Spanish Court Orders VPN Providers to Block Football Piracy Sites

A Spanish court has granted precautionary measures against NordVPN and ProtonVPN, ordering the two popular VPN providers to block 16 websites that facilitate piracy of football matches. The restrictions will apply to a dynamic list of IP addresses in Spain, and there will be no opportunity for appeals.

The measures were taken 'inaudita parte', meaning that the defendants weren't called to participate in a hearing. LaLiga - the country's professional football organizer, and its broadcasting partner, Telefónica, are required to "preserve sufficient digital evidence of the unlawful transmission of the protected contents."

LaLiga showed a strong stance against the piracy ecosystem in recent years, previously targeting Cloudflare, accusing the internet giant of facilitating illegal sports streaming. The two organizations proved that the VPN providers fall under the EU Digital Services Regulation, and therefore have a duty to help prevent copyright infringement carried out through their infrastructure.

"The orders identify how VPN systems prove to be a suitable means, 'highly effective and accessible to generate the possibility of access to content not accessible in certain geographic points,' distorting the real geographic location of online access, and facilitating 'access to websites that broadcast protected content illegally,'" reads LaLiga's announcement.

"What is more, the orders highlight how the defendant companies acknowledge and even advertise that their system is excellent at evading restrictions."

LaLiga characterized the ruling as unprecedented in Spain, aligning it with similar decisions in France, and celebrated that the liability of VPN providers for piracy is clearly recognized.

VPN Providers Push Back

In response, ProtonVPN took to Twitter to question the decision, declaring a total lack of awareness of the proceedings and stating that they have not been formally notified.

"Any judicial order issued without proper notification to the affected parties, thereby denying them the opportunity to be heard, would be procedurally invalid under fundamental principles of due process," stated the VPN service provider. "Spanish courts, like all courts operating under the rule of law, are bound by procedural safeguards that ensure parties are given a fair opportunity to present their case before any binding judgment is rendered."

In a request for comments to BleepingComputer, NordVPN's spokesperson Laura Tyrylyte stated that the company was not involved in any legal proceedings in Spain.

"At this stage, we have not received the judicial documents mentioned in the press so it will be premature to comment without having reviewed them. We were not part of any Spanish judicial proceedings to our knowledge, and therefore had no opportunity to defend ourselves. Given such judgments impact on how the Internet operates, such an approach by rightsholders is unacceptable" - NordVPN

Tyrylyte stated that the process for blocking domains is ineffective in the fight against piracy as it does not address the root cause. Instead, hosting providers should be the target, since pirates can use subdomains to bypass the restrictions.

"Effective piracy control should focus on eliminating the source of the content, targeting hosting providers, cutting off financing for illegal operations, and increasing the availability of legitimate content."

Through its representative, NordVPN said that the measures affect mostly reputable, paid VPN providers, while free services continue to operate largely unhindered.

"Free VPNs are often harder to regulate and, since users who seek to avoid paying for content are unlikely to pay for a VPN either, these services remain a loophole for pirates to bypass restrictions."

Implications for VPN Industry

The ruling represents a significant shift in how VPN providers are treated under copyright law. By classifying VPN services as falling under the EU Digital Services Regulation, Spanish courts have established that these companies have a legal obligation to prevent copyright infringement carried out through their infrastructure.

This approach differs from traditional anti-piracy measures that typically target the websites hosting or streaming pirated content directly. Instead, it places responsibility on the tools that enable users to bypass geographic restrictions and access content that would otherwise be unavailable in their region.

The "inaudita parte" nature of the proceedings - where defendants weren't given an opportunity to respond before the order was issued - raises serious questions about due process and the balance between intellectual property rights and fair legal procedures.

For VPN users in Spain, this could mean increased difficulty accessing geo-restricted content, even when using legitimate paid services. The dynamic nature of the block list means that the restrictions could evolve over time as new piracy sites emerge.

Industry Response and Future Challenges

The VPN industry is likely to challenge this ruling, particularly on procedural grounds. The lack of notification and opportunity to defend themselves before the order was issued violates basic principles of due process that are fundamental to legal systems operating under the rule of law.

However, the substantive question of whether VPN providers can be held liable for copyright infringement facilitated through their services remains unresolved. This case could set a precedent for other jurisdictions to follow, potentially reshaping the global VPN landscape.

For content creators and rights holders, this represents a new tool in the fight against piracy. By targeting the infrastructure that enables geographic bypassing, they can potentially cut off access to pirated content more effectively than by targeting individual websites.

For consumers, particularly sports fans looking to access content that may be geographically restricted or expensive, this could limit their options and potentially drive them toward less reputable free VPN services that may be harder to regulate.

Technical and Practical Considerations

The effectiveness of domain blocking through VPN providers remains questionable. As NordVPN's spokesperson noted, pirates can easily circumvent such blocks by using subdomains or switching to free VPN services that may not be subject to the same legal requirements.

This approach also raises privacy concerns, as it requires VPN providers to monitor and potentially log user activity to identify attempts to access blocked sites. This could undermine the privacy protections that are a core selling point for many VPN services.

The ruling also highlights the ongoing tension between copyright enforcement and internet freedom. While protecting intellectual property rights is important, measures that restrict access to information and tools that have legitimate uses raise concerns about overreach and unintended consequences.

The case is likely to be appealed and may eventually reach higher courts for a definitive ruling on the liability of VPN providers for copyright infringement. Until then, the VPN industry and its users in Spain face an uncertain regulatory environment.