“Anne Frank Fonds” (CJEU Case C-788/24): geo-blocking, VPNs and communication to the public

The Diary of Anne Frank is perhaps the most famous journal in the world, read by millions and translated into dozens of languages. It has now become the subject of a landmark CJEU decision. According to the Court, publishing a work online while using geo-blocking measures to restrict access in a Member State where the work remains protected does not amount to a communication to the public, provided that those measures are effective within the meaning of Article 6(3) of the InfoSoc Directive.

This preliminary ruling arose from the proceedings in the Netherlands between the copyright owner of The Diary of Anne Frank (the “Diary”) and Belgian non-profit organisations that published a new scientific version of the work online. The Diary remains protected by copyright in the Netherlands until 2037, whereas in most other Member States it is in the public domain.

The most important aspect of the case is that the Belgian organisations used geo-blocking measures to ensure that the Diary would not be accessible from the Netherlands, thereby preventing copyright infringement. Nonetheless, the rights holders brought proceedings against the non-profit organisations because the work was in fact accessed in the Netherlands through Virtual Private Network services (“VPNs”). To analyse whether the publication, viewed in its full context, constituted an unauthorised act of communication to the public, it is necessary to consider:

• the specific elements of the Court’s reasoning; and
• the practical implications of the judgment given its broader significance.

1. The limits of the “communication to the public” concept in the context of effective technological measures

Given the unusual facts of the case, the CJEU was required to further develop its extensive case law on “communication to the public” under Article 3(1) of the InfoSoc Directive. The Court first considered whether geo-blocking measures that were circumvented through VPNs affected the classification of the online publication as a communication to the public in the Netherlands, being the Member State in which the Diary remains protected. Secondly, on the assumption that such publication constituted a communication to the public, the Court examined whether responsibility for the act and any resulting infringement should rest with the user or the VPN provider.

1.1 The nuances and impact of restricting technological measures

While geo-blocking measures are permitted under the InfoSoc Directive, the system in practice prevented access where users connected using an IP address originating from the Netherlands. In those circumstances, access was denied. If access was attempted from a country in which the Diary was in the public domain, users were additionally required to confirm that they were accessing the work from such a country. The measure could nonetheless be circumvented through the use of VPNs and, on that basis, the rights holders argued that the publication constituted a communication to the public in the Netherlands despite the publishers’ efforts to restrict access.

To answer this question, the Court reiterated its established approach to the concept of “communication to the public.” The Court confirmed that two cumulative conditions must be satisfied. First, there must be an “act of communication”, broadly understood as any transmission or making available of a work through a deliberate intervention by the person sharing it. Secondly, the communication must be directed at a “public”, meaning a fairly large number of unidentified individuals. In addition, the work must either be communicated through technical means different from those previously used or be communicated to a new public not taken into account by the rights holder when authorising the original communication. In principle, the Court considered that those conditions were fulfilled in the present case.

The Court also recalled that, under Articles 6(1) and 6(3) of the InfoSoc Directive, the rights holders may protect access to their works through technological measures designed to prevent unauthorised access to their work. Such measures must satisfy the effectiveness requirements set out in Article 6(3) of the Directive. Where effective technological measures are in place, it may be inferred that the rights holders intended to limit access to their work on the Internet to a specific group of users.

The Court confirmed that geo-blocking measures fall within the definition of “technological measures” under Article 6(3) of the InfoSoc Directive. As regards effectiveness, the Court left the final assessment to the national court while providing important guidance. Effectiveness does not require a measure to be impossible to circumvent. Rather, it must be capable of achieving its intended purpose and be proportionate to that objective. Importantly, the measure must strike a fair balance between copyright protection and fundamental rights, including freedom of expression. National courts may therefore take into account whether less intrusive measures could have achieved a comparable result and whether the technology deployed reflected the state of the art.

According to the Court, a technological measure should not be regarded as ineffective merely because it can be circumvented through tools such as VPN services. By contrast, a user’s self-declaration is not, in itself, sufficient to constitute an effective technological measure because it depends entirely on the user’s honesty. This aspect of the judgment may have implications beyond copyright law, including in areas such as age-verification mechanisms.

1.2 The responsible party for unauthorised access through VPNs

To address the final question, the Court proceeded on the assumption that the publication constituted a communication to the public in the Netherlands. This assumption was necessary because the national court must still determine whether geo-blocking measures used in the case were effective and the Dutch Supreme Court could ultimately reach a different conclusion. Guidance on responsibility was therefore still required.

In summary, if a publisher fails to implement effective technological measures, they bear the responsibility for the communication to the public. The Court emphasised that VPNs are lawful tools and that their providers cannot be held liable solely because their services may be used for unlawful purposes. This approach is consistent with the Digital Services Act, which generally limits the liability of intermediary service providers for information transmitted through their services where they neither initiate nor control the transmission. The Court expressly stated that a VPN provider must not play an indispensable role in the user’s access to the work, even if VPN providers may be generally aware that their services can be used to facilitate unauthorised access.

2. The practical impact of the CJEU’s judgment

The practical consequences of the judgment are significant not only for copyright law, but also potentially for other areas in which access to online content or services is restricted through technical measures. In particular, the Court’s reasoning may prove relevant wherever such restrictions are intended to achieve a regulatory objective or protect legal rights.

One immediate consequence is that self-declaration mechanisms should be treated with caution. The Court’s conclusion that a mere statement made by the user is insufficient to ensure effective protection may be relevant not only in the copyright context but also for other online compliance mechanisms, including age verification. While such declarations may continue to play a supporting role, they are unlikely to be considered sufficient unless accompanied by objective technical safeguards capable of achieving the relevant regulatory objective.

For publishers and other online content providers, the judgment confirms the importance of implementing technical measures that are both appropriate and up to date. Geo-blocking does not need to be impossible to circumvent in order to be effective. However, publishers should be able to explain how a particular measure was selected, implemented and monitored. Proper documentation, periodic testing and internal reporting of circumvention attempts may therefore become important evidence that an access restriction was genuinely intended to function effectively and remained proportionate to the rights being protected.

The legal position of VPN providers appears more nuanced. The Court did not regard the mere provision of VPN services as sufficient to establish liability, even where those services may be used to circumvent geo-blocking. Nevertheless, VPN providers should exercise caution in the way they describe and market their services. Promotional activities that encourage users to bypass territorial copyright restrictions may increase litigation and regulatory risk, though the Court did not expressly endorse the distinction proposed by the Advocate General.

The judgment may also prompt closer scrutiny of territorial provisions in licensing agreements. Where parties rely on geo-blocking to preserve territorial exclusivity or prevent access from jurisdictions in which rights remain protected, agreements should more clearly define the required level of protection, the criteria for assessing effectiveness and the allocation of risk if users succeed in circumventing the restrictions. Similar clarity may also be beneficial in agreements with hosting providers and other technical service providers involved in implementing access-control measures.

For compliance planning, the decision supports the use of multiple overlapping access controls. Depending on the relevant risk assessment and proportionality analysis, geo-blocking may be combined with payment-location checks, account-location data, device signals or other objective indicators. At the same time, businesses should not assess technical restrictions in isolation. In a dispute, courts may also consider whether a publisher’s overall conduct suggests that it is targeting a protected territory, including the language used, currency, marketing materials, customer support arrangements and available payment options.

Finally, the judgment may become relevant in transactions involving digital content businesses. As part of legal due diligence, buyers may increasingly examine whether a target has adequate territorial restriction mechanisms in place, whether their effectiveness has been properly documented and whether the relevant contracts with technology providers adequately support those measures. This may be particularly important where the target’s business model depends on territorially fragmented rights or on the online availability of works that are protected in some Member States but not in others.

Overall, the judgment confirms that geo-blocking can be an effective tool for limiting online access to protected works, provided that it is technically meaningful, proportionate and not merely formal. More broadly, it signals that businesses relying on territorial or regulatory access restrictions should be prepared to demonstrate that their safeguards are genuinely capable of achieving their intended purpose.