NordVPN has won a significant legal fight in Spain, successfully pushing back against an attempt by La Liga, Spanish football’s top division, to hold the VPN provider liable in the same way courts have started treating VPNs in France. The ruling matters well beyond Spain: it’s one of the first times a court has drawn a clear line against extending anti-piracy blocking obligations from ISPs onto VPN providers, at a moment when France has been moving in exactly the opposite direction.
What La Liga was trying to do
La Liga has spent the past several seasons in an aggressive campaign against pirate football streams, working with Spanish ISPs to block access to sites and, controversially, entire IP ranges (including some belonging to legitimate services like Cloudflare) suspected of hosting or fronting pirate streams. La Liga sought to extend that same blocking framework to NordVPN, arguing that VPN traffic was being used to circumvent the ISP-level blocks it had already secured, and that NordVPN should therefore face similar obligations or penalties.
Why the Spanish court sided with NordVPN
The core of the ruling draws a distinction courts across Europe are increasingly being asked to make: is a VPN provider more like an ISP, a network operator with visibility and control over the traffic passing through it, or more like a privacy tool whose entire function depends on not inspecting or filtering that traffic? The Spanish court’s decision leaned toward the latter, rejecting the idea that a VPN can be held to the same blocking standard as an internet service provider without fundamentally changing what a VPN is.
This directly contrasts with the situation in France, where Paris courts have ordered NordVPN, Proton, Surfshark, ExpressVPN, and CyberGhost to block hundreds of pirate sports streaming domains under Article L333-10 of the French Sports Code, with NordVPN currently appealing that outcome. Spain and France, two of Europe’s largest football markets, are now on visibly different legal tracks over the same underlying question.
Why this matters if you’re not in Spain or France
Rights holders across Europe have been watching both cases closely as potential templates for other jurisdictions. A win for La Liga’s approach in Spain would likely have encouraged similar filings in Italy, Germany, and elsewhere, on the logic that if VPN-level blocking works in France and Spain, it’s worth trying everywhere sports piracy is a problem. This ruling removes that momentum, at least for now, and gives VPN providers a concrete legal precedent to cite if similar cases are filed in other EU jurisdictions.
Timeline
The dispute developed over the 2025/2026 football season as La Liga’s ISP-level blocking campaign expanded and increasingly caught VPN traffic and legitimate infrastructure in its net, drawing criticism even from parties unrelated to VPN providers. NordVPN’s Spanish case was decided this month, arriving roughly six weeks after the French appeal was confirmed as ongoing, giving observers a rare side-by-side comparison of how two major EU jurisdictions are handling functionally the same legal question within the same football season.
The bigger tension: privacy tool or network gatekeeper
Both the French and Spanish cases sit on top of the same unresolved question the VPN industry has been grappling with all year: as VPN adoption has grown into the mainstream, driven partly by age-verification laws and partly by ordinary streaming and privacy use, regulators and rights holders increasingly want to treat VPNs as just another layer of network infrastructure that can be compelled to filter, block, or report. VPN providers, NordVPN and Proton loudest among them, have argued that complying with that logic anywhere undermines the no-logs, no-inspection promise that makes a VPN worth using at all.
This Spanish ruling is a genuine win for the industry’s position, but it’s not the end of the story. NordVPN’s French appeal is still pending, and La Liga has other legal avenues in Spain it could still pursue, including a potential appeal of this specific ruling.
Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.
How Spain’s approach differs technically from France’s
France’s blocking orders work by requiring VPN providers to maintain and apply a list of banned domains directly within their own infrastructure, effectively asking the VPN to run its own mini-blocklist the way an ISP would. What La Liga wanted in Spain leaned in a similar direction but went further in places, at points seeking to hold NordVPN responsible for traffic patterns rather than specific domains, a broader and, the court found, harder to justify standard. That distinction, specific domain blocking versus broader traffic-pattern liability, is likely part of why the two cases are heading in different directions even though they share a common origin in football piracy enforcement.
What rights holders do next
Expect La Liga and similar rights holders bodies elsewhere to keep testing narrower, more specific requests rather than abandoning the approach entirely; the French domain-blocking model remains intact and under appeal, not overturned. Sports piracy enforcement has become one of the more active fronts in European VPN regulation precisely because live sports broadcasting rights are worth enormous sums and the piracy problem is real and ongoing, not a hypothetical rights holders are inventing.
What this changes for everyday NordVPN users
Practically, nothing changes immediately for subscribers in Spain or elsewhere; NordVPN was never actually blocking or filtering traffic under either the French order (which it’s appealing) or this Spanish case (which it just won). The significance is precedent, not a feature change. If you’re a NordVPN user watching how this plays out elsewhere, the practical read is that the company has, so far, been willing to litigate rather than quietly comply, which is the behavior you’d want from a provider handling your traffic.
Where this leaves NordVPN’s broader legal standing
NordVPN has had an active year in courtrooms beyond this case, including an ongoing lawsuit over its auto-renewal subscription practices in the US, an unrelated matter but one that adds to a picture of a company facing legal pressure on multiple fronts simultaneously in 2026. Winning the Spanish case doesn’t offset that, but it does demonstrate the company is willing to invest in contesting cases it thinks it can win rather than settling or complying by default, which is the more relevant signal for privacy-focused subscribers weighing which provider to trust with their traffic long-term.
A genuine and important win for NordVPN and the broader argument that VPNs shouldn't be regulated like ISPs. It doesn't resolve the parallel fight in France, and rights holders elsewhere in Europe will keep testing this legal theory in new courts. Worth watching if you care about where VPN regulation in Europe is headed next, less relevant to your day-to-day service if you're just a subscriber.
For the French side of this story, read our full breakdown of the French court VPN blocking order, our NordVPN review, or our wider look at VPN industry trends in mid-2026.