A Copyright Dispute With Wider Reach
On 9 July 2026, the Court of Justice of the European Union's Second Chamber ruled in Anne Frank Fonds v Anne Frank Stichting (Case C-788/24) that a publisher who uses "state-of-the-art" geo-blocking satisfies its legal obligations under EU copyright law — even when users circumvent that block with a VPN. The case itself is narrow: parts of Anne Frank's diary manuscripts remain copyrighted in the Netherlands until 2037 but are in the public domain elsewhere in the EU, so the Anne Frank Stichting published a scholarly edition online while geo-blocking Dutch visitors. The Anne Frank Fonds sued, arguing that VPN circumvention made the geo-block meaningless. The Court disagreed, and in doing so said something considerably broader about who bears responsibility when a privacy tool is used to route around a restriction (EUR-Lex, Case C-788/24).
What the Court Actually Held
Two holdings matter beyond copyright. First, the possibility that a technological measure can be circumvented "cannot, in itself and in all circumstances, be a decisive factor" in judging whether that measure is effective — publishers aren't required to build an unbreakable wall, just a genuine one. Second, and more consequential, the Court held that VPN providers are not liable for enabling that circumvention, because a VPN "does not give end users access to a protected work" and does not play an "indispensable role" in any unauthorized transmission. VPNs, in the Court's framing, are lawful technical tools, not accomplices to whatever their users do with them (EUR-Lex; TorrentFreak).
The Age-Verification Collision Course
That reasoning lands in the middle of a live fight over VPNs and child safety. The European Parliamentary Research Service published a briefing on 20 January 2026, Virtual Private Networks and the Protection of Children Online, warning that VPNs represent "a loophole in the legislation that needs closing" as age-verification laws spread across the bloc, and floating whether VPN providers should eventually face a legal duty to verify their own users' ages (EPRS briefing, europarl.europa.eu). The concern isn't hypothetical: one VPN developer reported downloads surging roughly 1,800% in the month after the UK's Online Safety Act took effect in July 2025 (Tom's Hardware). The Commission, meanwhile, is urging member states to roll out its EU age-verification app — which lets users prove they meet an age threshold without disclosing identity — by the end of 2026, and Executive Vice-President Henna Virkkunen has publicly flagged VPN circumvention as a risk to that system. The Commission's own FAQ concedes the point directly: "it may be technically possible to circumvent age verification techniques, for example by using a VPN," though it argues this "does not undermine the value of the app" (Commission, digital-strategy.ec.europa.eu; Commission news, commission.europa.eu).
Steelmanning the Case for Closing the Loophole
The child-safety argument deserves a fair hearing before it's dismissed. Regulators aren't inventing a problem: age-verification regimes only work if the population they're meant to cover can't trivially opt out, and a service that lets a 14-year-old present as an adult in another jurisdiction with one tap genuinely weakens the protection Parliament intended to create. An 1,800% download spike immediately after a safety law takes effect is a real signal, not noise, and it's reasonable for regulators to ask whether the intermediary that makes evasion effortless should carry some responsibility for the outcome — especially when that intermediary is a for-profit commercial service, not a neutral pipe.
Why the Court's Underlying Principle Still Applies
But the CJEU's reasoning — a copyright ruling, not a child-safety one — points to why extending liability to VPN providers would be the wrong fix. The Court's logic is a standard feature of EU intermediary-liability doctrine, echoed in the Digital Services Act's own hosting and mere-conduit exemptions: a provider that doesn't play an indispensable role in a specific unlawful act shouldn't be held liable merely because its general-purpose tool was one link in the chain. A VPN provider that has no visibility into, and no technical means of assessing, what a given user does with an encrypted tunnel is functionally in the same position as an ISP or a browser vendor — neither of which the EU proposes to conscript into age-checking their entire user base.
More importantly, the fix regulators are circling — requiring VPN providers to verify user age — would require VPNs to do the one thing that makes them valuable: identify and log their users. That defeats the purpose for the large majority of VPN traffic that has nothing to do with age verification at all: journalists protecting sources, businesses securing remote access, and users in authoritarian states routing around censorship the EU itself condemns. Converting privacy infrastructure into an identity checkpoint, to close a gap the Commission's own FAQ admits won't be airtight anyway, is a disproportionate trade — and the DSA already gives regulators a proportionate route: impose the verification duty on the age-restricted platforms in scope of that law, not the general-purpose network tools sitting outside it.
The Proportionate Path
No EU legislative proposal to restrict VPNs currently exists — the EPRS briefing is Parliament's research arm flagging a policy question, not adopted law. But the Anne Frank ruling should weigh on how that question gets answered when it reaches a legislative text. Brussels can keep pushing its age-verification app forward on its own merits. It should resist the temptation to backstop that app's limitations by making VPN providers the identity police for everyone else's internet traffic.