Which Countries Make VPNs Block Websites? Every Order and Bill, Dated

Within ten days in September 2026, the United States Congress received two bills that both order internet companies to block piracy sites, and disagree about exactly one kind of company. The American Copyright Protection Act, introduced on September 14, names virtual private networks as blocking agents. The DEFEND IP Act, introduced on September 24, excludes them in so many words. Whichever way Congress goes, it will be choosing between two models that already exist: in Europe, courts and regulators in exactly three countries have pulled VPN providers into the blocking chain, and everywhere else the obligation stops one layer lower.

This page is the ledger. Every instrument we could verify that puts, or would put, a VPN provider under a duty to block websites: country by country, dated, with the legal basis, who was named, and where each fight stands. It gets updated as orders land.

One definition before the table, because the distinction carries the whole subject: a site-blocking order against a VPN tells a company to filter destinations; it does not create an offence for the person using the VPN, and no order or bill in this ledger penalizes VPN use itself.

Which Countries Have Ordered VPN Providers to Block Websites?

Three yes rows out of the whole table, and even those three arrived differently: France by repeated adversarial court orders, Spain by a precautionary measure granted without hearing the providers, Italy by regulation with no named-VPN order yet on the public record. The rest of this page takes the rows one at a time.

What Did French Courts Order VPNs to Do, and Under Which Law?

France is the deepest file, and the one we have covered since the first order. Article L.333-10 of the sports code lets rightsholders ask the Paris Judicial Court to order “any measure” against “any person” in a position to contribute to remedying live sports piracy. In May 2025 the court read that breadth literally and ordered five VPN providers, NordVPN, CyberGhost, Surfshark, ExpressVPN and Proton VPN, to block 203 domains for Canal+ and the LFP. In July 2025 it added further orders and declined to refer the question to the EU Court of Justice. By March 2026 the model had widened beyond ISPs and VPNs to DNS resolvers and CDN services in a single round of beIN orders.

The current season’s orders arrived in two July waves. On July 8 and 9, 2026, the LFP obtained its 2026/27 judgments, a batch that collectively reaches ISPs, VPN providers, DNS resolvers and search engines, though the lead ISP order itself (no. 26/07709) names only nine access providers. On July 17 came fourteen rulings for Canal+: seven covering the Champions League with 26 domains and seven covering the Premier League with 47, running to late May and early June 2027, and this time naming Proton VPN, CyberGhost and ExpressVPN among the respondents. Days later, on July 21, the legislature adopted a sports law whose Article 10 rewrites L.333-10 around automated, real-time blocking: new domains pushed to intermediaries during the broadcast itself, with ARCOM checking afterwards rather than approving first.

France also runs a second blocking register entirely, for adult sites that skip age verification, and the mechanics rhyme. We keep a dedicated dated register of France’s website blocking, so this ledger keeps the French rows compressed.

What Happened in Spain With LaLiga, NordVPN and Proton VPN?

Spain’s entry is one court, one claimant and a procedural detail that drew more criticism than the blocking itself. In February 2026, Commercial Court No. 1 of Cordoba granted LaLiga and Telefonica’s audiovisual arm precautionary measures ordering NordVPN and Proton VPN to block 16 sites, and it did so inaudita parte, without hearing the providers first. The order came on top of LaLiga’s existing IP-level blocking through Spanish ISPs, the campaign that has made Spanish football weekends a case study in collateral damage, which we covered in our Spain reference.

The follow-up cut the other way. On May 19, 2026, the same court refused LaLiga’s request for coercive fines against NordVPN, declining to punish the provider while the measures are contested. The blocking order stands; the attempt to make non-compliance expensive did not. For scale on what surrounds it: OONI’s measurement study of the first five months of 2026 counted 554,507 domains, 5.8 percent of everything it tested, caught by LaLiga’s IP blocks, because blocking a shared IP address takes down every site behind it.

Does Italy's Piracy Shield Apply to VPNs?

On paper, fully. Italy is the only country that put VPN providers under a standing regulatory duty rather than case-by-case orders: AGCOM’s Piracy Shield platform pushes rightsholder reports to registered intermediaries, which must block within 30 minutes, and a February 2025 amendment extended the registration duty to VPN and public DNS providers. One consequence arrived before any named-VPN enforcement did: AirVPN stopped accepting Italian residents, calling the obligations incompatible with its service.

The enforcement test case is Cloudflare. AGCOM fined it EUR 14,247,698.56, decided December 29, 2025 and announced January 8, 2026, for not wiring its public 1.1.1.1 resolver into Piracy Shield. Cloudflare appealed to the Regional Administrative Tribunal of Lazio in March, and no ruling had been published as of this update. How that appeal lands will tell every VPN provider registered in Italy what the rules are actually worth.

Italy also supplies the best error data in this ledger. A University of Twente team, in a peer-reviewed study presented at IEEE CNSM 2025, hand-verified at least 510 lawful, non-streaming websites blocked by Piracy Shield out of 7,114 affected domains, with wrongful blocks lasting around 320 days on average, and the authors call those numbers a conservative lower bound.

Would a US Law Make VPNs Block Sites? ACPA and DEFEND IP, Compared

Here is where the two models meet. Both bills sit in the House and Senate Judiciary Committees, neither has a hearing scheduled, and they were written by people who plainly read the same European news and drew opposite conclusions. The comparison, from the bill texts:

Two details in the fine print deserve more attention than they have had. First, a correction to something widely repeated: the ACPA contains no “block within 24 hours” rule for live broadcasts. The 24-hour figure in the text is part of the definition of a time-sensitive event; what the bill actually grants is judicial discretion to compress deadlines. Second, a disappearance nobody seems to have reported: the DEFEND IP Act’s predecessor, FADPA, barred any order that would “prevent a user … from using a virtual private network.” DEFEND IP drops that clause. It still defines the term, then never uses it outside the exclusion. VPN providers are out of its blocking chain; the explicit protection for VPN users went out with the rewrite.

Is It Still Legal to Use a VPN in These Countries?

Yes, in every country in this ledger. The point is worth stating mechanically: the French orders bind five companies, the Spanish order binds two, the Italian rules bind registered intermediaries, and both American bills define duties for service providers above a size threshold. A person connecting through a VPN appears nowhere in any of them as the bearer of an obligation.

The one country that came close is Denmark, and the attempt died twice over. A December 2025 draft of its anti-piracy package would have fined users who reached blocked or geo-restricted content through a VPN; within two weeks of the consultation opening, culture minister Jakob Engel-Schmidt announced the VPN section was being removed, and the bill then lapsed entirely when Denmark called its March 2026 election before anything was introduced. Worth remembering if it returns: the operative draft clause was written technology-neutrally, around any “technical solution” used to gain unauthorized access, so a revived bill would not need the letters VPN to cover one. Where VPN use itself is restricted in the world today, the instrument is a censorship law, not a copyright one, and our country-by-country guide to VPN legality maps that separate territory.

Does a Blocking Order Mean a VPN Has to Log Its Users?

No, and conflating the two helps nobody. A blocking order is a filtering duty: prevent connections to the destinations on this list. A logging obligation would be a surveillance duty: record what your users did. Nothing in the French court orders, the Spanish measures, the Italian rules or either US bill asks a provider to track which user attempted to reach which site, and the ACPA goes as far as barring courts from prescribing any specific technical measure at all, leaving the method to the provider. The honest criticisms of blocking orders are about overreach and error, the 510 lawful Italian sites and the half-million Spanish domains above, not about secret surveillance.

What Should You Watch Next?

Four proceedings will redraw this table. The TAR Lazio ruling on Cloudflare’s fine decides whether Italy’s regulatory model survives contact with a resourced defendant. The French appeals, including NordVPN’s against the December 2025 LFP order, test whether “any measure against any person” has a ceiling. Any markup of ACPA or DEFEND IP shows which US model has committee support, and the treatment of the VPN definition will be the tell; with the House out until its November 9 votes, nothing moves there before mid-November. And each new European football season now reliably brings a fresh round of orders, broader than the last.

We keep this ledger updated as each of those lands. For the wider question of where VPNs themselves are legal, regulated or restricted, start with the legality guide; for what makes a VPN worth defending in the first place, our overview of VPN legality and legitimate uses covers the ground.