The Court of Justice of the European Union ruled on July 9, 2026 that a website can legally publish a work still under copyright in one member state, provided it deploys state-of-the-art geo-blocking, even if determined users can defeat that block with a virtual private network.

Your Feed Has a Viewability Problem

If nobody's reading it, did it ever really load? Add PPC Land as your preferred source in Google Search and actually see the stories that matter.

Fix My Sources

A dispute over a wartime diary reaches Europe's highest court

The case began with a scholarly edition of a teenager's private writing. Anne Frank kept a diary between 1942 and 1944 while hiding from Nazi occupation in Amsterdam. She did not survive the war. Her father, Otto Frank, did, and in 1947 he published his daughter's account of those years, then founded the Anne Frank Fonds, or Anne Frank Fund, in 1963. That organization has held copyright in Anne Frank's works since.

Copyright law does not treat all of Europe identically, though. Under transitional provisions in Dutch law, parts of Anne Frank's writings remain protected in the Netherlands until 2037. In Belgium and a number of other member states, the same material has already fallen into the public domain. That split created the conditions for a legal fight that would eventually reach Luxembourg.

In September 2021, a separate group, the Anne Frank Stichting, or Anne Frank Foundation, together with the Koninklijke Nederlandse Akademie van Wetenschappen (the Royal Netherlands Academy of Arts and Sciences) and the Vereniging voor Onderzoek en Ontsluiting van Historische Teksten (the Association for Research in and Access to Historical Texts), published a scholarly online edition of Anne Frank's manuscripts. The website, registered in Belgium, made the material available in Dutch, free of charge. Because the underlying works were still protected by copyright in the Netherlands, the site's operators built in a geo-blocking system meant to stop Dutch visitors from reaching it.

That measure did not satisfy the Anne Frank Fund. In November 2021, it sent a formal notice demanding the site stop displaying the manuscripts, citing its exclusive right under Dutch copyright law to control the public release of Anne Frank's works within the Netherlands. When that notice went nowhere, the Fund pursued interim relief through the Dutch courts, seeking an order requiring the Foundation, the Academy and the Association to halt the publication immediately. Both the first-instance and appellate courts rejected that request, finding that the three organizations had made reasonable efforts to prevent Dutch access.

The Fund did not let the matter rest there. It escalated to the Hoge Raad der Nederlanden, the Supreme Court of the Netherlands, arguing that the lower courts had wrongly concluded there was no "communication to the public" of the manuscripts within Dutch territory. Rather than decide the underlying copyright question itself, the Dutch Supreme Court referred three questions to the Court of Justice for a preliminary ruling, a mechanism EU law provides so that national courts can obtain a binding interpretation of EU legislation before resolving a domestic dispute.

How the geo-blocking system actually functioned

The technical setup at the center of the case is the kind of infrastructure advertising technology providers already build and maintain for other purposes, including audience targeting, regulatory compliance and content licensing enforcement.

When a visitor attempted to reach the manuscript website from within the Netherlands, the site displayed a blunt refusal. The message read, in part: "Unfortunately, this site is not available in your country," attributing the restriction to copyright considerations that prevented availability "in all countries." No workaround was offered on that screen. Anyone connecting from a Dutch IP address simply hit a wall.

Visitors connecting from a public-domain jurisdiction saw something different: an interactive prompt. The site displayed a message noting that the manuscripts could only be accessed "from the following public domain countries," followed by a list. Below that text sat two colored boxes. A green box read: "YES I am accessing the website from one of the public domain countries listed above." A red box read: "NO I am accessing the website from another country." The message warned that a false declaration would amount to circumventing protection measures and could expose the visitor to copyright liability.

This second layer, the self-declaration prompt, turned out to matter a great deal to the court's reasoning, and not in the way the site's operators might have hoped.

The three questions referred to Luxembourg

The Dutch Supreme Court's first and second questions, which the Court of Justice chose to examine together, asked in essence whether a work published on a geo-blocked website can count as a "communication to the public," within the meaning of Article 3(1) of Directive 2001/29 (also known as the InfoSoc Directive), inside a member state where the geo-blocking is supposed to prevent access. Directive 2001/29 gives authors the exclusive right to authorize or prohibit any communication to the public of their works, including making those works available so that members of the public can access them from a place and at a time they choose.

The referring court flagged a genuine dilemma. If the mere theoretical possibility of a Dutch resident using a VPN were enough to establish an unauthorized communication to the public, it would become nearly impossible to publish any work online anywhere in the EU as long as that work remained protected somewhere in the bloc and the rightsholder objected. Yet the opposite reading, ignoring circumvention entirely, risked stripping rightsholders of any meaningful ability to enforce their rights in the one country where those rights still applied.

The third question addressed a narrower but consequential point: if circumvention via VPN did count as an unauthorized communication to the public, who bore responsibility for it? The person who put the work online, or the company providing the VPN service that made the workaround possible?

What the Second Chamber decided

The Second Chamber of the Court, composed of President K. Jürimäe, Court President K. Lenaerts acting as a judge for this case, and Judges O. Spineanu-Matei, M. Gavalec and Z. Csehi, delivered its judgment on 9 July 2026 following a hearing held on 6 October 2025 and an Advocate General's Opinion delivered on 15 January 2026 by Advocate General A. Rantos.

On the first and second questions, the Court held that a work in the public domain in some member states but still protected in another does not become the subject of an unauthorized communication to the public in that other state, provided the geo-blocking measure protecting it qualifies as "effective" under Article 6(3) of Directive 2001/29. Crucially, the judgment specifies that a measure can be effective, and therefore lawful, even if internet users are able to defeat it using a VPN or a similar service.

The reasoning draws heavily on the Court's earlier ruling in VG Bild-Kunst (Case C-392/19), which the judgment cites repeatedly. Where a copyright holder deploys effective technological measures to restrict access to a work, the Court reasoned, that person is expressing an intention to confine the audience for that work to a specific circle of internet users, not to the public at large. The existence of such measures reflects the rightsholder's deliberate choice about who should be able to reach the content, and courts should respect that choice rather than treat any circumvention risk as fatal to the measure's legal status.

Article 6(3) of the Directive defines "technological measures" broadly, covering any technology, device or component designed to prevent or restrict unauthorized acts in respect of protected works, including encryption, scrambling or other transformation processes, or a copy control mechanism. The Court confirmed that geo-blocking, which operates by checking a visitor's IP address and permitting or denying access based on inferred geographic location, falls squarely within that definition as a technological measure. The harder question was whether it counted as an effective one.

The judgment sets out the test for effectiveness in some detail. Effectiveness does not have to be absolute. It must be assessed according to the principle of proportionality, weighing whether the measure suits its stated objective without going further than necessary, while striking what the Court repeatedly calls a fair balance between protecting intellectual property rights, safeguarded under Article 17(2) of the Charter of Fundamental Rights of the European Union, and protecting freedom of expression and information under Article 11 of the Charter. The Court also instructed that effectiveness must be judged in light of technological development and the practical possibility of circumvention, as well as the inherently territorial nature of copyright itself.

Applying that framework, the Court concluded that a geo-blocking measure "would seem to be effective as long as it is state of the art," language that recurs throughout the judgment as the operative legal standard. Such a measure serves the interests of both sides in the dispute, the judgment reasons: it does not impair free access to a work in jurisdictions where that work has entered the public domain, while still protecting the rightsholder's interests in the jurisdiction where protection persists.

On the possibility of circumvention specifically, the Court was direct. Geo-blocking measures, even state-of-the-art ones, can be defeated through VPNs or comparable services, the judgment acknowledges, but that possibility cannot by itself and in every circumstance be treated as decisive proof that a measure is inadequate. Treating any circumventable measure as automatically ineffective would, the Court found, distort the fair balance it had just described, and would grant copyright an excessive territorial reach in situations where the rightsholder does not actually possess authorization rights in the public-domain jurisdictions concerned.

The Court also addressed an argument that other, stricter access controls, such as subscription systems or username-and-password logins resembling library terminal access, might better serve a rightsholder's interests. That argument does not render geo-blocking ineffective by comparison, the judgment holds, because imposing those stricter measures would disproportionately undermine free, no-cost access for the public in jurisdictions where the work is legitimately in the public domain.

The self-declaration prompt did not pass muster

Here the ruling draws a sharper line than a casual reading might suggest. The Association's website did not rely on geo-blocking alone. It layered a second measure on top: the honor-system declaration asking visitors from public-domain countries to click "yes" or "no" confirming their location.

The Court rejected that supplementary measure as ineffective in its own right. Because the declaration depended entirely on the honesty of the person answering it, with no independent verification mechanism, it could not be described as an "effective" technological measure within the meaning of Article 6(3). The distinction matters for anyone building compliance infrastructure: legal adequacy rests on independent technical verification, such as IP-based geo-blocking, not on user-submitted attestations with no enforcement mechanism behind them.

That finding did not undermine the overall outcome, since the geo-blocking measure itself was assessed separately and could still satisfy the effectiveness standard on its own if it met the "state of the art" threshold.

Responsibility falls on the publisher, not the VPN provider

On the third question, the Court ruled that if a geo-blocking measure does turn out to be ineffective, and the resulting publication therefore qualifies as an unauthorized communication to the public, responsibility for that communication attaches to the person or organization that published the work online. It does not attach to the provider of the VPN or similar service that enabled a user to defeat an ineffective block.

The Court grounded this conclusion in earlier case law, including YouTube and Cyando (Joined Cases C-682/18 and C-683/18) and Ocilion IPTV Technologies (Case C-426/21). A VPN provider does not itself grant end users access to a protected work, the judgment reasons, and even where the provider is aware that its service might be used to reach protected content without the rightsholder's consent, the provider does not intervene in a way that plays an "indispensable role" in that access. Making a general-purpose service available that could, among countless other uses, enable circumvention does not, by itself, constitute an act of communication under Article 3(1).

Why this ruling matters beyond a single archive

For anyone working in advertising technology, the immediate subject matter, a diary and a scholarly manuscript archive, sits far outside the usual beat. The legal architecture underneath it does not. Geo-blocking, IP-based location inference and VPN circumvention are technologies that advertising, publishing and platform compliance teams already build, maintain and budget for, often at considerable expense, and this judgment supplies the first authoritative EU-level statement on when those systems satisfy a specific legal test.

The Google RTB privacy settlement approved by a US federal judge in March 2026 turned in part on stripping IP addresses and location signals from bid requests, a reminder that the same location-inference technology sits at the center of both privacy litigation and, now, copyright litigation. Google's own June 2026 disclosure that it would begin using IP addresses for ad measurement and personalization across the EEA, UK and Switzerland from August 3 shows the same signal doing double duty: an advertising input and, per this ruling, a potential copyright compliance mechanism.

The Court's insistence on a "state of the art" standard, rather than an absolute one, also lands on a debate already running in ad tech circles. Research finding IP-address targeting only 13 percent accurate for household-level advertising shows how imprecise the same geolocation signal can be as a targeting tool, even as this ruling confirms that signal can satisfy a legal effectiveness threshold for access control. Targeting precision and access control ask different questions of the same data, and the Court's answer here is that a measure need not be flawless to be lawful, only current with prevailing technical practice.

The ruling also touches an active conversation about VPN usage more broadly. A July 2026 interview with Ad-Shield co-CEO Dustin Cha estimated that VPN services and mobile applications account for a substantial share of what the company calls dark traffic, meaning ad-blocked visits invisible to publisher measurement systems. Proton VPN separately documented a surge of more than 1,400 percent in UK signups after the Online Safety Act's age-verification requirements activated in July 2025, evidence that a meaningful share of any audience will reach for circumvention tools once a geographic or eligibility restriction goes live. The EU's own move toward continent-wide age verification faces a structurally similar question: does a theoretical VPN workaround defeat an underlying compliance measure? This judgment answers that question, for copyright at least, in the negative.

The ruling also sits inside a broader pattern. The same court, a week earlier, dismissed Google's appeal in full and confirmed a 4.125 billion euro fine over Android practices, while in May 2026 the Court's Grand Chamber upheld Italy's publisher compensation framework against a Meta challenge. Read together, these rulings describe a court increasingly willing to draw detailed, technically grounded lines around how digital platforms structure access control and compensation, rather than leaving such questions to commercial negotiation alone.

What remains open

The judgment leaves one significant question in the hands of the Dutch Supreme Court: whether the specific geo-blocking measure the Association deployed actually meets the "state of the art" threshold the Court of Justice has now defined. Luxembourg supplied the legal test; applying it to the facts of this particular website falls to the referring court, a standard division of labor for preliminary rulings under Article 267 of the Treaty on the Functioning of the European Union.

That means the Anne Frank Fund's broader case is not fully over. The Dutch Supreme Court must now determine, considering the geo-blocking system independently of the rejected self-declaration prompt, whether it was current enough with available technology to qualify as effective. If the measure falls short, the Fund's infringement claim could yet succeed. If it clears that bar, the earlier dismissals of the Fund's claims for interim relief stand vindicated under the newly clarified standard.

Timeline

  • 1942 to 1944: Anne Frank keeps her diary while in hiding in Amsterdam during the Nazi occupation of the Netherlands.
  • 1947: Otto Frank, the sole family survivor, publishes his daughter's writings for the first time.
  • 1957: The Anne Frank Stichting (Anne Frank Foundation) is established, with a mandate that includes maintaining the Anne Frank House in Amsterdam.
  • 1963: Otto Frank establishes the Anne Frank Fonds (Anne Frank Fund).
  • 23 December 2015: A final judgment of the rechtbank Amsterdam (District Court, Amsterdam) confirms that parts of Anne Frank's works remain protected in the Netherlands until 2037.
  • End of September 2021: The Anne Frank Stichting, the Koninklijke Nederlandse Akademie van Wetenschappen and the Vereniging voor Onderzoek en Ontsluiting van Historische Teksten publish a scholarly edition of Anne Frank's manuscripts, free of charge, on a Belgium-registered website protected by geo-blocking.
  • November 2021: The Anne Frank Fund sends a formal notice demanding the website stop displaying the manuscripts.
  • 2021: Having received no satisfactory response, the Anne Frank Fund brings an action and an application for interim relief before the Netherlands courts; the claims are dismissed at first instance and on appeal.
  • 8 November 2024: The Hoge Raad der Nederlanden (Supreme Court of the Netherlands) decides to refer three questions to the Court of Justice for a preliminary ruling.
  • 14 November 2024: The reference is received at the Court of Justice, registered as Case C-788/24.
  • 6 October 2025: A hearing is held before the Court of Justice.
  • 15 January 2026: Advocate General A. Rantos delivers his Opinion.
  • 9 July 2026: The Court of Justice, Second Chamber, delivers its judgment in Case C-788/24.

Summary

Who: The Court of Justice of the European Union, Second Chamber, ruled on a dispute between the Anne Frank Fonds (Anne Frank Fund) as applicant and the Anne Frank Stichting (Anne Frank Foundation), the Koninklijke Nederlandse Akademie van Wetenschappen and the Vereniging voor Onderzoek en Ontsluiting van Historische Teksten as respondents, following a referral from the Hoge Raad der Nederlanden (Supreme Court of the Netherlands).

What: The Court ruled that a work in the public domain in some EU member states but still under copyright in another can be published free of charge on a website protected by a state-of-the-art geo-blocking measure, without that publication counting as an unauthorized "communication to the public" in the member state where the work remains protected, even if determined users can defeat the geo-block using a VPN or similar service. The Court also ruled that if a geo-blocking measure is found to be ineffective, responsibility for any resulting unauthorized communication falls on the party that published the work, not on the VPN provider.

When: The judgment was delivered on 9 July 2026, following a reference lodged on 14 November 2024, a hearing on 6 October 2025 and an Advocate General's Opinion delivered on 15 January 2026.

Where: The case originated in the Netherlands, concerning a website registered in Belgium, and was resolved by the Court of Justice of the European Union sitting in Luxembourg. The ruling is binding across all EU member states.

Why: The case tests how far copyright holders can control a work's availability once that work enters the public domain in some jurisdictions but not others, and clarifies that geo-blocking systems do not need to be unbreakable to satisfy the EU's "effective technological measures" standard under Directive 2001/29. The ruling carries direct relevance for advertising, publishing and platform compliance teams that build and maintain geo-blocking and IP-based location-inference systems for reasons ranging from copyright licensing to advertising compliance to age verification, since it supplies the first EU-level judicial test for when such systems count as legally adequate despite the well-documented ease of VPN circumvention.