In brief
The Court of Justice of the European Union (CJEU) in its judgment Case C-788/24 has ruled on when publishing a work online that is copyright-protected in some EU Member States, but in the public domain in others, amounts to an unauthorised "communication to the public".
- A geo-blocking measure that is genuinely up to date ("state of the art") can be enough to avoid infringement in a country where the work is still protected, even if determined users can circumvent it using a VPN.
- However, a simple "click to confirm your location" pop-up is not good enough. Self-declaration mechanisms, which rely on users being honest, do not count as effective technological measures.
- If a publisher's geo-blocking is found to be inadequate, the liability sits with the publisher that published the content, not with the VPN provider that helped a user get around the block.
Overview of the decision
Certain parts of Anne Frank's diary remain protected by copyright in the Netherlands until 2037, but are already in the public domain in other EU countries, including Belgium. A Belgian organisation published a scholarly edition of Anne Frank's manuscripts online, free of charge. To prevent Dutch users accessing the content, the website used geo-blocking based on the user's IP address, plus a pop-up asking visitors to confirm they were accessing the site from a public domain country.
The rightsholder, the Anne Frank Fonds, argued that this still infringed copyright in the Netherlands as an unauthorised communication to the public under Article 3(1) of Directive 2001/29 because the geo-block could be bypassed using a VPN. The dispute reached the CJEU by way of a reference from the Supreme Court of the Netherlands.
The CJEU held that publishing a work behind an effective, "state of the art" geo-blocking measure does not amount to a communication to the public in the country where the work is still protected, though it left it to the referring Dutch Court to decide whether the measure used here was sufficient. The mere theoretical possibility of circumvention does not render a measure ineffective. However, a self-declaration pop-up would not be effective, because it relies entirely on the user telling the truth.
Finally, the court confirmed that, if a geo-block does turn out to be inadequate, responsibility for the resulting infringement falls on the publisher of the content, not on the provider of the VPN.
Whilst the decision concerns cross-border publication within the EU and is not binding on the UK courts, the UK courts may have regard to the court's decision. Potentially, the CJEU's approach raises the possibility of divergence in relation to questions around targeting and accessibility of websites.
Why this matters
The length of copyright protection can vary by country, particularly for older works subject to different national transitional rules. This judgment confirms that publishers cannot rely on mediocre technological measures to prevent access from protected territories, but equally that perfect blocking is not the required standard. The test is whether the technology used is genuinely current and "state of the art".
Publication checklist for publishers
1. Check the copyright status territory by territory
Before publishing, establish where the work is still protected and where it is in the public domain. Copyright term and transitional provisions differ between Member States, so a work can be free to use in one country and infringing in another. Do not assume that the answer will be consistent across the EU.
2. Use IP-based geo-blocking, not a self-declaration form
Implement geo-blocking that identifies and restricts access based on the user's IP address or equivalent technical signal. Do not rely on a pop-up that simply asks the user to confirm their location.
3. Keep the technology current
"Effective technological measures" means state of the art at the time of use, not a one-off implementation left untouched for years. Publishers should periodically review their geo-blocking against current circumvention techniques and industry standards, and be able to demonstrate that their measures reflect current practice. That said, a publisher will not be found liable simply because a determined user circumvented a properly implemented, current geo-block.
4. Document your approach
Because the assessment is fact-specific and proportionality-based, keep a record of the technology selected, why it was considered state of the art, and when it was last reviewed. This will be essential if a rightsholder later challenges the publication.
5. Review existing publications, not just new ones
Publishers with existing multi-territory digital archives or content platforms should audit current access controls against this standard now, rather than waiting for a complaint. A measure that was adequate several years ago may no longer qualify.
6. Do not assume liability falls on VPN provider
If geo-blocking is found to be inadequate, the publisher will be the party liable, not the VPN or other infrastructure provider.
How Mishcon de Reya can help
Our Intellectual Property team regularly advises on cross-border copyright risk, digital publishing strategy and content access controls. If you publish content across multiple territories and want to assess your exposure under this ruling, please get in touch with a member of the Intellectual Property team.