A six-month study by the Open Observatory of Network Interference (OONI) has documented the scale of collateral damage caused by Spain’s anti-piracy enforcement campaign, raising questions about proportionality and technical precision in copyright enforcement.

The Spain case crystallizes the balance the NMC has advocated for in response to the European Commission’s piracy review and live-event protections. NMC welcomes efforts to strike a balance in combating online piracy while protecting media freedom, including the EC recommendation’s explicit requirement that ‘the unauthorised retransmission of live events should be distinguished’ from content ‘shared by journalists for the purpose of informing the general public, including in real time.’

Yet Spain’s enforcement approach—blocking news outlets, human rights platforms, and journalist infrastructure alongside piracy targets—demonstrates why enforcement mechanisms must enforce this distinction with technical precision. Without safeguards to protect legitimate newsgathering, anti-piracy measures risk disrupting the open infrastructure on which primary source journalism and newsroom operations depends.

The Enforcement Campaign

Since February 2025, major Spanish internet service providers have been blocking IP addresses associated with unauthorized broadcasting of matches in La Liga—Spain’s professional football league—following court authorization. The enforcement is tied to Commercial Court No. 6 of Barcelona’s December 2024 ruling, which responded to applications from La Liga and Telefonica’s audiovisual division seeking dynamic IP-level blocking during live match broadcasts.

By March 2025, La Liga reported blocking around 3,000 IP addresses every weekend. In February 2026, Spanish courts further extended the enforcement by ordering VPN providers NordVPN and Proton VPN to block access from Spain to websites accused of illegally streaming matches.

The motivation is clear. La Liga has estimated annual losses of €600–700 million to unauthorized streaming. The Sports Rights Owners Coalition (SROC)—an alliance representing over 50 international sports bodies—has characterized digital piracy as the “biggest problem that sport rights owners have across the board” and an “existential threat to sport itself.”

The Unintended Scale

The Open Observatory of Network Interference (OONI), a nonprofit organization specializing in internet censorship measurement, released findings in June 2026 based on network data collected between January and June 2026. The results reveal far-reaching collateral effects.

Across the observation period, OONI documented the blocking of 554,507 unique domain names—approximately 5.8% of 9.2 million tested domains—at least once during match broadcasts. The enforcement affected 7,441 unique IP addresses across 36 infrastructure providers, including Cloudflare, Amazon, Alibaba Cloud, Akamai, Meta, and Microsoft.

The concentration on Cloudflare is particularly stark: more than 501,000 affected domains sat behind just 2,218 blocked IP addresses on that network. OONI’s analysis shows that blocking as few as four to 20 IP addresses during a typical one-hour match window was sufficient to make over 400,000 unrelated domains inaccessible. A single blocked Squarespace IP address accounted for 18,592 affected sites.

Who Got Blocked

The affected website roster spans legitimate institutions and services with no connection to sports piracy. OONI’s dataset includes:

• Human rights organizations: Amnesty International chapters across multiple countries, Venezuela Sin Filtro (Venezuelan digital rights group), and five US American Civil Liberties Union (ACLU) state offices
• Climate and environmental groups: Greenpeace Argentina, Cool Earth, The Climate Reality Project, and the climate science nonprofit Berkeley Earth
• Humanitarian organizations: Caritas (the Catholic Church’s social and charitable arm), Mercy Corps, and UNICEF national sites in multiple countries
• Governmental institutions: The Australian Senate, Bergamo Court in Italy, US municipal government websites, and the UK National Cyber Security Centre’s public awareness portal
• News outlets: La Patilla (Venezuelan news), the Ukrainian Crisis Media Center, pro-democracy Russia-focused outlets, and regional editions of major news brands
• Developer and cloud infrastructure: Docker Hub, GitHub Pages, Amazon S3 regional endpoints, HashiCorp’s Terraform registry, and Linux Mint
• Academic and cultural sites: Stanford Law Review, Yale Alumni Magazine, universities, and research institutes

The blocking events aligned precisely with match schedules, with enforcement beginning shortly before kick-off and lifting shortly after final whistle—suggesting the measures were intentionally timed to broadcast windows rather than continuous.

Responses from Affected Parties

Technology and infrastructure companies have taken a more resistant stance. Cloudflare sought to appeal La Liga’s measures, arguing they were disproportionate and caused massive collateral damage by blocking millions of legitimate users, though that appeal was rejected in March. Cloudflare CEO Matthew Prince warned that “It’s only a matter of time before a Spanish citizen can’t access a life-saving emergency resource because the rights holder in a football match refuses to send a limited request to block one resource versus a broad request to block a whole swath of the internet.” Vercel documented its services going down and submitted detailed technical arguments to Spanish authorities about the imprecision of IP-level enforcement.

Both NordVPN and Proton VPN reported they were not notified of the February 2026 VPN court orders before they were announced publicly. NordVPN stated that “blocking does not eliminate the content itself or reduce the incentives for piracy”. Proton’s head of privacy stated the blocking orders were “simply unworkable” given how content delivery networks operate, and warned that compliance would require blocking legitimate sites alongside pirate streams. The company said it would contest any order to “vandalize the internet.”

Spanish developers reported acute practical impacts. Docker pull failures on 12 April 2026, left developers debugging configuration issues, only to discover the culprit was football—with Docker Hub becoming inaccessible across Spain during matches, breaking CI/CD pipelines. VPN demand surged, with Proton VPN reporting demand as high as 200% above baseline in Spain during enforcement windows.

European internet service providers, represented by EuroISPA—an association covering over 3,300 ISPs—have escalated their objections beyond Spain. EuroISPA submitted formal criticism to the European Commission, demanding that copyright holders who cause excessive network outages be held accountable and pay for the resulting damages, with compensation mechanisms that are clearly defined and enforceable to ensure “the burden of enforcement errors does not fall on innocent intermediaries and their users.”

The Sports Rights Perspective

La Liga and the broader sports rights community maintain that enforcement is proportionate and necessary. Mark Lichtenhein, SROC Chairman, stated that the absence of legally binding remedies is “highly damaging to the business of sport” and allows “an unhindered black market for organised crime to flourish”. SROC has not issued a public statement specifically addressing the OONI collateral damage findings, though the coalition continues to advocate for stronger enforcement mechanisms at the EU level.

La Liga has reported gains from its multi-pronged approach. Google and La Liga reported significant progress in anti-piracy efforts, with closer collaboration improving communication and accelerating the handling of infringement notifications, resulting in a substantial reduction in incidents linked to Google services. The league also launched an informant scheme in 2025 offering €50 bounties for reports of illegal streaming in venues, achieving over 1,600 convictions against restaurants, hotels, and catering establishments by September 2025.

Sports rights holders emphasize that piracy represents direct revenue loss from the clubs and competitions themselves. When piracy erodes the value of broadcasting rights, the central income pools distributed to clubs shrink, affecting investment in player development, academy systems, and community engagement.

Parliamentary and Governmental Responses

The scale of disruption has triggered formal action within Spain’s legislature. On April 29, 2026, Spain’s Commission on Economy, Trade and Digital Transformation voted in favour of a non-legislative initiative to adopt measures restricting indiscriminate IP blocking. The initiative, led by ERC (Republican Left of Catalonia) and supported by the socialist PSOE party, anticipated reforms within the Digital Services Act to prevent judicial rulings from collapsing third-party pages.

ERC’s economic spokesperson Inés Granollers cited specific cases during parliamentary debate, including the Transporta’m civic transport platform, which goes offline every time a match is broadcast—“thousands of citizens are left without this service”—and a geolocation app used to monitor a family member with dementia that loses connectivity when it shares infrastructure with a blocked IP.

Granollers emphasized: “Private interests are conditioning the functioning of the Internet with direct consequences on citizens.” The party-aligned position noted support for fighting piracy “but not at any price,” and called for “clear rules” to shield third parties from judicial decisions intended to address copyright infringement.

The Spanish government has acknowledged the collateral damage but maintains the matter falls under judicial authority. No formal redress mechanism exists for sites wrongly caught in blocks, nor any independent technical validation before new IP addresses are added to enforcement lists. When pressed on the issue, government officials have indicated that since the original blocking order was issued by a court, the matter remains within judicial jurisdiction rather than executive or legislative reach.

Broader Governance Questions

The OONI report identifies additional concerns beyond collateral domain blocking. OONI researchers detected TLS Man-in-the-Middle (MitM) attacks on Digi Mobil, a Spanish ISP network, affecting 7,334 unique IPs hosting 10,759 domain names, where users received fake security certificates instead of authentic ones—raising privacy and security concerns.

The report also flags governance issues. OONI notes that Telefonica operates as both a major telecommunications provider and a broadcaster of football content through its media services, and is approximately 10% state-owned. This combination of roles raises questions about conflicts of interest and the independence of enforcement dynamics, particularly given Telefonica’s commercial interest in eliminating piracy competition to its own streaming platform. No ISPs challenged the original blocking application in court, and all major ISPs sell La Liga TV packages, suggesting potential conflicts of interest in their role as enforcement intermediaries.

Technical Alternatives and EU Context

The European Union Intellectual Property Office (EUIPO) published guidance in 2023 on live-event piracy that noted IP-level blocking may be an effective tool when dealing with uncooperative hosting providers. However, the same guidance recommended excluding IP ranges known to be used for shared hosting and limiting enforcement to live-event broadcast windows.

Spain’s implementation meets the timing criterion—blocks are largely confined to match hours. But it does not apply technical precision recommendations. The court order did not require La Liga to distinguish between infringing and non-infringing services, meaning if a hosting provider shared an IP range with a site accused of piracy, the entire range could be blocked without ongoing judicial oversight or accountability.

Rights holder organizations and EU bodies continue to engage on proportionality. SROC, the EUIPO, and members of the European Parliament have been meeting to discuss current and emerging challenges in fighting online piracy, with SROC proposing solutions that would require certain intermediaries to immediately remove illicit live content during broadcast.

What’s Next

The OONI study is the first large-scale empirical analysis quantifying collateral damage at scale. Its findings—while acknowledged by OONI as likely understating the true impact due to incomplete visibility into all blocked IPs—have prompted renewed debate among European technology providers, legal scholars, and policymakers about whether IP-level blocking, however well-intentioned, remains proportionate when shared infrastructure means affecting half a million legitimate services to target a few piracy streams.

Industry groups and constitutional courts continue to examine whether current Spanish enforcement practices comply with proportionality principles under EU law. The Disruptive Competition Project has documented how Spain is “repeating failure” by ignoring lessons from Italy’s similar overblocking disasters under Piracy Shield. The approach adopted in Spain may also inform how other European jurisdictions handle similar enforcement challenges as piracy detection technology and sports broadcasting revenue stakes continue to escalate.