The Court of Justice of the European Union (CJEU) has ruled that VPNs are “lawful technical tools” and that their providers are not liable when users use them to circumvent geographical restrictions on copyrighted material.
The landmark ruling came in a dispute over the online publication of Anne Frank’s manuscripts.
The Anne Frank Fonds, which manages copyright interests in Anne Frank’s work, sued the Anne Frank Stichting and other organisations over an online scientific edition of her manuscripts. The material was published from the Netherlands, where parts of the work remain protected by copyright until 2037, but was accessible from Belgium, where the relevant copyright protection has expired.
The website used geo-blocking to prevent users in the Netherlands from accessing the material. However, users could potentially bypass the restriction by using a VPN to appear as if they were connecting from another country.
The CJEU ruled that geo-blocking can still constitute an “effective technological measure” even if a user can circumvent it with a VPN or similar service.
The Court also ruled that responsibility for an ineffective geo-blocking measure cannot be transferred to the VPN provider simply because its service enables a user to bypass the restriction. The responsibility for any unauthorised communication of the copyrighted work lies with the person who uploaded or published it.
In a particularly significant formulation, the Court described VPNs as “lawful technical tools” and said that VPN providers do not themselves give users access to protected works.
The ruling now returns to the Supreme Court of the Netherlands, which must determine whether the geo-blocking measures used in the case were sufficiently effective in practice. If they were, the website’s intended audience would not have included Dutch users.
The decision is notable because VPNs have increasingly come under political and regulatory pressure in Europe, even though they are widely used for legitimate purposes including cybersecurity, remote work and privacy protection.
Now the ECJ has confirmed that copyright holders can’t simply blame VPN’s for their own shortcomings.
The Court’s ruling arrives amid a broader push for stronger online identification and monitoring. The EU is developing age-verification tools for access to certain online content, while proposals such as the controversial “Chat Control” legislation have raised concerns about the scanning of private and encrypted communications.
Critics argue that such measures could make privacy tools more important, while simultaneously creating pressure to limit their ability to circumvent online restrictions.
