Yes, VPNs are legitimate tools.
The CJEU recently issued a ruling that some have interpreted in this way. It’s a simplification. The European Union’s top court did not make a general statement, but offered a hypothesis that guided its judgment.
The VPN circumvention…
The case concerned the manuscripts of the Diary of Anne Frank. Under a transitional regime in the Netherlands, part of these writings remained protected by copyright until 2037—with the Anne Frank Fonds, based in Switzerland, as the holder. In other European countries, they have fallen into the public domain.
In 2021, a digital edition of the manuscripts was published for free on a Belgian-hosted website, run at the initiative of Dutch organizations, including the Anne Frank Foundation. This site applies a geoblocking measure to restrict access from the Netherlands.
The Anne Frank Fonds argued that despite this geoblocking, the site remained technically accessible from the Netherlands via VPNs, risking unauthorized communication to the public on Dutch soil. It had been dismissed at first instance. It did so on appeal as well, on the grounds that the site’s publishers had taken reasonable measures. Hence its appeal to the Dutch Supreme Court… which ultimately referred the matter to the CJEU.
The CJEU concluded that the use of a “state-of-the-art” geoblock — i.e., one capable of preventing access within a normal Internet-use scenario — demonstrated the publisher’s intention not to target or include the public residing in the country where the work is protected.
… and geoblocking does not render it “ineffective”
The geoblock does not lose its “effectiveness” simply because it can be bypassed by a VPN, the CJEU added. It also held that this circumvention, as an individual, unilateral action by the user, does not, in itself, engage the site operator’s liability.
In its reasoning, the court underscored the need to maintain a balance between copyright and freedom of expression and access to information. Requiring a site to absolutely prevent any VPN workaround would make it nearly impossible to offer public-domain works whenever they remain protected in at least one Member State. At the same time, such a requirement would extend copyright beyond reasonable limits.
In the scenario of an ineffective geoblock, the liability for unauthorized communication cannot rest on the VPN provider, at least as long as the tools themselves are lawful…
Complementary reading:
The CJEU affirms site liability for content curated by algorithms
GDPR prevails over business secrets, according to the CJEU
Why the CJEU did not invalidate the Data Privacy Framework
The U.S. Copyright Office weighs in on generative AI
ChatGPT and copyright: OpenAI, within the bounds of fair use?
