On July 9, 2026, the Court of Justice of the European Union handed down a ruling that gives VPN users across the bloc something rare: a direct, explicit answer on whether using one to get around geo-blocking is legally risky. The short version is no, and the reasoning is worth understanding because it applies far beyond the specific case that produced it.

The case that forced the question

The ruling came out of a dispute over Anne Frank’s diary manuscripts, reported in detail by TechRadar. Copyright over the diary’s original text has expired in most of the roughly 60 countries that recognize the public domain cutoff, but a portion of the material remains protected in the Netherlands until 2037 under Dutch copyright rules. A website published the manuscripts behind geo-blocking that restricted access from the Netherlands specifically, while making them freely available elsewhere.

The Anne Frank Fonds, which holds certain rights tied to the work, argued that the geo-block wasn’t good enough, since anyone in the Netherlands could still reach the material with a VPN. If that argument had succeeded, it would have meant a publisher’s geo-blocking measure could be judged inadequate specifically because VPNs exist and defeat it, a standard that would have made almost any geo-restriction legally fragile.

What the Court actually decided

The CJEU rejected that argument. Per its judgment (case C-788/24, available in full on EUR-Lex), a “state-of-the-art” geo-blocking measure satisfies a publisher’s legal obligations even if a determined user can defeat it using a VPN. The fact that circumvention is technically possible doesn’t retroactively make the geo-block ineffective in the eyes of the law, and it doesn’t shift liability onto the VPN provider or the person using one.

The Court went further and categorized VPNs directly as lawful technical tools. If a geo-blocking measure turns out to be genuinely ineffective, the report notes, responsibility for any resulting unauthorized access to protected content falls on the party that published the work with an inadequate block, not on the VPN provider or the user connecting through it.

This is the first time the EU’s highest court has weighed in this directly on VPN legality in a copyright context, and the framing matters for reasons that go well past manuscripts and diaries. Streaming services, news sites, and sports broadcasters across Europe all rely on geo-blocking to segment their markets, and rights holders have occasionally floated the argument that services should be liable when VPN users slip through. This ruling takes that argument off the table, at least within the copyright framework the Court examined.

It also lines up with a broader legal reality that’s been building for years: VPNs are treated as neutral infrastructure, similar to a browser or an internet connection, rather than as circumvention tools carrying their own legal exposure. National courts and regulators across the EU can be expected to cite this ruling going forward whenever a similar question comes up.

Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.

Does this change anything for VPN users right now

Not in a way that requires you to do anything differently. VPNs were already legal to use throughout the EU before this ruling; nothing here creates a new right to use one. What it does is remove a specific legal argument that could have made using a VPN to access geo-blocked content riskier in the future, at least on copyright grounds. It’s a clarification of existing legal reality rather than a change to it, but a welcome one, given how often “is this legal” comes up whenever geo-unblocking is discussed.

If a ruling like this makes you more comfortable using a VPN for everyday geo-unblocking, the providers with the strongest legal and privacy track record in the EU remain NordVPN, based in Panama with an independently audited no-logs policy, and Proton VPN, headquartered in Switzerland with similar audit history.

It’s also worth being precise about what the ruling doesn’t cover. This case concerned copyright and geo-blocking specifically. It says nothing about VPN legality questions tied to other areas, like the ongoing debates in several EU member states and the UK over VPN use and age verification for social media, which our coverage of the EU’s ProtectEU proposals and UK age-verification debate track separately. Those are different legal questions with different pressures behind them, and this ruling doesn’t resolve either.

EU courts have dealt with circumvention technology before, but usually in contexts where the tool itself was built specifically to break a protection measure, like software designed to strip DRM from a specific format. Those cases produced a more cautious view of circumvention tools generally. This ruling draws a sharper line: a VPN is general-purpose infrastructure with an enormous number of legitimate uses that has nothing to do with any particular copyright dispute, and the Court’s reasoning treats it that way rather than folding it into the same category as a purpose-built DRM-stripping tool.

That distinction is the part legal commentators have focused on. Treating VPNs as neutral technical tools, rather than judging them by whatever a particular user happened to do with one in a specific case, is a more durable legal position, and one that avoids the awkward outcome of a VPN’s legal status depending on the intentions of whoever is using it in each individual dispute that reaches a courtroom.

The advocate general’s opinion foreshadowed this outcome

Legal observers following the case weren’t entirely surprised by the result. An earlier advisory opinion from the Advocate General assigned to the case, covered by Courthouse News, had already suggested that VPN use alone shouldn’t be treated as breaking copyright borders. The Court’s final judgment followed that reasoning closely, which is typical, though not guaranteed, since the Court isn’t bound by an Advocate General’s opinion.

What publishers and rights holders take from this instead

The ruling puts the responsibility squarely back on the publisher’s side of the equation. If you run a geo-restricted service in the EU, the standard you’re held to is whether your geo-blocking reflects the current state of the art, not whether it’s theoretically unbeatable by every possible tool. That’s a more achievable bar, and one that several commentators, including IPKat’s analysis of the judgment, noted has implications reaching beyond copyright into how courts might reason about circumvention technology generally, AI tools included.

Our verdict

This is a genuinely good outcome for VPN users and providers, and a rare case of a major court addressing VPN legality with this much clarity. It doesn't change what you can legally do today, since using a VPN in the EU was never illegal, but it closes off a specific legal theory that could have made geo-unblocking a shakier proposition down the line. Worth remembering the boundary though: this ruling is about copyright liability, not about the separate and still unsettled fights over VPNs and age verification playing out in Brussels, London, and several national capitals.

Sources: TechRadar coverage of the ruling | Full judgment on EUR-Lex, case C-788/24 | Advocate General’s earlier opinion, via Courthouse News | IPKat’s legal analysis