In a move that fundamentally threatens the neutrality of internet infrastructure, a Spanish court has ordered two of the world’s leading privacy providers—NordVPN and ProtonVPN—to actively block websites accused of streaming illegal football matches.
The order, issued by Commercial Court No. 1 of Córdoba on February 17, 2026, was granted inaudita parte—meaning “without the other party being heard.” Neither NordVPN nor ProtonVPN were notified of the proceedings, nor were they given a chance to defend themselves before the hammer dropped.
This isn’t just about football. It represents a dangerous shift in how Europe views privacy tools: no longer as neutral security utilities, but as accomplices to be commandeered by private corporations.
The Order: “Dynamic” Censorship
The ruling serves the interests of LaLiga (Spain’s top professional football division) and its broadcast partner, Telefónica. Under the mandate, the VPN providers are required to block access to a “dynamic list” of IP addresses provided by LaLiga.
Unlike traditional court orders which target specific, static domain names (e.g., piratesite.com), this order allows LaLiga to continuously update the blacklist in real-time as new servers pop up. The court seemingly accepted LaLiga’s argument that VPNs fall under the EU Digital Services Regulation (DSA), classifying them not as mere conduits of data, but as “technological intermediaries” with a legal duty to prevent copyright infringement.
Proton Mail’s Legal Battle for Privacy: Challenging Australia’s eSafety Regulator
Crucially, the court explicitly noted that these measures are non-appealable in the immediate term, stripping the defendants of standard legal recourse.
The “Due Process” Vacuum
The most alarming aspect of this ruling is the procedural shortcut used to obtain it. By filing for inaudita parte measures, LaLiga effectively successfully argued that notifying the VPN companies would defeat the purpose of the order.
ProtonVPN immediately pushed back on social media, exposing the absurdity of the situation:
“Any judicial order issued without proper notification to the affected parties, thereby denying them the opportunity to be heard, would be procedurally invalid under fundamental principles of due process.”
NordVPN echoed this sentiment in a statement to the press, noting they hadn’t even received the court documents yet:
“We were not part of any Spanish judicial proceedings to our knowledge… Given such judgments impact on how the Internet operates, such an approach by rightsholders is unacceptable.”
This creates a chaotic legal standard where a private entity (LaLiga) can effectively rewrite the firewall rules of global security companies without those companies ever stepping foot in a courtroom.
Denmark Withdraws VPN Ban After Public Outcry—But the Global War on VPNs is Just Beginning
Technical Theater: Why It Won’t Work
Beyond the legal overreach, the ruling betrays a profound misunderstanding of how the internet works. LaLiga’s strategy relies on a game of “Whack-a-Mole” that they cannot win.
- The Subdomain Shuffle: As NordVPN’s spokesperson Laura Tyrylyte pointed out, “Pirates can easily bypass the restrictions” by simply spinning up new subdomains or shifting to new hosting providers. Blocking an IP address is a temporary inconvenience for a pirate, not a permanent solution.2. The “Free VPN” Loophole: The order targets premium, compliance-focused companies like Nord and Proton. However, the vast majority of piracy traffic flows through sketchy, free VPNs or decentralized networks that have no legal presence in Spain and will simply ignore the court order.3. Collateral Damage: Blocking IP addresses is a blunt instrument. In modern cloud hosting (like Cloudflare or AWS), a single IP address can host thousands of legitimate websites alongside one pirate stream. By forcing VPNs to block these IPs, the court risks knocking offline innocent businesses, blogs, and services that happen to share a server with a soccer stream.
UAE’s Battle Against VPN Abuse in The Digital Age: Safeguarding the Cyber Realm
The Dangerous Precedent
This ruling aligns with a growing trend in Europe, following similar aggressive moves in France. The strategy is clear: if you can’t catch the pirates, threaten the infrastructure they use.
LaLiga’s announcement tellingly complained that VPNs advertise their ability to “evade restrictions.” They view privacy features—masking your location and encrypting your traffic—as inherent evidence of guilt.
If this legal theory holds, it threatens the core value proposition of any VPN. If a VPN provider is forced to inspect traffic or blindly blacklist IPs at the behest of a copyright holder, they are no longer a “Virtual Private Network.” They become a filtered proxy service for the state.
For now, users in Spain are left in limbo, and privacy advocates worldwide are watching closely. If a copyright claim is enough to bypass due process and break internet infrastructure in Spain, it won’t be long before other industries—and other governments—try to do the same.
Russia’s WhatsApp and VPN Restrictions: Separating Fact from Fiction
