The Court of Justice of the European Union (CJEU) has ruled that virtual private networks (VPNs) are lawful technical tools and that their existence alone does not make website operators liable for copyright infringement when users bypass geographical restrictions. The judgment stems from a long-running legal dispute over the online publication of Anne Frank’s manuscripts, a case that has become an important precedent for copyright enforcement and the use of privacy technologies across the European Union.
The dispute arose because Anne Frank’s writings are in the public domain in Belgium and many other countries, but portions of the work remain protected by copyright in the Netherlands until 2037. A group of Dutch and Belgian academic institutions published a scholarly online edition of the manuscripts from Belgium, where doing so is legal. To prevent access from countries where copyright protection still applies, the publishers implemented geo-blocking and an additional location verification system.
The Anne Frank Fonds, which manages the Dutch copyright, argued that those safeguards were insufficient because users could bypass them by connecting through a VPN or proxy service and falsely declaring their location. According to the copyright holder, the possibility of circumventing the restrictions meant the publishers were effectively making the protected work available to readers in the Netherlands.
The CJEU rejected that interpretation. The court concluded that when a publisher deploys state-of-the-art geo-blocking measures to restrict access in territories where copyright protection applies, it cannot be held responsible simply because some users intentionally evade those restrictions with VPNs or similar technologies. The judges described VPNs as lawful technical tools rather than instruments whose existence automatically creates legal liability for publishers or service providers.
The ruling also reinforces the legal distinction between providing a neutral technology and being responsible for how individual users employ it. According to the court’s reasoning, copyright holders cannot rely solely on the fact that VPN services exist to argue that geo-blocking measures are ineffective or that online publishers are intentionally communicating copyrighted material to audiences in protected jurisdictions.
Privacy advocates have welcomed the decision, arguing that it acknowledges the legitimate role VPNs play in protecting users’ online privacy and securing internet communications. The judgment comes at a time when VPNs have become the focus of broader regulatory discussions in Europe, particularly in connection with age verification systems and proposals intended to prevent users from bypassing online restrictions. Those debates have prompted concerns among cybersecurity experts that privacy tools could increasingly be viewed as circumvention technologies rather than essential security software.
While the judgment does not change copyright laws or legalize unauthorized distribution of protected works, it provides guidance on how courts should assess liability when publishers use appropriate geo-blocking measures. The decision is expected to influence future copyright disputes involving territorial licensing and online access restrictions, while also affirming that VPN providers themselves are not responsible simply because their services can be used to bypass geographical blocks.