Is it permissible to post a work online that is still protected in one EU country but not in another?

Anyone who publishes a work that is in the public domain in their own country but is still protected by copyright in another country can avoid infringement in that other country by implementing effective geoblocking. The fact that the block can be circumvented using a VPN does not, in principle, alter this. This was the ruling of the Court of Justice on July 9, 2026, in the case of Anne Frank Fonds v. Anne Frank Stichting et al. (C-788/24), regarding the online edition of the manuscripts of Anne Frank’s diary, which is still protected by copyright in the Netherlands until 2037 but has not been protected in Belgium since 2016.

The facts

The Anne Frank Fund holds the copyrights to Anne Frank’s writings. For some of these works, copyright protection in the Netherlands remains in effect until 2037, pursuant to a transitional provision in the Dutch Copyright Act. In a number of other member states, including Belgium, these same works have been in the public domain since 2016.

In late September 2021, a Belgium-based association, in collaboration with the Anne Frank Foundation and the Royal Netherlands Academy of Arts and Sciences, published a scholarly online edition of the manuscripts on a website. Access is free. To avoid infringing on Dutch copyrights that are still in effect, they implemented two measures: a geoblocking system that blocks access from member states where the work is still protected, and a warning system requiring visitors from a public domain country to declare that they are accessing the site from such a country.

The Fund argued that a public communication to the Dutch public had nevertheless taken place, because the geoblocking could be circumvented using a VPN. After losing its case in summary proceedings at first instance and on appeal, it filed an appeal to the Supreme Court. The Supreme Court of the Netherlands referred three questions for a preliminary ruling to the Court of Justice.

The decision

The Court reformulates the first two questions together: Does the publication of a work on a website protected by geoblocking constitute a communication to the public within the meaning of Article 3(1), InfoSoc Directive in the member state where the work is still protected, if the block can be bypassed using a VPN?

The Court first recalls the established doctrine. The concept of “communication to the public” involves two cumulative elements: an act of communication and a public. It requires an individual assessment and a broad interpretation, with the aim of ensuring a high level of protection for authors, while at the same time striking a fair balance with freedom of expression and freedom of information (Art. 11 Charter) and the public interest.

The key lies in the technique. Based on its ruling VG Bild-Kunst (C-392/19) the Court held that a rights holder who implements effective technical measures thereby indicates that he wishes to restrict access to his work to a specific group of Internet users, and not to all Internet users. The Court extends this reasoning by analogy: anyone who publishes a work that is still protected elsewhere must implement effective technical measures to restrict access to countries where the work is in the public domain, thereby indicating that users in the Member State where the work is protected are not part of the intended audience.

Geoblocking is a technical measure within the meaning of Article 6(3) of the InfoSoc Directive. Whether it is also effective is a matter for the national court to assess, taking into account the principle of proportionality, the state of the art, and the possibilities for circumvention. However, the Court provides clear guidance: a state-of-the-art geoblocking measure is appropriate and ensures a fair balance, and the mere possibility of circumvention via a VPN does not render it ineffective. If the opposite were assumed, free access in public domain countries would be disproportionately impeded, and copyright would be granted a disproportionate territorial scope. The fact that stricter alternatives exist, such as access restricted by login or subscription, does not render geoblocking ineffective, because those alternatives would actually disrupt the balance. The supplementary declaration system is not effective in and of itself, as it depends entirely on the user’s willingness to answer honestly.

The conclusion regarding the first two questions: with effective, state-of-the-art geoblocking, there is no public communication in the protected Member State, even though it can be circumvented using a VPN.

In response to the third question, the Court held that if the measure were ineffective, there would in fact be a communication to the public attributable to the publishing party, and not to the VPN provider. Relying on YouTube and Cyando (C-682/18 and C-683/18) the Court ruled that a VPN provider merely facilitates Internet access, does not play a central role in granting access to the work, and therefore does not itself disclose the information.

Legal analysis and interpretation

The technology determines who the target audience is

The underlying principle of the ruling can be summarized simply: anyone who posts a work online indicates, through their technical choices, who the work is intended for. Anyone who does not restrict access is addressing everyone on the internet. Anyone who restricts access excludes part of the public and retains only those users who can bypass the restriction. The Court had already applied this same reasoning in the VG Bild-Kunst ruling, which concerned protection against framing. Here, it applies it to geographic blocking. What is new is that the Court thereby accepts that copyrights on the internet can be managed on a country-by-country basis. Visitors from countries where the work is still protected simply do not count as the intended audience as long as the blocking excludes them.

It is noteworthy that the Court reached the same conclusion as Advocate General Rantos, but by a different line of reasoning. In his opinion of January 15, 2026, the Advocate General stated that Article 3(1) does not contain a targeting requirement: an online publication does not need to be specifically directed at a particular country to constitute a communication to the public. He resolved the case by addressing whether the technical measures were effective, without introducing such a targeting criterion. The Court takes a subtly different approach. By reasoning that the technology itself defines the audience, it does not need to answer the fundamental question of whether a targeting requirement always applies. The Court thus deliberately leaves that issue unresolved.

No security system is foolproof, and that's okay

The reasoning is based on a sober observation that the Advocate General articulated sharply: no security measure is completely impenetrable. If the mere possibility of circumvention were sufficient to label a measure as ineffective, then any publication on the internet would automatically reach the entire world. Managing copyrights on a country-by-country basis would then become impossible. The Court therefore accepts that a measure can be effective despite a risk of circumvention, as long as other factors mitigate that risk. The downside, which the Court itself acknowledges, is that the rights holder may not be able to fully enforce their rights in the protected country. That is the price of the balance the Court seeks.

Protection is an ongoing task, not a one-time measure

Both the Advocate General and the Court link effectiveness to the state of the art. The assessment is therefore not set in stone. The Advocate General pointed out the corresponding obligation for the website owner to regularly reassess new risks of circumvention and, if necessary, take additional measures. What is the best technology today may no longer be so next year. Geoblocking is therefore not a switch you flip once, but something you must continuously monitor. Anyone wishing to invoke the exemption also bears the burden of proof.

Specifically, what does this mean?

For heritage institutions, publishers, and researchers. Anyone who wants to make works available online that are still protected in certain Member States can do so legally by using a state-of-the-art geoblocking solution that shields the protected markets. Document the chosen technology and reassess it periodically, as its effectiveness is evaluated against the evolving state of the art. A system based solely on warnings or click-through agreements is insufficient and can, at best, serve as a supplementary deterrent. It may be prudent to inform the rights holder in the protected country in advance about the publication and the measures taken.

For rights holders. The ruling weakens the legal position against foreign publications that implement proper blocking measures. There is little that can be done against the publisher as long as the geoblocking is effective, and the VPN provider is not a target unless it actively encourages circumvention. The leeway lies in challenging the effectiveness of the measure: Is it truly state-of-the-art, does it cover current VPN services, and has it been updated over time? Even intentionally weak or superficial geoblocking remains open to challenge.

For VPN providers. The mere fact that a service can be used to circumvent geoblocking does not give rise to liability for copyright infringement. That changes when the provider actively encourages unlawful use to gain access to protected works; in that case, the “central role” test comes into play.

Frequently asked questions (FAQ)

Can I post a book online that is in the public domain in Belgium if it is still protected by copyright in another EU country?
Yes, provided that you restrict access from countries where the work is still protected using an effective, state-of-the-art geoblocking measure. Without such restrictions, you are making the work available to the public in those countries and risk infringing copyright.

Does it matter that people can bypass geoblocking using a VPN?
In principle, no. According to the Court of Justice, the mere possibility of circumventing a state-of-the-art geoblocking measure via a VPN does not render it ineffective. However, the measure must remain up to date with the state of the art.

Is a VPN provider liable if someone uses its service to view a blocked work?
No, unless the provider actively encourages unlawful use in order to gain access to protected works. A VPN facilitates Internet access and does not itself make the work available to the public.

Conclusion

The Court of Justice has opted for a solution that strikes a balance between technological and territorial considerations: effective, state-of-the-art geoblocking prevents public communication within the Member State where the work is protected, despite the possibility of circumventing it via a VPN, and the VPN provider remains outside the scope of liability. Those who make works available that are freely accessible in one Member State but still protected in another are thus provided with a workable framework, but at the same time bear an ongoing duty of care to keep their blocking measures up to date.