A diary, a border, and a VPN
On July 9, 2026, the Court of Justice of the European Union (CJEU) handed down its judgment in Anne Frank Fonds v Anne Frank Stichting and Others (Case C-788/24), resolving a genuinely odd legal puzzle: the Diary of Anne Frank is in the public domain in Belgium and several other member states, but a portion of the underlying manuscripts remains protected by copyright in the Netherlands until 2037. In 2021, the Anne Frank Stichting and academic partners published a scholarly edition of the diary on a Belgian-registered website, geo-blocked to prevent access from the Netherlands. The Anne Frank Fonds, which holds the Dutch rights, sued, arguing that geo-blocking which any teenager can defeat with a free VPN app cannot possibly satisfy copyright law's "communication to the public" standard under the InfoSoc Directive (2001/29/EC).
The Hoge Raad der Nederlanden (Dutch Supreme Court) referred three questions to Luxembourg on November 14, 2024, after an Advocate General opinion on January 15, 2026: whether online publication is only a "communication to the public" in a country if addressed to that country's public; whether geo-blocking prevents such communication; and if circumvention is possible, who bears responsibility given VPN providers' role. The CJEU answered all three in a single, consequential move.
What the Court actually held
The judgment draws a clean line. First, "state-of-the-art" geo-blocking is enough: the mere theoretical possibility that a determined user can defeat it with a VPN "cannot, in itself, be a decisive factor" in ruling the measure ineffective. A publisher that deploys genuinely effective technical blocking — not a click-through "I am not Dutch" honor-system page — has defined its intended audience, and users outside that audience who circumvent the block are not communicated to for copyright purposes.
Second, and separately, VPN providers bear no liability for that circumvention. The Court held that a VPN service "does not give end users access to a protected work" and plays no "indispensable role" in any act of communication — language that places VPNs in the same doctrinal bucket as neutral conduits and hosting intermediaries the Court has previously declined to hold liable for users' downstream conduct. VPNs are, in the Court's words, lawful technical tools.
Because this is a preliminary ruling under Article 267 TFEU, every national court in the EU must now apply this interpretation of the InfoSoc Directive going forward.
The case for the other side
Before cheering, it's worth taking the Anne Frank Fonds' position seriously. Territorial copyright exists because member states have made different legislative choices about protection terms, and rightsholders who license works differently across borders — a scholarly archive in one country, a paid edition in another — have a legitimate interest in those choices meaning something. If "effective but circumventable" is the standard, and every consumer VPN clears that bar, critics can fairly ask whether territorial copyright has been quietly hollowed out rather than adjudicated. That is not a frivolous concern for an industry — sports broadcasting, film windowing, regional archives — built on the assumption that borders are enforceable online.
Why the Court's balance is still the right one
The Court's answer to that concern is proportionality, not indifference: publishers still have to build real blocking, not a fig leaf, and the ruling explicitly does not immunize sloppy geo-blocking. What it refuses to do is demand the impossible — a bypass-proof internet — as the price of legal certainty. That refusal matters far beyond one archive. Insisting that any leakage via VPN defeats a publisher's diligence would have pushed rightsholders toward demanding VPN-blocking, account verification, or ID-gated access as the only "safe" compliance path, exactly the kind of friction that degrades the open internet for the overwhelming majority of lawful VPN users — journalists, remote workers, security-conscious consumers, and, not incidentally, the ~35% of EU internet users who report using a VPN for privacy reasons.
Holding VPN providers liable for what their users do downstream would also have broken with a settled principle of EU intermediary liability: platforms and tools that don't control or select content aren't insurers of every use their users make of them. A VPN is infrastructure, not a publisher.
A fault line the ruling doesn't close
The judgment sits awkwardly next to France, where courts have ordered NordVPN, ExpressVPN, and ProtonVPN to block access to pirate sports-streaming sites for French subscribers under the French Sports Code — a regime that treats VPNs as choke points precisely because they can be made to block. ProtonVPN has signaled it intends to take that French blocking framework to the CJEU. When it arrives, Luxembourg will have to explain why a VPN is a liability-free neutral tool in a Dutch copyright dispute but a compellable blocking agent in a French sports-piracy one — or accept that EU digital-single-market coherence on VPN regulation remains, for now, a work in progress.
What comes next
For publishers and platforms, the message is concrete: invest in the geo-blocking you already have, because "state of the art" is now the legal floor, not a ceiling regulators will ignore. For VPN providers, the ruling is a genuine relief after years of ambiguity — but it is not a shield against sector-specific blocking mandates like France's, which rest on different statutory footing. And for policymakers eyeing the InfoSoc Directive's aging "communication to the public" test, this is the clearest signal yet that the Court prefers a workable, proportionate standard over a technologically impossible one — a precedent worth defending the next time a rightsholder lobby asks Brussels to legislate VPN-proof borders into existence.