A Spanish court has issued precautionary measures against two well-known providers of private virtual networks: NordVPN and ProtonVPN. The order forces both services to block access from Spain to a long ten sites that, according to demand, they illegally broadcast football matches. The striking case is not only the direction of the measures - targeting VPN suppliers rather than traditional hosts - but the procedural formula used: they agreed part, that is, without the companies in question being previously summoned to defend themselves.
According to the resolution, the restrictions apply to a dynamic list of IP addresses within Spanish territory and, at least at first instance, the possibility of an immediate appeal against this interim order is not provided. In addition, LaLiga and its broadcast partner, Telefónica, have been forced to keep "sufficient digital evidence" on alleged illicit transmissions, pointing to a strategy of persecution that combines blocking and preservation of evidence for possible subsequent actions.

LaLiga has defended the measure as consistent with its anti-piracy action line, which in recent years has included public confrontations with Internet intermediaries; for example, it issued critical releases against Cloudflare for allegedly facilitating unauthorized retransmissions in his own statement. In addition, the applicant argued to the judge that services such as those of the VPN fall within the scope of European rules on digital services and therefore have obligations to prevent their infrastructure from being used systematically in copyright violations. For those who want to consult the policy framework, the European Commission maintains public information on the regulatory package known as Digital Services Act: DSA and its objectives.
On the basis of the resolution the court points out that VPN are tools that facilitate in a "high and accessible" way to avoid geographical restrictions and access to unauthorized content from certain geographical points, and that some companies explicitly publicize the ability to remove blockades and controls. This interpretation raises an important legal line: if a technical service announces that it helps to avoid regional constraints, judges can consider it as a sufficient contribution to the infringement to impose diligence obligations.
The reactions of the companies were not expected. ProtonVPN published on social networks that it had no formal knowledge of the proceedings and questioned the procedural validity of an order issued without prior notification to the parties concerned. His message stressed that, in a rule of law, due process requires the possibility of being heard before imposing measures that so directly affect the operation of Internet services; the communication is accessible in its public profile: ProtonVPN declaration.
NordVPN, for its part, told the press that it had not received the above-mentioned judicial documents and that it had therefore not participated in the proceedings. The company added that the blocking orders on domains or IP addresses rarely attack the root of the problem, as those responsible for illegal retransmissions can move the location of the files, create subdomains or change accommodation providers very easily. NordVPN argued that effective control against piracy should focus on cutting the source of emissions, their financing and improving legal supply, rather than focusing only on intermediaries providing connectivity services.
Beyond the views found, the case opens technical and practical questions. Blocking IP addresses in a dynamic list poses the risk of collateral blocking of legitimate services sharing IP addresses or cloud infrastructure. The very changing nature of addresses in accommodation services and content delivery networks makes the blocking tactic, in many cases, a temporary solution: infrastructure changes and evaders adapt. In addition, there is a paradox that measures directed at established payment providers could leave free services or less visible actors, which, precisely because of their structure, are more difficult to regulate.
In the legal field, the precedent is relevant. LaLiga has celebrated the decision as a milestone in Spain, resembling resolutions in other European countries where intermediaries have been tried to be held accountable for facilitating access to protected content. However, the precautionary approach used and the absence of a prior hearing complicate the picture: the companies concerned are likely to challenge the decision if formal notification is confirmed, which would lead to discussions on the proportionality of the measures, the protection of commercial secrecy and the defence of the right to privacy and anonymity on the network.
For users and for those who manage legitimate content, the lesson is double. For consumers, the debate is reopened on the extent to which services that promise privacy and circumvention of restrictions may be forced to execute court orders without the end-user being able to distinguish between legitimate measures and unnoticed censorship. For rights-holders, the resolution reinforces the idea that disputes are no longer limited to the sites hosting the emissions, but can be addressed to the chain of intermediaries that facilitate access.

It is important to remember that these matters are not only legal or technical: they are also market-based. Experience shows that reducing the demand for pirate content is to improve the availability and attractiveness of legal alternatives, as well as to attack the sources of financing for illicit networks. The television and streaming industry itself has been adopting models and offers that meet these needs, but the process is uneven and the gaps continue to be exploited by platforms outside the legitimate circuit.
In short, the Spanish resolution is one more piece in a complex battle between copyright, technological intermediaries and due process. If the arguments against VPN are successful as facilitators of illicit access, we could see a shift of focus in the fight against piracy, with more orders addressed to connectivity providers and less to simple content hosts. It remains to be seen how resources will be developed, what criteria other European jurisdictions will adopt, and how the courts will balance the protection of intellectual property with the defence of privacy and the correct judicial procedure.
For those who want to expand information, see the official LaLiga communiqué on measures Here., the public replica of ProtonVPN in networks Here. and the European regulatory framework applicable on the Commission's website on the Digital Services Act. In addition, the press pages and official releases of suppliers, such as the NordVPN press section ( nordvpn.com / press), are useful in monitoring the evolution of the case.
Related
More news on the same subject.

18-year-old Ukrainian youth leads a network of infostealers that violated 28,000 accounts and left $250,000 in losses
The Ukrainian authorities, in coordination with US agents. They have focused on an operation of infostealer which, according to the Ukrainian Cyber Police, was allegedly adminis...

RAMPART and Clarity redefine the safety of IA agents with reproducible testing and governance from the start
Microsoft has presented two open source tools, RAMPART and Clarity, aimed at changing the way the safety of IA agents is tested: one that automates and standardizes technical te...

The digital signature is in check: Microsoft dismands a service that turned malware into apparently legitimate software
Microsoft announced the disarticulation of a "malware-signing-as-a-service" operation that exploited its device signature system to convert malicious code into seemingly legitim...

A single GitHub workflow token opened the door to the software supply chain
A single GitHub workflow token failed in the rotation and opened the door. This is the central conclusion of the incident in Grafana Labs following the recent wave of malicious ...

WebWorm 2025: the malware that is hidden in Discord and Microsoft Graphh to evade detection
The latest observations by cyber security researchers point to a change in worrying tactics of an actor linked to China known as WebWorm: in 2025 it has incorporated back doors ...

Identity is no longer enough: continuous verification of the device for real-time security
Identity remains the backbone of many security architectures, but today that column is cracking under new pressures: advanced phishing, real-time proxyan authentication kits and...

The dark matter of identity is changing the rules of corporate security
The Identity Gap: Snapshot 2026 report published by Orchid Security puts numbers to a dangerous trend: the "dark matter" of identity - accounts and credentials that are neither ...