The EU's top court says geo-blocking still counts, even if a VPN beats it

On July 9, 2026, the EU's Court of Justice ruled that a website's geo-blocking can stay legally effective even after a VPN gets a user around it. The case that produced the rule is about who can publish Anne Frank's manuscripts online for free. The rule itself is about something every builder eventually has to answer: how good does a geo-block have to be before you can call it done.

The fact pattern: one manuscript, two copyright clocks

Anne Frank's writings are public domain in Belgium, where the copyright has expired, but still protected in the Netherlands until 2037. Two Dutch institutions, the Anne Frank Stichting and the Royal Netherlands Academy of Arts and Sciences, along with a Belgian research association, published a free scholarly edition of the manuscripts online, hosted to respect the Belgian side of that split. The Anne Frank Fonds, the Swiss foundation that holds the copyright, sued anyway: Dutch users could still reach the site through a VPN.

What the court actually decided

The court's answer, in Case C-788/24, is that publishing a public-domain work online for one EU country does not infringe copyright in a country where the work is still protected, as long as the publisher uses a 'state-of-the-art' geo-blocking measure. Critically, that measure does not have to be unbeatable. It stays legally effective even if a VPN lets someone in the restricted country get around it. The court sent the case back to the Dutch Supreme Court, which referred the questions in the first place, to apply that standard to the actual facts.

Where the liability actually lands

The part that matters past this one case: if a geo-block later turns out to not be state-of-the-art, or stops being maintained, the liability sits with whoever published the work, not with the VPN provider that helped a user get around it. The ruling does not regulate VPNs directly, but the practical read from legal coverage is consistent: a VPN is a lawful tool, and the publisher who chose the geo-block owns the risk of it failing.

Why a build studio cares

We have built geo-restricted features before, and geo-blocking has never been the same thing as a hard wall. That gap is a design constraint every one of those builds has to be honest about from day one. This ruling puts a number on how honest: the legal bar is now state-of-the-art and effective, not unbeatable, and that is a standard that has to be kept current, not implemented once and forgotten. In practice that means documenting the blocking method as current at build time, planning for what state-of-the-art will mean next year, and writing down, before launch, who owns the risk if a user tunnels past it. This ruling answers that last question for the EU: the risk sits with whoever built the gate, not the tool a user picked to get through it.

Next step: read the CJEU's own press release for the court's exact wording, and TorrentFreak's summary for the practical read. If your product ships a geo-restricted feature and you want a second look at where the liability actually sits, write to us at hello@gattyworks.com.