DisCo warns that extending blocking orders to VPN providers could force privacy tools to become internet watchdogs, shifting them from passive conduits to active filters.

Blocking could require VPNs to check traffic against blocklists—such as destination IPs or DNS requests—without breaking VPN encryption, potentially compromising user privacy.

DisCo notes that, although authorities sometimes promote VPN use for privacy, blocking orders could blunt these protections and necessitate monitoring or retention of traffic.

Overblocking risks are illustrated by Spain’s LaLiga campaign, which allegedly took hundreds of thousands of legitimate domains offline through IP blocking.

Several European countries have tested or implemented VPN blocking: France in 2025 ordered major VPNs to block hundreds of illegal sports sites; Italy extended its Piracy Shield to VPNs/DNS providers; Spain’s Córdoba court ordered NordVPN and Proton VPN to block IPs tied to illegal LaLiga streams, later not fining NordVPN for non-compliance, with LaLiga seeking broader VPN inclusion.

There are precedents where VPNs have been ordered to block illegal content, including actions in France and Italy, with Microsoft-wide court cases involving NordVPN and Proton VPN in Spain.

The European Commission is considering an EU-wide system of anti-piracy injunctions that would force providers to block access to websites and servers hosting infringing content, potentially compelling VPNs to filter traffic and threatening user privacy.

This EU-wide injunction concept is expected to be part of a Copyright Package due in 2027, with potential implications for VPNs across member states.

The EU top court previously ruled that VPNs are lawful technical tools and providers aren’t liable when users bypass geoblocking; however, this ruling does not preclude an injunction system that could affect VPNs.

Blocking measures are blunt tools that can overblock legitimate sites and fail to reduce piracy, especially when VPNs are involved since infringing content can resurface via alternate routes or domains.

EU policymakers should protect strong privacy protections and encryption, avoid forcing VPNs to monitor or filter traffic, and keep a stable regulatory environment for trusted VPN providers while focusing enforcement on hosting services.