While courts across Europe race to force internet providers - and now even VPN services - to block pirate sites, Bulgaria has just gone the other way. The country's Supreme Court of Cassation has ruled that civil site blocking is simply not legally possible under current Bulgarian law, handing local rightsholders a defeat and delivering a rare check on the spread of network-level censorship in the EU.
What the court ruled
The judgment is narrow but decisive: Bulgarian law does not recognise a legal claim "for blocking access to Internet sites." One of the internet providers argued that the EU rules requiring member states to make injunctions available against intermediaries could not be used against it, because Bulgaria has never transposed those provisions into its national law. The Supreme Court agreed. No implementing law, no basis for a blocking order.
The court did leave one door open, noting that rightsholders harmed by Bulgaria's failure to fully implement the EU framework could, in theory, sue the state itself for damages. But that is a claim against the government, not a route to blocking a website - and for now, Bulgaria has no mechanism to make ISPs filter what their customers can reach.
How the case unfolded
The fight goes back to 2020, when the Bulgarian Association of Music Producers and the global recording-industry group IFPI sued three ISPs, demanding they block The Pirate Bay and Zamunda, long the country's most popular torrent site. In 2023 a lower court in Sofia sided with the rightsholders and ordered the providers to block both sites, along with every mirror and proxy, within six months. The ISPs appealed - and years later, the highest court has now thrown the order out entirely.
A patchwork Europe, and why it matters
Bulgaria's ruling is striking mostly because of how sharply it clashes with the direction next door. In the same period, a Paris court ordered five major VPN providers to block pirate streaming domains and refused to refer the case to the EU's top court, extending French blocking obligations from ISPs all the way to privacy tools. France had already forced ProtonVPN to block a list of pirate domains months earlier. One country is conscripting every layer of the network into enforcement; another has just found it has no legal power to block anything at all.
That inconsistency is the real story. The EU likes to present a single digital market, but site-blocking law is a patchwork that depends entirely on whether and how each member state wrote the rules into its own books. It is the same fragmentation the bloc's own top court highlighted when it held that VPN providers are not liable for how users reach geo-blocked content. For an ordinary user, "is this legal here?" genuinely has a different answer depending on which side of a border they sit on.
This is exactly the gap that drives people to privacy tools. When access to the same website depends on your country's implementing law rather than anything you did, a VPN is the simplest way to make that geography stop mattering - moving your connection to wherever the rules happen to be lighter. It does not change the law; it changes which law reaches you.
