EU Court Rules VPNs Are Lawful Tools in Landmark Case

Key Takeaways

• The Court of Justice of the European Union (CJEU) has ruled that VPN providers aren't liable for copyright infringement and explicitly recognized VPNs as "lawful technical tools."
• The ruling stems from a dispute over an online scholarly edition of Anne Frank's manuscripts, which used geo-blocking to restrict Dutch users — but was sued when VPN users bypassed those restrictions.
• The court found that as long as a website employs "state-of-the-art" geo-blocking technology, the publisher can't be held liable simply because users circumvent it with a VPN.
• The ruling sets a significant precedent: copyright holders can't point to the mere existence of VPNs to argue that a website's geo-restrictions are legally inadequate.

The Court of Justice of the European Union handed down a landmark judgment in July 2026, explicitly categorizing VPNs as "lawful technical tools" while ruling that publishers and VPN providers aren't liable for copyright infringement when users choose to circumvent geo-blocking restrictions, according to reporting by IT Pro. The ruling is the clearest judicial recognition yet of VPNs' legitimate status under EU law, and it comes at a moment when governments across Europe are actively looking for ways to restrict them.

The case that produced this ruling is an unusual one. A coalition of Dutch and Belgian academic institutions published a free scholarly edition of Anne Frank's historical manuscripts online. Because copyright law isn't fully harmonized across Europe, the diary's legal status differs by country: in Belgium and around 60 other countries, the writing has entered the public domain, but in the Netherlands, parts of the text remain protected until 2037. To respect that territorial divide, the publishers hosted the site in Belgium and used geo-blocking to prevent access from Dutch IP addresses.

The Anne Frank Fonds, which holds the Dutch copyright, sued. Their argument: because standard VPNs allow users to spoof a Belgian IP address, the geo-blocking wasn't truly effective — meaning the site was, in effect, publishing protected content to Dutch audiences. The CJEU rejected that argument, and the reasoning behind the rejection is what makes this ruling significant.

What the Court Actually Said

The CJEU's core finding is this: the possibility that geo-blocking can be circumvented "cannot, in itself and in all circumstances, be a decisive factor in finding those measures to be inadequate and, therefore, ineffective." In other words, the existence of VPNs doesn't make geo-blocking legally meaningless — and publishers who deploy state-of-the-art blocking measures can't be held liable for determined users who route around them.

That's an important legal line to have drawn clearly. The alternative (holding publishers responsible for any access that occurs despite their restrictions) would've created an impossible standard. No geo-blocking is absolute. If the mere existence of circumvention tools made publishers liable, the logical endpoint is either no geo-restricted content at all or a legal basis to demand that VPNs themselves be suppressed as tools of infringement.

The court didn't go there. Instead, it drew a distinction between a publisher's reasonable technical measures and the independent choices of individual users. That distinction protects publishers. It also protects VPN providers. And it protects the users who rely on them.

A Ruling That Pushes Back on VPN Demonization

We're currently in a period where VPNs are under legislative pressure in ways that would've been difficult to predict even a few years ago. The UK is preparing regulations that would ban VPN access for under-18s. Utah passed a law targeting VPN use for adult content. Governments routinely frame VPNs as tools of circumvention, as if the privacy and security they provide are secondary to the ability of states and rights holders to enforce geographic restrictions.

The CJEU's ruling doesn't resolve any of those debates directly. But it does something useful: it puts the EU's highest court on record saying that VPNs are lawful tools. Not a legal gray area. Not circumvention software that happens to be tolerated. Lawful technical tools, with the same standing as any other privacy or security technology.

That matters for users who rely on VPNs to protect their data, bypass censorship, access information that's geographically restricted for reasons that have nothing to do with copyright, or simply browse without being tracked. It matters for journalists, activists, and ordinary people in countries where VPN restrictions are tightening. And it matters as a counterpoint to the legislative momentum that keeps trying to reframe privacy tools as problems to be managed rather than rights to be protected. Courts don't always get these calls right. This one did.