The Court of Justice of the European Union has ruled that virtual private networks are “lawful technical tools,” handing privacy advocates a major victory in a case that originated from an unlikely source: Anne Frank’s manuscripts.
The judgment, handed down in Case C-788/24, addresses a question that has become increasingly urgent as both copyright enforcement and VPN adoption have surged across Europe. If a publisher deploys geo-blocking to restrict access to copyrighted material by country, but a user bypasses that restriction with a VPN, who bears legal responsibility?
The court’s answer is unambiguous: the publisher, not the VPN provider.
“The possibility of such circumvention cannot, in itself and in all circumstances, be a decisive factor in finding those measures to be inadequate and, therefore, ineffective,” the CJEU ruled. VPN providers “do not themselves give users access to protected works.”
The case began when the Anne Frank Fonds, which manages copyright interests in Anne Frank’s diary and manuscripts, sued the Anne Frank Stichting and affiliated organizations over an online scholarly edition published from the Netherlands. Parts of Anne Frank’s work remain under copyright in the Netherlands until 2037 but have entered the public domain in Belgium. The publishers deployed geo-blocking to prevent Dutch users from accessing the material, though a user with a VPN could route through a Belgian server and bypass the restriction.
The Anne Frank Fonds argued that the mere existence of circumvention tools meant the geo-blocking was ineffective, effectively constituting unauthorized communication to the Dutch public. The CJEU rejected that logic, establishing a principle that effective geo-blocking does not require impenetrability. Publishers who implement reasonable, state-of-the-art measures are protected, even if determined users can find a way around them.
Liability for copyright infringement stays with the publisher only if the geo-blocking measure fails the effectiveness test under Article 6(3) of the EU Copyright Directive. VPNs alone do not make a measure ineffective.
The ruling arrives at a moment when VPNs face growing political pressure across Europe. Several member states have experimented with blocking VPN services used for piracy, and the European Commission has proposed measures, including the controversial Chat Control legislation, that would mandate scanning of private and encrypted communications. The CJEU’s explicit recognition of VPNs as legitimate tools with purposes including cybersecurity, remote work, and privacy protection complicates those efforts.
The case now returns to the Supreme Court of the Netherlands, which will determine whether the specific geo-blocking measures used in the Anne Frank dispute were sufficiently effective in practice. The CJEU’s guidance, however, applies across all EU member states and will shape how national courts approach similar disputes.
For the broader internet ecosystem, the judgment provides something rare: legal clarity. Publishers have clear guardrails for implementing geo-blocking without facing open-ended liability. VPN providers have legal cover against copyright claims based solely on their users’ behavior. And millions of Europeans who use VPNs for legitimate purposes, accessing news from other countries, securing public Wi-Fi connections, or working remotely, can do so without their tools being presumptively classified as infringement devices.
Sources: ‘VPNs are lawful technical tools,’ says EU Court in landmark Anne Frank copyright ruling (Brussels Signal, July 22, 2026); EU Court Declares VPNs Lawful Tools in Anne Frank Copyright Case (WebProNews, July 21, 2026)