4 days ago
VPNs ordered to block illegal streaming sites in France – but how would this work?
French broadcaster Canal+, alongside the Ligue de Football Professionnel (LFP), recently dealt a blow to some of the best VPNs, with victory in its anti-piracy court case.
The ruling ordered VPN providers to block access to over 200 "illegal sports streaming sites," with the case being described as a "legal first."
NordVPN, Surfshark, ExpressVPN, Proton VPN, and CyberGhost are named in the case, and all are disappointed with the outcome.
Being forced to restrict access to any sites – illegal or not – is a direct contradiction of the fundamental principles of most VPNs. It has been claimed that this sets a dangerous precedent for future legal cases and VPN targeting.
Appeals are expected, and it isn't yet clear what actions the VPN providers will take. However, should site blocking commence, we wanted to investigate what this might look like and who would be affected.
We can't predict if – or how – providers will comply with blocking orders, but domain-level blocking would appear to be the likeliest technical approach.
Many of the leading VPN providers operate their own DNS (Domain Name System) servers. DNS servers have been described as "the phonebook of the internet." They translate domain names and what you type into your browser into the correct IP address for your desired site.
DNS servers are often used by VPNs, adblockers, and malware protection software to block malicious sites. If you try to access a site that has identified as malicious, an IP address isn't returned and you won't be able to visit the site.
Providers will have a "blocklist" of dangerous sites you're unable to access. In theory, illegal streaming sites could be added to this list.
Affected users could use a custom DNS server, different from the one used by their VPN, to access the blocked sites. Not every VPN supports custom DNS, but NordVPN and Proton VPN do. Surfshark has also just launched a privacy-focused public DNS service.
It appears as though the ruling will only impact those in France or French territories.
Denis Vyazovoy, CPO of AdGuard VPN, commented on the ruling, describing it as "territorial." He said "this ruling does not directly affect users outside of France who connect to French VPN servers, unless their subscription was initiated while they were in France/French territories."
"VPN users in France who use one of the named providers will likely find that certain pirate IPTV and sports streaming sites simply stop working – that is assuming that the VPNs comply with the ruling."
Vyazovoy was skeptical that providers would fully go along with the blocking and suggested removing physical French servers as a workaround. They could be replaced with virtual servers elsewhere and lead to a maintained user level in France.
The Internet Infrastructure (i2) Coalition said in a statement that "the integrity of the internet" is at risk.
"The French ruling not only misplaces responsibility: it fundamentally threatens the privacy and security of millions of users in France and beyond," the coalition added.
The i2 Coalition oversees a working group known as the VPN Trust Initiative (VTI), of which NordVPN, Surfshark, and ExpressVPN are members.
The VTI recognized the need to safeguard rightsholders but urged "precision, restraint, and accountability" when it comes to technical enforcement of the internet.
AdGuard VPN CPO, Denis Vyazovoy, had further thoughts on the potential repercussions of this ruling.
"This ruling sets a worrying precedent: VPNs are being treated more like content platforms than neutral privacy tools," he said.
"If more rulings like this follow, established VPN services that appear to be primary targets of such injunctions may consider exiting France altogether or at least reconsider the terms of their presence there. This will deprive French users of essential and trusted privacy tools."
Vyazovoy expressed his worry that other VPN providers will be the next targets. "Everyone in the industry should be paying close attention and preparing for similar legal challenges. This ruling sends a signal to the whole VPN market in France and possibly beyond."
A repeated message is that it's wrong to target VPNs. The VTI said "this selective approach is certain to fail, as it targets symptoms rather than addressing the root causes of piracy."
Vyazovoy believed that "this court decision pushes VPNs into becoming content police, which risks turning them from privacy tools into enforcement tools."
"If VPNs are forced to monitor traffic or block domains, users can't fully trust them anymore. That could drive people to sketchier, less transparent VPNs that don't follow any rules at all," he added.
"This alone creates potential privacy risks for users. The precedent this sets could also lead to wider blocks, more legal actions, and less digital freedom in the long run."
It isn't yet clear how providers will respond, and there are various obstacles that need to be carefully navigated.
NordVPN acknowledged the ruling and believed it "will have a negative impact on France's digital security."
It added that its team "is currently assessing all possible approaches that align with both legal compliance and our core commitment to our users' freedom and privacy."
Surfshark said it was "reviewing the ruling and assessing all available options, including a potential appeal." While Surfshark said it has "respect for the French legal process," it believed the decision would be dangerous for global internet freedoms.
The provider added that "mandating that intermediaries implement content restrictions brings up critical issues related to freedom of expression, proportionality, and the protection of user rights."
ExpressVPN was also disappointed with the decision and said it was reviewing the judgement. "We assure you that our commitment to privacy and our no logs policy will never be compromised," the provider commented.
This is certainly not the last we will hear of this case, and we will carefully monitor the providers' next steps.
We test and review VPN services in the context of legal recreational uses. For example: 1. Accessing a service from another country (subject to the terms and conditions of that service). 2. Protecting your online security and strengthening your online privacy when abroad. We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.
