Background
Anne Frank’s diaries and manuscripts are copyright-protected in the Netherlands until the end of 2036 — a quirk of Dutch transitional copyright law that preserved a pre-harmonisation domestic term running from first publication (1947). In virtually every other EU member state, and in most of the world, her works entered the public domain on January 1, 2016, seventy years after her death in Bergen-Belsen in February 1945.
In late September 2021, three Dutch scholarly institutions — the Anne Frank Stichting (Anne Frank House), the Royal Netherlands Academy of Arts and Sciences, and an academic research association — launched a free website (www.annefrankmanuscripten.org), registered in Belgium, offering digitised transcriptions and facsimiles of the original manuscripts. The site employed state-of-the-art geo-blocking: visitors with Netherlands IP addresses were blocked and shown a message saying the site was unavailable in their country. However, a Dutch user with a VPN could bypass the block and access the manuscripts.
The Anne Frank Fonds — a Swiss foundation established by Otto Frank and the copyright rights holder — sent a cease-and-desist letter in November 2021. Lower Dutch courts dismissed its claims. The Fonds appealed to the Hoge Raad (Dutch Supreme Court), which stayed the case and referred three questions to the CJEU: Does publishing a work online with geo-blocking constitute a “communication to the public” in the blocked country? Does the possibility of VPN circumvention change that answer? And if the publisher is liable, does liability extend to VPN providers?
The Court’s Holding
The CJEU ruled that a publisher who implements state-of-the-art geo-blocking does not “communicate to the public” in the blocked member state for purposes of the InfoSoc Directive (Directive 2001/29/EC, Art. 3(1)). Geo-blocking is a “technological measure” within the meaning of Article 6(3) of the same directive. When it meets the “effective” standard — meaning it is current, proportionate, and technically sound — it limits the “public” reached by the publication such that the blocked territory’s audience is excluded. No communication to that excluded public occurs. The threshold question of whether a copyright violation has happened at all is answered in the negative.
On VPN circumvention, the Court held that the mere possibility of bypass does not, by itself, render effective geo-blocking inadequate. The proportionality analysis asks whether the measure is state-of-the-art at the time of implementation — not whether every user can be physically prevented from accessing the content by any conceivable means. Crucially, the Court rejected the argument that publishers must replace free open-access sites with subscription walls or authenticated library terminals: requiring such alternatives would “disproportionately undermine the fair balance” between copyright protection and the public interest in accessing works that are lawfully in the public domain everywhere except the protected member state.
On attribution, the Court addressed what happens if geo-blocking falls short and infringement does occur: liability rests with the website publisher, not with VPN providers. VPN services supply neutral technical tools and do not play an “indispensable role” in any act of communication to the public. This is consistent with the InfoSoc Directive’s own recitals, which shield neutral conduits from copyright liability.
Key Takeaways
- State-of-the-art geo-blocking is now a valid legal tool for EU publishers and cultural institutions to publish works that are in the public domain in their home country but remain protected in one or more other member states — no takedown, no suppression, no authentication wall required.
- VPN circumvention does not defeat effective geo-blocking as a matter of EU copyright law; what matters is whether the measure was current and proportionate when implemented, not whether every user can be blocked absolutely.
- VPN providers bear no copyright liability for providing neutral tools that users may employ to circumvent geo-blocking; any liability falls on the publisher whose measures were inadequate.
- Publishers should periodically review geo-blocking technology to ensure it remains “state of the art” — the standard is a moving target as circumvention methods evolve.
- Voluntary self-certification systems (users declaring they are not in the blocked country) are explicitly inadequate and will not satisfy the effectiveness standard.
- The ruling reinforces that copyright territoriality in the EU is still fundamentally a member-state-by-member-state matter; pan-European digital publishing requires territorial mapping and jurisdiction-specific controls.
Why It Matters
This ruling creates a practical, cost-proportionate compliance path for open-access digital publishing across the EU’s patchwork of copyright expiry dates. Libraries, national archives, universities, and cultural foundations running cross-border digital editions of historical works no longer face an all-or-nothing choice between suppressing access everywhere or risking infringement claims in the handful of countries where protection still runs. A properly implemented geo-block — maintained as state-of-the-art — closes the liability gap.
The decision also has wider implications for platform operators, digital distributors, and streaming services managing multi-territory rights. The Court’s proportionality framework for “effective” technological measures will likely be applied well beyond cultural heritage contexts — to commercial publishers, e-book platforms, and any service that must navigate EU copyright’s territorial variations. And by squarely holding that VPN providers bear no copyright liability for user-initiated circumvention, the judgment provides a measure of legal clarity in an area where platform liability for user behavior had remained contested under EU law.