EU Court Recognizes VPNs as a Lawful Technical Tool

The Court of Justice of the European Union (CJEU) has issued a ruling that rights advocates are calling a landmark: virtual private networks have been officially recognized as “lawful technical tools.” The decision, handed down in July 2026, grew out of a tangled dispute over the online publication of Anne Frank's manuscripts.

The heart of the dispute

A coalition of Dutch and Belgian academic institutions released a free scholarly online edition of the manuscripts. The problem is that copyright is not harmonized across Europe, and the status of the famous diary depends on the country. In Belgium and some sixty other states the texts have already entered the public domain, whereas in the Netherlands part of them remains protected until 2037.

To account for this territorial difference, the publishers hosted the site in Belgium and blocked access from Dutch IP addresses using geoblocking. Visitors from the Netherlands saw a notice explaining why the site was unavailable to them.

The rights holder — the Anne Frank Fonds foundation — filed suit. Its reasoning ran as follows: since an ordinary VPN easily allows one to mask a real IP address and pass oneself off as a Belgian user, the scholarly site was in effect making a protected work available to the Dutch public.

What the court decided

The CJEU rejected this argument. The court noted that geoblocking measures can in principle be circumvented, but “the possibility of such circumvention cannot, in itself and in all circumstances, be a decisive factor for finding those measures inadequate and, consequently, ineffective.”

In other words, if a site applies geoblocking that reflects the current state of the art, the publisher does not bear liability for copyright infringement merely because a determined reader switched on a VPN and crossed the digital border. The VPN provider, in turn, is not liable for the actions of users who circumvent the restrictions.

Why it matters

The court drew a pragmatic line: publishers are required to maintain protection at a state-of-the-art level, not to build unbreakable walls that do not exist in nature. Rights holders will no longer be able to cite the mere existence of VPNs as proof that a site's protective measures are useless.

For the ordinary user, the takeaway is reassuring: using a VPN to encrypt traffic, hide an IP address, or cross digital borders has been recognized as a lawful use of consumer technology. The ruling shows that a borderless internet can coexist with territorial copyright — provided that everyone uses the appropriate technical tools.

Source: Hacker News