Main takeaways
- EU-wide anti-piracy blocking could force virtual private networks (VPNs) to filter traffic, putting user privacy and secure access at risk
- Along with France and Italy, Spain targets VPNs through blocking injunctions, even as its national cybersecurity agency explicitly recommends these tools to citizens
- Copyright enforcement should target services hosting infringing content while protecting VPNs, encryption, and secure connectivity
The European Commission is considering an EU-wide system of anti-piracy injunctions – requiring providers to block access to websites and servers containing copyright-infringing content. Such a system risks turning providers of virtual private networks (VPNs) into watchdogs that have to filter traffic, undermining their core privacy-protecting function.
In practice, pirates can quickly circumvent such measures, meaning that injunctions harm users’ privacy without delivering lasting results. Yet the blocking system remains under consideration for the Commission’s Copyright Package, due in the second quarter of 2027.
Against this backdrop, an explainer (‘How Virtual Private Networks (VPNs) Really Work – And Why Certain EU Obligations Cannot Apply’) now sets out what is at stake. It explains how VPNs protect communications, support secure remote access, and underpin the digital infrastructure used by European citizens, businesses, and public services.
Drawing VPN providers into copyright enforcement or requiring them to police other EU laws, such as those related to child safety online, would undermine their ability to protect our privacy. The European Commission should instead recognise and safeguard VPNs’ essential role in the digital ecosystem.
1. From neutral conduits to active filters
By design, VPNs act as neutral services, routing and encrypting traffic to help protect users without monitoring or controlling what they access. They provide connectivity rather than hosting content. This was also reaffirmed recently by the Court of Justice of the European Union (CJEU) in the Anne Frank diary case, where it ruled that a VPN provider cannot be held responsible for copyright infringement when users use its services to bypass geoblocking.
VPNs protect communications and enable secure access, including for journalists, businesses, and human rights defenders. Applying dynamic or automated IP- and DNS-blocking injunctions to VPN services creates a fundamental conflict with that role.
Blocking measures do not themselves break encryption. However, enforcing them would require VPN providers to check traffic against blocking criteria, including destination IP addresses or DNS requests where available. This would shift VPNs from neutral intermediaries towards active filtering, undermining their core privacy-protecting function. The tension is particularly acute because VPN providers do not host the content in question and therefore cannot remove it at source. Infringing content remains accessible through alternative routes or domains, meaning that this kind of filtering is both intrusive and ineffective.
2. The overblocking and privacy paradox
IP blocking is a blunt enforcement tool. It fails to curb online piracy and, when VPNs are in scope, threatens our privacy. Overblocking also causes substantial collateral damage by restricting access to lawful websites alongside infringing services.
Spain illustrates the tension. Anti-piracy blocking by football league LaLiga, with the approval of the Spanish judiciary, has repeatedly disrupted access to lawful websites and services. This has raised concerns about overblocking and the judicial scrutiny of individual blocking decisions, with injunctions also being granted against multiple VPN providers.
Meanwhile, Spain’s National Cybersecurity Institute (INCIBE) recommends those very same VPNs to its citizens as tools for protecting personal information and countering censorship and tracking. This paradox underlines the need for copyright enforcement to respect the privacy tools and digital infrastructure that public authorities themselves encourage people to use.
Requiring VPNs to monitor destinations and filter traffic would undermine their function as privacy-protecting connectivity tools, even where encryption remains intact. Obligations to weaken encryption would create security vulnerabilities, but even ‘light-touch’ requirements to monitor, filter, or retain user traffic would undermine the privacy safeguards that VPNs provide.
Conclusion
It’s time for EU policy- and decision-makers to commit unequivocally to preserving strong privacy protections and encryption, to focus anti-piracy enforcement on services that host illegal content and also have the ability to remove it, and to maintain a predictable regulatory environment for trusted VPN providers.
As the European Commission considers changes to the EU copyright framework and its enforcement, the challenge is to ensure that measures remain effective and proportionate while safeguarding the privacy, security, and connectivity functions that VPNs provide by design to millions of Europeans.