Law & Regulation

A 1947 Diary Just Set Europe's VPN Liability Rule

The EU's top court ruled that geo-blocking only needs to be state-of-the-art, not VPN-proof. The case was about Anne Frank's diary. The consequence is a compliance bar that keeps moving.

Law & RegulationBy Servola Tech Desk2026-08-134 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

A 1947 Diary Just Set Europe's VPN Liability Rule

Key takeaways

On July 9, 2026, the Court of Justice of the European Union ruled in Case C-788/24, Anne Frank Fonds v Anne Frank Stichting, that a company can lawfully publish content online that is public domain in one EU member state but still copyrighted in another, as long as its geo-blocking is a 'proportionate and state-of-the-art' technical measure - it does not have to be absolute or impossible to circumvent, according to the Court's own judgment.
The case arose because a scholarly edition of Anne Frank's diary, public domain in Belgium and several other states but protected in the Netherlands until 2037 under rights held by the Anne Frank Fonds, was published in 2021 on a Belgian-registered website with geo-blocking meant to keep Dutch visitors out.
The Court explicitly ruled that a self-declaration system, where a visitor simply states their location, does not meet the 'effective' threshold, and separately that VPN providers cannot be held liable for enabling users to circumvent a geo-block, according to the judgment and CMS law firm's published analysis of the case (Sarah Wright, Agnes Solyom, Mike Walsh).
CMS's analysis states the ruling requires no single fixed technical checklist - only a proportionality test applied case by case by the referring Dutch national court - meaning the same geo-blocking setup that satisfies the law in 2026 has no guarantee of still satisfying it once VPN-detection technology has moved on.

What the Court Actually Decided

Case C-788/24 reached the CJEU because of a genuinely awkward copyright situation: The Diary of Anne Frank entered the public domain in Belgium and a number of other EU member states years ago, but remains protected in the Netherlands until 2037, with rights held by the Anne Frank Fonds since Otto Frank's death. In 2021, a scholarly edition of the diary was published online by a Belgian entity, geo-blocked to prevent Dutch visitors from accessing content that would still infringe copyright inside the Netherlands. The Anne Frank Fonds sued anyway, and the case worked its way up to the EU's top court.

The Court's answer, delivered on July 9, 2026, was that publishing public-domain content online across the EU is lawful even where the same content remains protected elsewhere, provided the publisher's geo-blocking is a genuinely 'proportionate and state-of-the-art' technical measure. It does not need to be perfect. A visitor who defeats it with a VPN does not, on its own, make the geo-block legally ineffective - but a system that relies on visitors honestly declaring their own location does fail the test, according to the judgment.

Good Enough, Not Bulletproof

The distinction the Court drew matters more than it first looks. Before this ruling, any publisher relying on geo-blocking to manage cross-border copyright exposure had no clear answer to an obvious question: how good does the blocking actually have to be? Perfect and circumvention-proof was never realistic, given that consumer VPN use is legal and widespread across the EU. The Court's answer removes that impossible bar and replaces it with a real-world one - industry-standard, technically current, genuinely trying - while still requiring more than a tick-box honor system.

CMS's legal analysis of the ruling, authored by Sarah Wright, Agnes Solyom and Mike Walsh, notes that the Court left the actual determination of what counts as 'effective' to the referring Dutch national court, applying a proportionality test rather than a fixed checklist. There is no EU-wide certified list of compliant geo-blocking vendors or methods that comes out of this judgment - only a standard for national courts to apply, case by case.

VPN Providers Just Got a Liability Shield

The ruling's second half is arguably more consequential for a much bigger industry than academic publishing. The Court held that VPN providers cannot be held liable merely because their product lets a user bypass a website's geo-block. That is a direct answer to a legal question VPN companies have operated under uncertainty about for years: does selling a tool that defeats geo-restriction expose the seller to the publisher's copyright claim? The CJEU's answer, per the judgment, is no - VPNs are lawful technical tools, and using one to route around a geo-block is not, by itself, copyright infringement or grounds to make the VPN provider liable.

That protects a large legal industry built on privacy and access tools from a liability theory that could otherwise have followed every geo-blocking dispute in Europe. It does not touch other legal questions around VPN use - only this specific one, about whether enabling circumvention of a geo-block creates liability for the tool provider.

The Compliance Bar That Never Stops Moving

Here is the part of this ruling that will not show up in most headlines: 'state-of-the-art' is not a fixed standard. It is measured against whatever geo-blocking and VPN-detection technology is actually capable of at the time a court looks at the question - and that capability keeps improving. CMS's own analysis flags that publishers face 'ongoing technical maintenance' obligations and may need a 'granular inquiry into system architecture' to defend a specific setup, not a one-time compliance exercise.

The practical consequence for any EU business that geo-restricts content, pricing, or access - streaming platforms, digital archives, territorially licensed SaaS, regional pricing pages - is that a geo-blocking setup that clears the bar today is not guaranteed to clear it in three years, even if nothing about the setup itself changes, simply because the definition of 'state-of-the-art' keeps advancing around it. A case about a wartime diary just handed EU compliance teams a standard with no finish line.

Frequently asked questions

What did the CJEU actually rule in the Anne Frank case?

In Case C-788/24, decided July 9, 2026, the Court ruled that publishing content online that is public domain in one EU state but copyrighted in another is lawful, as long as the publisher uses a proportionate, state-of-the-art geo-blocking measure - it does not need to be impossible to circumvent.

Does this mean VPNs are illegal to use for bypassing geo-blocks?

No. The ruling addresses the publisher's and the VPN provider's legal exposure, not the individual user's. It holds that VPN providers are not liable merely for enabling circumvention, and that a determined user circumventing a geo-block does not, by itself, make the block legally ineffective.

What geo-blocking method fails the Court's test?

A self-declaration system, where a visitor simply states their own location without any technical verification, does not meet the 'effective' threshold the Court set, according to the judgment.

Does this ruling give businesses a fixed compliance checklist?

No. CMS's published legal analysis of the case notes the Court applied a proportionality test rather than a fixed technical standard, leaving assessment to national courts case by case - meaning what counts as compliant can shift as geo-blocking and VPN-detection technology evolves.

Most EU compliance stories involve a new law, a new fine, or a new regulator. This one involves neither - just a copyright dispute over a 1947 diary that quietly reset the legal bar for every business in Europe that restricts content, pricing, or access by country. The bar it set is real and workable, which is the good news. The bad news is that it never stops moving, and no one gets to declare the job finished.

CJEUCopyrightGeo-blockingVPNEU court rulingCompliance

Vet a paid partner, lose the EU hosting shield

The Court of Justice held on 16 July 2026 that Google's pre-contract review of a YouTube channel means Article 14 hosting immunity does not apply. What owners who pay content partners should do now.

7 min read

AI Policy

A Delhi Court Backed OpenAI on Training Data

A Delhi judge refused to block OpenAI, holding that training ChatGPT on a news agency's articles is prima facie fair dealing. Why the ruling does not settle the same question in Europe.

3 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.

4 min read

← All articles