The Spanish football league LaLiga has asked the European Commission to add four of the largest commercial VPN providers to the next edition of its Counterfeit and Piracy Watch List.
The 14-page submission names NordVPN, ProtonVPN, ExpressVPN and Surfshark. The watch list is a periodic Commission document identifying sites and services it regards as threats to intellectual property. The previous edition appeared in 2025; the one LaLiga is addressing is due in 2027.
The list has historically been populated by torrent sites and cyberlockers, and in recent editions by intermediaries such as hosting providers and infrastructure services.
LaLiga's case is not that VPNs are unlawful. "This request is based not on the provision of VPN services as such, but on the commercial exploitation and active promotion of their ability to circumvent court-ordered blocking measures," the submission says.
It locates the conduct specifically in marketing. "The conduct that takes these services beyond neutral technical provision is the deliberate marketing of circumvention, conducted at arm's length through affiliate programmes," it says.
The submission also questions the independence of some published guidance recommending VPNs, noting that the publishers are in some cases not independent and that those publications disclose as much.
A second service is named. AFTVnews Downloader, an app with more than 100 million users, lets people download files by entering a web address or a short numeric code. LaLiga catalogued 341 of those short codes and said 262 of them led to pirate applications.
Elias Saba of AFTVnews disputed the characterisation, saying the short codes simply save users from typing full addresses, that anyone can submit an address, and that the service generates an active short code automatically, without editorial review or approval.
The background is a run of Spanish litigation. In February a court in Cordoba issued an ex parte blocking order against ProtonVPN and NordVPN; in May the same court declined to fine NordVPN for failing to comply. ProtonVPN and the VPN Trust Initiative did not respond to requests for comment.
It is worth being precise about the test LaLiga is proposing. The service is accepted as neutral. What is objected to is the description of it. A VPN that conceals a user's location is unobjectionable. A VPN that mentions that it conceals a user's location has moved beyond neutral technical provision.
The Questionable Times considers this the most promising development in enforcement for years, because it is the first standard a provider can meet without altering anything. The four companies are not being asked to stop working. They are being asked to stop saying so.
The compliance path is correspondingly simple. An accurate advertisement is the conduct at issue, so the remedy is a less accurate one. A provider that described its product only in general terms, or declined to describe it at all, would be restored to neutral technical provision while continuing to route exactly the same traffic through exactly the same servers.
Our analysts note that the watch list would then function as a register of candour. Services would appear on it in proportion to how clearly they had explained themselves, and the most compliant provider in Europe would be the one whose customers could not work out what they had bought.
The Department of Unnecessary Research has asked the Commission for one ruling before the 2027 list is drawn up. If the deliberate marketing of circumvention is the conduct at issue, it would like to know the standing of a VPN that promises nothing whatsoever: whether it is compliant, or merely untested.