A court in Cordoba, Spain has delivered what experts are calling the first significant judicial victory for a VPN provider in the European Union: it dismissed fines that Spanish football league LaLiga sought against NordVPN over allegations of facilitating access to pirated streams. The ruling, issued in May 2026, found that the proposed enforcement method - blanket IP address blocking - would have collateral consequences so broad that the measure could not be considered proportionate under EU law.
What LaLiga Demanded and Why the Court Said No
LaLiga, Spain's top professional football league, has been waging a sustained legal campaign against services it accuses of enabling subscribers to bypass geographical restrictions and access unlicensed broadcasts of its matches. As part of that campaign, it sought financial penalties against NordVPN on the grounds that the VPN service allowed users to reach pirated streams.
The Cordoba court rejected the fine request, centering its reasoning on the proportionality principle. Judges found that the IP-based blocking LaLiga envisioned would inevitably sweep in thousands of legitimate websites, businesses, and individual users who have nothing to do with sports piracy. Because a single IP address can host hundreds or even thousands of separate services, courts across the EU have increasingly been reluctant to authorize IP-level blocks without evidence that the damage to innocent parties can be contained.
The ruling does not end the underlying litigation - LaLiga's main case against NordVPN continues in Spanish courts - but the dismissal of the fines request is a meaningful procedural setback for the league and a signal that at least one European court is unwilling to treat VPN providers as simple accessories to copyright infringement.
Why This Ruling Matters Across the EU
The decision arrives at a particularly sensitive moment for digital rights policy in Europe. Over the past several years, major rights-holders - sports leagues, film studios, record labels - have pushed regulators and courts in multiple EU member states to adopt increasingly aggressive blocking regimes. Spain has been a particularly active battleground, with LaLiga securing broad court orders that have, at times, resulted in the temporary disruption of unrelated services.
Digital rights organizations have long argued that IP blocking is a blunt instrument incompatible with the proportionality requirements embedded in the EU's Charter of Fundamental Rights and the e-Commerce Directive. The Cordoba court's logic - that forcing a VPN provider to block IPs would unavoidably harm innocent third parties - directly echoes those arguments.
Legal observers note that while the ruling comes from a lower Spanish court and carries no binding precedent across the EU, it contributes to a body of case law that higher courts and the Court of Justice of the European Union may eventually have to address. If upheld on appeal, it could make it significantly harder for rights-holders to use fine threats as leverage against infrastructure providers like VPN services.
The Bigger Picture: VPNs, Piracy, and Legal Liability
The core legal question the Cordoba case highlights is whether a VPN provider bears any responsibility for what individual users do with the privacy tool it sells. NordVPN and most other major providers argue - and courts in many jurisdictions have agreed - that they operate general-purpose privacy infrastructure, not piracy-enablement services. The fact that some users may choose to route traffic through a VPN to reach blocked content does not, under this theory, make the provider liable for that content.
LaLiga and organizations like it take the opposite view: that any service which knowingly or foreseeably assists users in circumventing court-ordered blocks is contributing to copyright infringement and should face consequences. The outcome of the main Spanish case will likely depend on which of these frameworks the court ultimately accepts.
What Happens Next
The main lawsuit proceeds, and legal analysts expect LaLiga to appeal the fine rejection. The league has historically been aggressive in defending its broadcast rights through litigation and has secured cooperation from Spanish internet service providers in the past. A final ruling on the merits could take years.
In the meantime, the Cordoba decision gives other VPN providers facing similar pressure in Europe a legal argument to cite: that mandatory IP blocking is disproportionate and that courts should scrutinize blocking demands carefully before endorsing them.
For ordinary internet users in Spain and across the EU, the ruling is a reminder that the legal landscape around VPN use and online privacy remains contested and is still being actively shaped by litigation. Courts - not just legislators - will play a major role in determining how much freedom individuals retain to manage their own digital access.
Privacy tools that help users control their own internet access sit at the intersection of copyright enforcement, fundamental rights, and infrastructure liability. How that intersection gets mapped in European courts over the next few years will affect not just VPN services, but the broader architecture of online freedom across the continent.
