Spanish Court Orders NordVPN And ProtonVPN To Block Piracy Sites

In a landmark escalation of the fight against online piracy in Spain, a Spanish commercial court has granted precautionary measures requiring NordVPN and Proton VPN to block access to websites identified as illegally streaming LaLiga matches within Spain. The decision, issued on February 17, 2026, underscores a broader shift in anti-piracy enforcement that now targets tools often used to circumvent broadcast rights protections.

The legal orders from Commercial Court No. 1 of Córdoba require VPN providers to immediately implement technical controls in their systems so that specific IP addresses verified as hosting illegal streams of LaLiga content are inaccessible from Spanish networks.

This requirement is dynamic, meaning LaLiga and its audiovisual partner, Telefónica Audiovisual Digital (TAD), can update the list of blocked IPs as new infringement sources are identified during live match broadcasts. Under Spanish procedure, these precautionary measures were granted inaudita parte (without the defendants present) and do not offer an avenue for appeal at this stage.

According to LaLiga's official information note on the court's decision, the injunctions rest on the recognition of VPN services as "technological intermediaries" under the European Digital Services Regulation, which imposes obligations on digital intermediaries to prevent infringements occurring through their infrastructure. LaLiga described this as a necessary advance in its global fight against piracy, aimed at making it harder for illegal streams to evade geographic restrictions and reach Spanish audiences.

LaLiga further stated,

Hence these precautionary measures to prevent these service providers "from contributing so that in Spain the access restrictions to certain websites that various Spanish judicial authorities have already decreed are evaded," in clear reference to the December 2024 judgment of Commercial Court No. 6 of Barcelona...For their part, the orders require LALIGA and Telefónica Audiovisual Digital to "preserve sufficient digital evidence of the unlawful transmission of the protected contents" that they notify to the defendants, thus supporting the reliability of the procedures that LALIGA had already been using by virtue of that same December 2024 judgment, among others...These judicial decisions, unheard of in Spain and pioneering worldwide due to their dynamic nature, add to other similar ones such as the one issued in France, where the responsibility of VPNs in the process of audiovisual fraud is also recognized.

LaLiga's legal strategy builds on years of anti-piracy efforts in Spain. A December 2024 ruling already empowered the league to order blocking of IP addresses linked to piracy, including extensive actions targeting infrastructure providers such as Cloudflare, the previous year. However, this latest ruling represents a significant shift, requiring entities that provide privacy and circumvention services to police access to their own networks.

Legal experts and industry observers see this as part of a broader European trend of imposing responsibilities on intermediaries beyond traditional internet service providers. In France, courts have already ordered major VPNs to block access to hundreds of illegal sports streaming sites, setting a precedent that Spanish authorities have now followed.

Responses from NordVPN and Proton VPN

Both NordVPN and Proton VPN have publicly protested the process surrounding the court decision, saying they were not formally notified of the proceedings before media reports surfaced. NordVPN's spokesperson, Laura Tyrylyte, said the company was not aware of any judicial proceedings in Spain at the time and that it had no opportunity to defend itself or review documentation before the ruling, saying,

At this stage, we have not received the judicial documents mentioned in the press so it will be premature to comment without having reviewed them. We were not part of any Spanish judicial proceedings to our knowledge, and therefore had no opportunity to defend ourselves. Given such judgments impact on how the Internet operates, such an approach by rightsholders is unacceptable

In response to the ruling, Proton VPN took to social media, stating that it had "not been formally notified of any proceedings or judgment" and emphasized the importance of due process. The company wrote that jurisdictions operating under the rule of law must ensure affected parties are given a fair opportunity to be heard, implying that the court's ex parte action could be procedurally invalid.

NordVPN also criticized the strategy's effectiveness, arguing that blocking domains and IP addresses does not address the root cause of piracy. Instead, the company maintained that anti-piracy efforts should focus on "eliminating the source of the content, targeting hosting providers, cutting off financing for illegal operations, and increasing the availability of legitimate content."

The court's move has sparked debate among legal scholars, privacy advocates, and technology professionals over its implications for internet neutrality, privacy, and infrastructure reliability. VPNs are widely used for legitimate activities, including protecting personal data on public Wi-Fi, preserving privacy, and enabling secure communications. The shared nature of many VPN server IPs means that blocking an address used by pirates could inadvertently disconnect thousands of legitimate users from services they rely on.

Because of this, critics argue that dynamic blocking measures could have extensive collateral effects. The dynamic ability to update blocked IPs in real time, while effective in theory at targeting illegal streams, raises the risk of disrupting lawful connections, whether people are working remotely, accessing cloud services, or using privacy tools for lawful reasons.

Another consequence is evident in recent historical data: anti-piracy blocks targeting infrastructure services like Cloudflare have, in the past, caused widespread outages for unrelated legitimate services and apps in Spain on match days when IP ranges were blocked. This history has amplified concerns that extending similar tactics to VPN services could repeat those patterns on an even broader scale.

The enforcement of this ruling remains uncertain. Neither NordVPN nor Proton VPN has yet confirmed how, or whether, they will comply with the Spanish order, and questions remain about the technical feasibility of implementing such blocks without eroding the privacy protections that are fundamental to their services.

Legal analysts also speculate about potential challenges in other jurisdictions: both Proton VPN (based in Switzerland) and NordVPN (based in Panama) operate outside the European Union, raising questions about whether Spanish court orders can be effectively enforced.

Nevertheless, LaLiga hailed the decision as unprecedented in Spain and pioneering worldwide, describing it as an important step in protecting its clubs' audiovisual rights and deterring piracy. Whether this model sets a lasting precedent in the complex global battle against online piracy remains to be seen, but for now, it marks a notable chapter in the intersection of sports media rights, privacy services, and internet governance.