The EU Court of Justice certifies VPNs as legal: bypassing geographic restrictions to view blocked content does not constitute copyright infringement

The EU’s highest court has issued a ruling, finding that the geographic blocking measures adopted by Dutch and Belgian academic institutions for the publicly accessible Anne Frank diary manuscript are lawful and effective. Even if some readers can get around the restrictions using a VPN, the publisher does not need to bear copyright infringement liability as a result, and VPN providers also do not need to be jointly responsible for users’ circumvention behavior.
(Background: the biggest piracy library—US court orders Anna’s Archive to pay $19.5 million, with global domain blocking; did the AI it was trained on get wrecked?)
(Additional background: “Fast Connection VPN,” with 20 million users, announces its exit from China! Mainland China imposes the strictest internet shutdown ever: IDC directly cuts the line, and “circumventing the firewall” becomes a crime of subverting state power.)

Table of contents

Toggle

• One diary, two copyright fates
• Why the Anne Frank Fonds sued
• Being bypassable doesn’t mean invalid
• The significance for ordinary users and the VPN industry

This July, the EU’s highest court delivered a heavy blow: VPNs (virtual private networks) have been formally recognized as “lawful technical tools.” Viewing, through a VPN, content that would otherwise be blocked by geographic restrictions does not constitute copyright infringement. In Case C-788/24, the ruling draws a practical dividing line between a “borderless internet” and a “copyright law with borders.” Liability does not lie with readers who use VPNs, nor with providers of VPN services.

And the entire case began with a diary.

One diary, two copyright fates

During World War II, the copyright situation for the well-known Anne Frank diary was not uniform across the EU. Because the copyright laws of different countries have not yet been fully harmonized, this manuscript had already entered the public domain in about 60 countries, including Belgium, so anyone could use it freely. But in the Netherlands, some parts are still protected by copyright and will not expire until 2037.

To ensure that more people can see this valuable historical material, a group of Dutch and Belgian academic institutions, including the Anne Frank Fonds and the Royal Netherlands Academy of Arts and Sciences (KNAW), turned the manuscript into a free online academic version and made it public. To respect these “copyright borders,” they deliberately set up their servers in Belgium and used geographic blocking technology to block visitors coming from Dutch IP addresses. When readers in the Netherlands opened the website, they only saw a notice page explaining why they could not access it.

Why the Anne Frank Fonds sued

But the Swiss foundation Anne Frank Fonds, which holds the copyright in the Netherlands, did not accept this and decided to sue. The reasoning was straightforward: VPNs are too easy to obtain and too easy to operate. Any Dutch user only needs to turn on a VPN, disguise themselves as being in Belgium, and thereby bypass the geographic restrictions to access the protected content. Anne Frank Fonds argued that since circumventing the restrictions is so easy, the geographic blocking used by the academic institutions is effectively a sham. In substance, the website is still disseminating works protected by copyright to “the Dutch public,” so it should be held liable for infringement.

At first glance, this logic seems reasonable—but it was rejected outright by the EU’s highest court.

Being bypassable doesn’t mean invalid

In its decision, the EU court gave a key statement: while geographic blocking measures may be unavoidable and can be bypassed, the fact that “someone can get around it” cannot, by itself, be used to directly prove that the protective measures have failed.

The core of the court’s reasoning is that as long as the publisher adopted the “most advanced” geographic blocking technology, it has already discharged its obligation to implement reasonable safeguards. It will not have to bear copyright infringement liability merely because some readers bypassed the restrictions using a VPN. Conversely, the copyright holder also cannot, based solely on the “existence of a VPN,” claim that the other party’s protective measures are completely ineffective. What the court requires is “reasonable and effective,” not a perfect line of defense that is absolutely impossible to crack.

Going further, the court also made its position clear: providers of VPNs or similar services do not need to bear joint responsibility for users’ acts of circumventing restrictions. This effectively removes VPN providers from the list of risks for copyright infringement litigation.

The significance for ordinary users and the VPN industry

This ruling shifts the balance of the burden of proof—moving it from “users and VPN providers” back to “publishers.” If content platforms want to maintain the boundaries of territorial licensing, they must continuously uphold technical defenses that keep pace with the times, rather than expecting to block every potential person trying to circumvent restrictions.

For hundreds of millions of everyday VPN users, this is a reassuring signal. Under the EU’s highest court’s recognition, encrypting traffic, hiding real IP addresses, and crossing digital borders to view content are considered “lawful consumer-grade technology uses,” and will not, as a result, expose users to liability for infringement offenses. TorrentFreak noted that this ruling is also seen as one of the most important victories for the VPN industry in the EU’s legal battleground in recent years.

As streaming platforms, academic databases, and news media all rely on geographic blocking to segment markets and licensing, the precedent set by Case C-788/24 provides a practical set of standards for the long-running tug-of-war between “a borderless internet” and “copyright law with borders.”