Every weekend for the past year and a half, millions of Spanish internet users have lost access to banking apps, developer tools, emergency-adjacent services, and even a US government portal — not because of a cyberattack, but because LaLiga, Spain’s top football league, holds a court order allowing it to cut off IP addresses at will, with no per-block judicial review and no mechanism for those wrongly affected to seek redress. On April 29, 2026, Spain’s Commission on Economy, Trade and Digital Transformation voted to change that — a move that, if it becomes statute, could force EU-wide reconsideration of how copyright enforcement is allowed to weaponize shared internet infrastructure.
LaLiga’s court order: one seven-page ruling, unlimited reach
The entire blocking regime rests on a single seven-page judgment issued on December 18, 2024, by Commercial Court No. 6 of Barcelona. The order authorized Spanish ISPs — Movistar, Vodafone, Orange, and DIGI — to block IP addresses that LaLiga identifies as carrying unauthorized streams of its matches. Crucially, the ruling empowered LaLiga to update those lists in real time, without returning to a judge for each new block.
The technical flaw in this design is fundamental. Modern content delivery networks like Cloudflare and Vercel use shared IP infrastructure: a single IP address can host hundreds of thousands — or, in some cases, millions — of unrelated websites simultaneously. LaLiga is not blocking specific infringing domains; it is blocking entire IP ranges. “In some cases, they have thousands, tens of thousands, hundreds of thousands, or even millions of domains behind them,” Cloudflare’s Vice President and Global Head of Public Policy, Alissa Starzak, told TechRadar. “Blocking [one IP] because there is a single domain that you want to block comes with a tremendous amount of collateral damage.”
The toll: dementia trackers, Docker pipelines, and Freedom.gov
The collateral damage has been documented extensively. LaLiga blocks roughly 3,000 IP addresses every weekend, causing what trackers at the grassroots monitoring site Hayahora Futbol have logged as more than 13,500 legitimate websites knocked offline at various points. Affected services have included the Madrid City Council website, banking apps, ChatGPT, Grammarly, Microsoft services, GitHub Pages, and Twitch.
During the parliamentary debate on April 29, ERC’s economic spokesperson Inés Granollers cited two cases that illustrate the human cost directly. First: Transporta’m, a citizen platform providing real-time transport infrastructure information, goes offline every time a LaLiga match is broadcast. “Every time there is a football match, thousands of citizens are left without this service,” Granollers said. Second: a Spanish citizen reported that a geolocation app used to monitor a family member with dementia went offline when it shared a server with a blocked IP.
In February 2026, LaLiga’s blocks also took down Freedom.gov, the US government-funded portal designed to help citizens bypass internet censorship. The irony was flagged publicly by David Peterson, General Manager at Proton VPN: a tool built to fight censorship had itself become collateral in a European sports league’s enforcement campaign. The Disruptive Competition Project has also documented payment providers and a Madrid regional health operator among those knocked offline during matchday windows.
Cloudflare CEO Matthew Prince put the systemic risk plainly: “It’s only a matter of time before a Spanish citizen can’t access a life-saving emergency resource because the rights holder in a football match refuses to send a limited request to block one resource versus a broad request to block a whole swath of the internet.”
The conflict of interest at the center of Spain’s enforcement regime
A structural problem compounds the legal one. The original blocking order was sought jointly by LaLiga and Telefónica Audiovisual Digital — the entity that paid €1.29 billion for domestic LaLiga broadcasting rights until the end of the 2026/27 season. Telefónica also owns Movistar, the ISP that implements the blocks. None of the ISPs challenged the original application; all sell LaLiga TV packages. TorrentFreak reported that Vodafone rejected efforts by digital rights group RootedCON to participate in the legal process — while being simultaneously a distributor of LaLiga content it had a commercial interest in protecting.
LaLiga escalates to VPNs — without notice
Rather than narrowing its approach as collateral damage mounted, LaLiga expanded it. On February 17, 2026, Commercial Court No. 1 of Córdoba issued a ruling ordering NordVPN and Proton VPN to block specific IP addresses during match times. The order was issued inaudita parte — without notifying either company, without allowing them to present a defense, and with no appeal mechanism.
NordVPN called the approach “unacceptable.” Proton VPN’s Peterson said the request was “simply unworkable” given the way CDNs function, adding that if asked to block legitimate sites he would “obviously contest that.” Neither company had even received official documentation when LaLiga announced the ruling publicly — both discovered it through press reports.
The Córdoba ruling classifies VPN services as “technological intermediaries” under the European Digital Services Regulation — a categorization that, if upheld, would make privacy tools legally responsible for the content of every IP address their users can access. Spain’s own National Cybersecurity Institute recommends VPNs to consumers. The order provides no mechanism to appeal individual blocking demands.
Spain’s parliament acts — but the path to law is long
The April 29 initiative, agreed between the governing PSOE and the Catalan republican party ERC, and backed by Sumar, Bildu, PNV, and Compromís, calls for incorporating principles of technological proportionality, graduated measures, and third-party protections into Spain’s Digital Services Act framework — the domestic legislation transposing the EU’s Digital Services Act. The proposal recognizes that IP-level blocking cannot be executed as though the internet were a list of isolated addresses.
ERC’s Granollers framed the question as one of democratic accountability: “Private interests are conditioning the functioning of the internet with direct consequences on citizens.” She called for “clear rules” so third parties are not subjected to judicial resolutions they had no voice in. Non-legislative initiatives do not change the law on their own — they direct the government to pursue reform through the legislative process. The road to binding statute remains long.
Cloudflare at Spain’s Constitutional Court, and the EU dimension
Cloudflare has exhausted the ordinary courts. Commercial Court No. 6 dismissed its appeal in March 2025, ruling that it had provided insufficient evidence of harm — despite the documented record of over 13,500 sites disrupted. The company has since filed an appeal with Spain’s Constitutional Court, arguing that LaLiga withheld from judges the fact that the targeted IP addresses are shared infrastructure, and that cloud providers were never notified before the order took effect.
The EU dimension is significant. Cloudflare has communicated its concerns to the European Commission, arguing the blocking regime violates Regulation (EU) 2015/2120 — the Open Internet Regulation — which prohibits ISPs from discriminatory or disproportionate traffic blocking except within narrow exceptions. The Disruptive Competition Project, a Washington-based digital policy organization, published an analysis in May 2026 arguing Spain is “repeating failure” by ignoring the lessons of Italy’s own overblocking disasters under its Piracy Shield system, and that LaLiga’s approach is “fundamentally incompatible with the rule of law.”
LaLiga, for its part, has been lobbying the European Commission in the opposite direction — calling for binding EU-level anti-piracy law that would formalize dynamic blocking regimes across member states.
LaLiga’s defense — and why its own numbers undercut it
LaLiga president Javier Tebas has insisted that the blocking measures are proportionate and that the league will not relent. He has publicly estimated that online piracy costs Spanish football €600–700 million per season. LaLiga’s February 2025 official statement accused Cloudflare of enabling human trafficking, prostitution, and child exploitation — claims Cloudflare and independent commentators have strongly disputed.
But LaLiga’s own data exposes a core weakness in its enforcement argument: the league acknowledges it successfully blocks only approximately 60% of pirated streams. Pirates use VPNs, IP hopping, and alternative infrastructure to stay ahead of the blocks. Sophisticated infringers adapt. Ordinary users lose access to their bank. That asymmetry — maximum collateral damage, limited enforcement gain — is precisely what the parliamentary initiative aims to address.
What reform would require, and what it cannot fix
If the non-legislative initiative produces binding legislation, the Disruptive Competition Project’s analysis outlines what meaningful reform would look like: quick mechanisms to remove an IP from blocklists when it affects legitimate services; transparency obligations on LaLiga’s block lists, which are currently secret and not publicly disclosed; technical traceability of decisions; and independent impact reviews before and after blocking orders are issued.
What legislation cannot undo is the current season. The December 2024 court order remains in effect through the 2026/27 campaign. The 2024/25 season ends May 24, 2026 — next week. When the new season begins in August, the blocks will resume unless a court rules otherwise. For Spanish internet users, developers, and businesses that rely on shared cloud infrastructure, the question is not whether reform is coming. The question is whether it arrives before the next matchday.
