Are VPNs legal in Spain? The law, and the 13 blocking episodes that made people ask

The previous version of this page opened with Spain as the world's second most attacked country, 45,000 cyberattacks a day and a 2,500% jump in VPN sign-ups. I tried to source all three. The first two trace to press releases from Spanish security vendors that give no method. The third is a misreading: the company it is attributed to, Proton, reported a 200% spike in its own post. None of them is in this version.

The question people bring to this page is simpler. Are VPNs legal in Spain, and, often, in Italy or Spain? The short answer is yes. The longer answer matters because Spain is where blocking aimed at football piracy has knocked hundreds of thousands of unrelated websites offline, and where a court has now told two VPN providers to join in. Below are the rules, with their statutes, and every blocking episode I could document since 2017, each with a verdict on whether a VPN would have got round it.

Are VPNs legal in Spain?

Yes. A VPN is legal to sell and legal to use in Spain, and no Spanish law I could find mentions VPNs at all. I searched the information society law, the 2022 telecommunications law, the data retention law, the copyright law, the gambling law and Article 270 of the Criminal Code. There is no single official sentence that says "VPNs are legal", because nobody has needed to write one. The closest thing is the state cybersecurity institute, INCIBE, whose first recommendation for public Wi-Fi is to use one.

Two points from those 11 rows. Spain has five separate routes to a blocked website, which are the general information society law, the civil courts, the culture ministry's commission, the gambling regulator and the criminal courts, and three of the five can work without a judge: the general route, which is how the medicines agency blocked Women on Web, the culture commission once a site is a repeat infringer, and the gambling regulator. And in none of the 11 does the law place any duty on the person using a VPN. Every obligation falls on an operator, an intermediary or an infringer. Spanish VPN law is, for now, the absence of VPN law.

Which blocking orders made Spaniards ask about VPNs?

The table lists 13 episodes between 2017 and September 2026. The VPN column answers a narrow technical question: given how the block was built, would a VPN have got round it? It is not a statement about what was lawful to view.

The verdicts come to ten yes, two partly and one not needed. The reason is structural. Ten of the thirteen were built inside the access provider's network, and a VPN tunnel passes through that network unopened. GitHub's 2019 geo-block keyed on a Spanish IP address, which a VPN also changes. Two episodes are different. In 2017 the state went to the domain registry, and a seized domain is gone for the whole world. In 2026 rights holders went to the VPN providers themselves. Those are the two directions in which blocking can go when the access network stops being enough.

The scale of the football blocking is the part with real measurements. OONI identified 7,441 IP addresses blocked on Spanish networks between January 1 and June 1, 2026, then checked 9.2 million popular domains against them: 554,507 of them, or 5.8%, sat on a blocked address at some point. More than 501,000 of those domains sat behind 2,218 Cloudflare addresses, and blocking between 4 and 20 addresses in a single hour was enough to disrupt over 400,000 domains. The affected sites included national pages of UNICEF and the UN refugee agency, Amnesty chapters and a software registry. LaLiga's position is that the blocking cut piracy by 40 to 60% on weekends "without collateral impact". The Barcelona court dismissed annulment requests from Cloudflare and the security conference RootedCON in March 2025, finding harm to third parties not proven. Net neutrality complaints to the ministry went from about ten to about 265 in 2025.

This is why "are VPNs legal in Spain" became a common search. Most of the people asking were not looking for football. They were developers whose deployments failed on a Saturday evening, and shoppers whose payment page would not load.

Is a VPN legal in Italy or Spain, and how do the two compare?

Using a VPN is legal in both countries. They differ in how far blocking duties have been pushed onto VPN and DNS companies, and Italy has gone further.

The contrast is between a regulator and a courtroom. Italy wrote VPN providers into a standing administrative system. Spain has a single interim order whose own court then declined to enforce it with fines. Neither country has touched the user. Our pages on using a VPN in Spain and in Italy cover the everyday side, and the register of website blocking in France shows the third model, where Paris courts have ordered five VPN providers to block sports piracy domains since May 2025.

What about privacy, data retention and cybercrime in Spain?

The old page leaned on alarming numbers. These are the official ones. INCIBE's response team handled 122,223 cybersecurity incidents in 2025, up 26% in a year, of which 45,445 were online fraud, including phishing. The data protection agency received 30,931 complaints in 2025, up 64% and the most in its history, and imposed €48.1 million in fines.

On retention, Spain still has the 12-month rule it adopted in 2007 to implement an EU directive that the EU Court of Justice struck down in 2014, the first in a line of rulings against blanket retention. The law binds telecom operators, it requires a judge's authorisation for access, and it has not been rewritten. Your internet provider therefore keeps a year of records about when and where you connected, though not what you read. A VPN replaces what that provider can record about your destinations with a single entry, the VPN server. Our table of retention laws in 16 jurisdictions shows how other countries handle the same question. Le VPN has a server location in Spain among more than 100, allows 10 simultaneous connections and comes with a 30-day money-back guarantee.

What changes next?

• Constitutional Court. RootedCON announced its challenge to the football blocking on May 16, 2025 and Cloudflare filed its own by June 2025. As of September 18, 2026 the court had still not decided whether to admit RootedCON's.
• Córdoba. The interim order against the two VPN providers stays in force and the main case is pending. I found no report on whether Proton has applied the order.
• The Barcelona judgment expires with the 2026 to 2027 season, around June 20, 2027. LaLiga's tender for the 2027 to 2032 broadcasting rights makes cooperation with blocking, and support for legal action against VPNs and DNS services, a condition for bidders. A new application in 2027 is likely.
• Congress. A committee approved a non-binding motion on April 29, 2026 asking the government to write "technological proportionality" into the law. It changes nothing by itself, and no bill has followed.
• The minors' law. The government wants the organic law passed before the end of 2026. The clause to watch is amendment 89, which would write VPN and DNS providers into the information society law as intermediaries with a 30-minute blocking duty. I could not establish whether the committee has accepted it.
• Women on Web v Spain was filed at the European Court of Human Rights on June 12, 2026.
• Italy. The Lazio administrative court upheld the Cloudflare fine on July 17, 2026, in judgment 13201/2026. Cloudflare has said it will appeal again.