a rights-holder’s control notional, then the circumvention tools become the defect in the system, and the remedy migrates downward — from the publisher, who is hard to reach across a border, to the infrastructure, which is not. The court declined to start that engine. Geoblocking built to the state of the art does the job it is meant to do, and the possibility of getting around it cannot by itself be treated as decisive proof that the measures were inadequate.
Forcing an Account Layer
The second holding drew less attention and will outlast the first.The litigants did not only want the site down. It wanted the site gated — subscriptions, login accounts, a registration wall standing between the reader and the manuscript. The court refused, reasoning that such a requirement would disproportionately burden readers in the many countries where the text belongs to everyone.
This is the conversion that the enforcement apparatus keeps attempting across every domain it touches: turning a question of access into a question of identity. A geographic filter asks a reader for nothing and remembers nothing. An account asks for a name, a working address, a payment instrument, and produces a durable record of which documents that person opened and when. The same substitution is currently being made in the name of child safety, platform accountability, and fraud prevention. Here it was attempted in the name of copyright, and a court said no — on proportionality grounds, which is to say on grounds that can be relitigated whenever the balance is argued differently.
VPNs Remain Legally Threatened in Europe
French courts have spent the past year moving in the opposite direction. Canal+, holder of French rights to the Premier League and Top 14, has obtained orders compelling NordVPN, ExpressVPN, CyberGhost, Proton, and Surfshark to block pirate sports streaming sites for their French subscribers. In late January a French court directed Proton to filter roughly thirty domains under a dynamic injunction — a standing order the media regulator Arcom can extend to new addresses without returning to a judge.
Those orders rest on the French Sports Code rather than on copyright law. That is not incidental. A different statutory hook produces the same operational result while avoiding any direct collision with Luxembourg, which means there is no conflict of laws for a defendant to appeal into. Proton has said it intends to put the question of VPN blocking to the CJEU on its own initiative rather than wait for one to arrive.
Back in the Netherlands, the Supreme Court must still determine whether the institutions’ geoblocking met the standard the CJEU set. The litigants counsel has complained that the ruling treats geoblocking as a box to be ticked rather than a duty that keeps pace with technology. It is worth noticing what that phrase would mean as a legal standard: an obligation with no ceiling, ratcheting upward forever, because there is always a newer way around.
The court has established that the VPN layer is not liable for what passes through it. But it has not established that the VPN layer cannot be conscripted into blocking what passes through it. Those are separate questions, and the second one is currently being decided in Paris.
