The Court of Justice of the European Union has ruled on that a VPN provider cannot be held liable for copyright infringement when its users route around a geoblock. The court described VPNs as lawful technical tools that people may legitimately use. The finding removes the argument that privacy software makes its makers party to whatever their customers do with it.
We obtained a copy of the ruling for you here.
The Second Chamber delivered the judgment in Case C-788/24, Anne Frank Fonds v Anne Frank Stichting and Others, on a reference from the Dutch Supreme Court. The ruling cannot be appealed. Advocate General Athanasios Rantos had reached the same conclusion in January.
The court held that a VPN provider “does not give end users access to a protected work” and does not play an “indispensable role” in any act of communication. Where a geoblock fails and a protected work reaches readers it was meant to exclude, responsibility stays with whoever put the work online. The court placed VPN operators alongside the intermediaries it declined to hold liable in earlier cases, including YouTube.
French courts have been moving the other way. Canal+, which holds French rights to the Premier League and Top 14, has won orders requiring NordVPN, ExpressVPN, CyberGhost, Proton and Surfshark to block pirate sports streaming sites for their French subscribers. A French court ordered Proton in late January to filter around thirty domains under a dynamic injunction the regulator Arcom can extend to new addresses without a fresh hearing. Those orders rest on the French Sports Code rather than copyright law, so they do not collide with Luxembourg directly. Proton has said it intends to bring the question of VPN blocking to the CJEU itself.
Anne Frank’s manuscripts are in the public domain in Belgium and around 60 other countries. Parts of the text stay under Dutch copyright until 2037. The Anne Frank Stichting, the Royal Netherlands Academy of Arts and Sciences and the Association for Research in and Access to Historical Texts published a free scholarly edition on a Belgian-hosted website in September 2021. The site blocked visitors from countries where the work is still protected. Dutch readers get a notice saying the edition “cannot be made available in all countries, due to copyright considerations.”
The Anne Frank Fonds, the Swiss foundation holding the Dutch rights, sued to force the site offline. Its argument was that a block anyone can defeat with a consumer VPN protects nothing, so the institutions were communicating the work to the Dutch public regardless of what their filters did.
The judges rejected that. Geoblocking built to the state of the art keeps a website out of the countries it excludes, and the possibility of circumvention “cannot, in itself and in all circumstances, be a decisive factor” in finding those measures inadequate. A publisher that blocks a territory has shown who its audience is not.
The court refused to require the subscriptions or login accounts the Fonds wanted, holding that such demands would disproportionately restrict free access for readers in countries where the text belongs to the public. A geographic filter asks a reader for nothing. An account asks for a name, an address to send mail to, and a record of which manuscripts that person opened.
The site’s self-declaration prompt, which asks visitors to confirm they are in a country where the work is free, does not do the job on its own, the judges said.
Arnout Groen, a lawyer for the Fonds, said the court had treated geoblocking as “a tick-in-the-box exercise” instead of an ongoing duty that keeps pace with technology. He said the judges ignored other indications that the website was aimed at Dutch readers and that the decision opens the door to misuse.
The Dutch Supreme Court must now decide whether the geoblocking the institutions deployed met the state-of-the-art standard. If it did, the publication does not infringe Dutch copyright.
