Quad9, the Swiss nonprofit DNS resolver, says it will stop serving users in France on 24 November 2026. A Paris court ordered it to block domains accused of carrying unauthorized sports streams. Quad9 says it cannot confine those blocks to French users, so it is leaving rather than extend French law to the whole world or promise something it can't deliver.
Neither the EFF's account nor Quad9's own post ties the dispute to the Digital Services Act. The link is that the case tests how far intermediary obligations and due-process safeguards reach in France. Written EU rules on exactly this question already exist, and this case shows how little they constrain what happens in practice.
The case for the court
The rights-holders' argument is serious. Live sports lose most of their value when pirated in real time, and beIN Sports can fairly say that blocking at the access-provider level is leaky if public resolvers stay open. A court that finds specific domains infringing has to be able to make its order bite. Resolvers are also not passive bystanders: they decide what a name resolves to. That is why French courts have extended blocking orders from ISPs to DNS providers, and why OpenDNS suspended its French service in 2024 after a Canal+ order, as TorrentFreak reports.
What the court actually did
By Quad9's account, beIN sought a penalty of up to roughly €580,000 a day. The court cut that to €1,000 a day in total, running until the blocking measures end on 14 November. Quad9 puts the total at about €24,000, excluding legal costs. Quad9 says an appeal is pending and that it is the target of about 20 similar suits.
The court's restraint on the penalty is welcome, but it doesn't settle the problem. Quad9 says it holds no database linking users to jurisdictions, so it cannot tell whom the ruling applies to. In its words, the options are blocking globally or promising a French-only block it can't keep. It has also described a German case where geo-blocking was circumvented by VPN users and led to contempt fines. A penalty that looks small on one docket becomes existential when multiplied across 20 pending cases and any future ones. Quad9 says it cannot survive that accumulation.
The result is that a privacy-protecting nonprofit leaves a major market. No allegedly infringing site is removed, because Quad9 hosts nothing and users can switch resolvers. The EFF, which covered the exit, calls it a predictable result of making infrastructure providers into copyright police.
What EU law already says about this
The DSA doesn't create the power to order blocks, and I make no claim that this particular order was issued under it. But it does set the baseline vocabulary for orders against intermediaries. Under Article 9 of Regulation (EU) 2022/2065, an order to act against illegal content must state its legal basis and its reasons. It must identify the content, and it must give information on available redress. Most relevant here, the order's territorial scope must be "limited to what is strictly necessary to achieve its objective." Article 8 bars any general obligation to monitor.
The case law is older and sharper. In UPC Telekabel Wien (C-314/12, 2014), the Court of Justice allowed injunctions that leave the choice of measures to the provider, but only if the measures are "strictly targeted" and don't affect users lawfully accessing information. National procedure must also let users assert their rights before a court once the implementing measures are known.
Hold the Quad9 facts against that standard. A resolver that can't geolocate users cannot be strictly targeted. Its only compliant move is a global block, which collides with the strictly-necessary territorial limit. Nor is there any obvious route for the ordinary French user of a blocked domain to challenge the measure, which is the second Telekabel safeguard.
Where the transparency gap is
Article 15 of the DSA requires intermediary providers to publish annual reports that include the number of orders received from Member States' authorities, sorted by type of illegal content and issuing state. That is useful, but it counts orders. It doesn't record what an order cost, how many domains it covered, whether it was applied globally, or whether the provider quit a market to avoid it. If 20 suits against one resolver can end in withdrawal, the public record should be able to show that pattern. Today it largely can't, and I found no public tally of how many such orders French courts have issued against resolvers.
This is the proportionate-regulation point. A statute can have strong safeguards on paper and still produce arbitrary results if orders are issued case by case with no public accounting.
What proportionate enforcement would look like
- Treat territorial limits as a condition of the order. If a provider cannot reliably geolocate, the court should say so before imposing penalties, not leave the provider to choose between impossibility and global compliance.
- Make penalties reflect the order, not the docket. Per-case daily fines that stack across dozens of suits need an aggregate ceiling, or they push out exactly the small, privacy-focused operators that rights-holders don't need to defeat.
- Publish the order data. Orders against resolvers, with domain counts, penalty terms and scope, should be reported in a form researchers can count.
- Aim at the source. Rights-holders already have tools against streaming operators, payment processors and hosts. Chokepoint blocking should be the exception, not the default.
The cost of getting this wrong is concrete. Protective DNS filtering of malware and phishing is a public good, and Quad9 provides it. Driving the operator out of a country doesn't stop the piracy, but it does remove users' choice of a privacy-respecting resolver. France can protect sports rights without teaching infrastructure operators that the only safe response to an overbroad order is to leave.