Disclosure: VPNFin is reader-supported. If you buy a VPN through links on this page, we may earn a commission at no extra cost to you. This never affects our ratings — here’s our full disclosure.
A Spanish court told two VPN companies to change how their networks behave. Neither sat in the room, neither received notice, and both learned about it from journalists instead.
One of them said publicly that it had received no documents at all. What follows is the strangest procedure in this series, and it still creates no offence for anyone using a VPN.
Is a VPN Legal in Spain?
Yes, without qualification. No Spanish law restricts buying, installing or using one, and none has been proposed. What exists is a commercial court order from February 2026 requiring two named providers to block IP addresses carrying pirated football, updated in real time during matches. It binds those companies and nobody else.
What the Córdoba Court Ordered
The measure is narrow on paper and wide in effect.
On 17 February 2026, Commercial Court No. 1 of Córdoba granted precautionary measures to LaLiga and its broadcast partner Telefónica Audiovisual Digital. NordVPN and Proton VPN must block sixteen sites streaming matches without rights.
The list updates itself. LaLiga and Telefónica can add addresses in real time as new sources appear during a broadcast, so the target moves while the obligation stays.
The legal basis is European rather than Spanish. The court classed both companies as technological intermediaries under the Digital Services Act, which is the same reasoning an Italian regulator used to reach VPN providers.
⚠️ The order names two providers and leaves out the rest. Surfshark, CyberGhost and IPVanish sell the same service in Spain, and they received nothing. In short, the measure describes who LaLiga sued rather than what the technology does.
The Defendants Read About It in the Press
Here is the part that separates Spain from the rest.
The court granted the order inaudita parte. Consequently, neither company attended a hearing, neither filed a defence, and neither could appeal at that stage.
Proton VPN posted the same day that it had seen no disruption to its service in Spain and had received nothing, despite reading about documents being sent. NordVPN told a Spanish outlet it had not been involved in any proceedings and called the approach unacceptable.
⚠️ A binding order that its target learns about from a newspaper is unusual anywhere. Both companies pointed at the same principle: courts under the rule of law let parties argue before judgment.
LaLiga cited France as the precedent. The Paris orders of 2025 did reach five named providers, though those companies were at least parties to the case.
The Damage Was Not Confined to Pirate Sites
Blocking by IP address is a blunt instrument, and Spain has the receipts.
Outages hit during match windows. Users and developers documented intermittent failures affecting Cloudflare, Vercel, GitHub and Docker while blocks were active.
The cause is structural rather than careless. Content delivery networks put thousands of unrelated sites behind shared addresses, so blocking one address removes all of them. Proton’s spokesperson called the request unworkable for exactly that reason.
⚠️ This is the same failure Italy produced, and Spanish civil society groups have said so directly. Neither country changed the method afterwards.
In May, the Same Court Said No
The sequel is the reason this page is worth reading in full.
On 19 May 2026 the Commercial Court of Córdoba dismissed LaLiga’s request for coercive fines against NordVPN. The court accepted technical evidence from the company’s experts and found it could not be established that the injunction had been breached deliberately and without justification.
The argument that worked was practical. LaLiga’s address lists changed within hours, so infrastructure had usually moved before any block could take effect.
⚠️ This is not a final judgment. NordVPN said so itself: the main proceedings continue, and the February measures still stand.
Parliament noticed too. On 29 April 2026 the Spanish Congress approved a non-binding initiative from PSOE and ERC lawmakers calling for a principle of technological proportionality in the country’s digital services law.
Nothing Here Reaches the User
Worth stating plainly, because the coverage reads like a crackdown.
No Spanish statute penalises VPN use. No fine, no offence, no proposal in front of parliament.
Every action has landed on a company. Cloudflare first, then two VPN providers, all through commercial litigation about broadcasting rights.
Germany went the other way entirely. Its courts struck down two attempts at data retention, and the third one asks providers to remember an IP address rather than to block anything.
⚠️ The European pattern is now consistent. Britain put the duty on platforms and ruled out touching VPNs. France used courts, Italy used a regulator, and Spain used an injunction nobody was told about. Not one of them created an offence for a person.
If You Are Visiting or Living There
Ordinary points, all lawful.
Nothing restricts you. Install what you like and connect where you like. Expect a short list of streaming addresses to fail on two providers during matches.
Set it up before you travel as normal preparation — our travel guide covers what breaks in hotels rather than in court.
Test the connection once. Running the leak checks confirms the tunnel does what the app claims.
Choosing a provider is a separate question. That guide covers the three free Spanish platforms, and the odder reason people there buy one: reaching the ordinary websites that vanish when a blocked address is shared.
⚠️ A VPN moves your apparent location and nothing else. What it actually hides is the honest version, and the Spanish orders change none of it.
⚠️ Not legal advice. We are not lawyers, the main proceedings are unresolved, and the address lists change during every match.
Where Spain Sits Against the Rest
Three European countries reached the same target by three different routes. A French court ruled after argument, an Italian regulator wrote a rule, and a Spanish court granted measures without a hearing.
The speed and the safeguards move in opposite directions. Spain’s list updates in real time; its defendants got no hearing at all.
| Country | What the rule aims at | Reaches the user? |
|---|---|---|
| Turkey | The tunnel — ISPs must block | No |
| The UAE | Conduct behind an address | No |
| India | The provider's records | Not nationally |
| China | Provider, tunnel and user | Yes |
| Brazil | Nothing, until a court acts | For 39 days |
| Indonesia | Paperwork — registration | No |
| The UK | The destination you visit | No, and ministers said so |
| The US | The platform, state by state | No, in all twenty-seven |
| Russia | The search, not the tool | Only if you went looking |
| Australia | The platform, and the tunnel itself | No — platforms must detect it |
| France | The VPN provider itself | No, the orders bind five companies |
| Italy | The provider, by regulator order | No, but one VPN left the market |
| Spain | The provider, by injunction without a hearing | No, and only two firms were named |
| Germany | The provider's logfile, for three months | No, and the courts twice removed it |
Our wider legality guide covers why the legal-or-illegal framing answers this question badly almost everywhere. For anyone choosing a service to watch football legitimately, our streaming guide sets out which providers are affected.
How We Research
This page draws on BleepingComputer and Tom’s Guide for the Córdoba measures of 17 February 2026 and their inaudita parte character, on TechRadar for the classification of VPN providers as intermediaries under the Digital Services Act and for Proton VPN’s and NordVPN’s statements that they had not been notified, on Medianama for the detail that only two providers were served, on CyberInsider and TechRadar for the ruling of 19 May 2026 dismissing coercive fines and for the documented outages affecting developer services, and on the Disruptive Competition Project for the comparison with Italy. We do not run our own tests and we do not publish circumvention instructions for any jurisdiction. Our full approach lives on the About Us page.
Spain VPN Law FAQ
No. Spanish law contains no offence for using, buying or installing one, and no bill has proposed restricting them. The February 2026 measures from the Córdoba court bind two named companies over specific streaming addresses, and they say nothing about the people who subscribe to those services.
NordVPN and Proton VPN, and only those two. LaLiga’s own statement confirmed that no other provider received notice, so Surfshark, CyberGhost and IPVanish continue operating in Spain untouched. Both named companies said publicly that they had not been formally notified of the proceedings.
Because blocking works by IP address, and content delivery networks put thousands of unrelated sites behind shared addresses. Users have documented outages affecting Cloudflare, Vercel, GitHub and Docker during match windows. The Spanish Congress approved a motion in April 2026 calling for more proportionate blocking.
No published case has penalised a subscriber. The proceedings are commercial disputes about broadcasting rights between a football league, a broadcaster and companies. The only fines discussed were coercive fines against a provider, and the court declined to impose them in May 2026.
Yes, and one won a round. On 19 May 2026 the Commercial Court of Córdoba dismissed LaLiga’s request to fine NordVPN, accepting technical evidence that the address lists changed within hours. NordVPN stressed that the main proceedings continue and the February measures remain in force.
The Verdict
Using a VPN in Spain is legal, and no proposal would change that. No offence exists and no penalty has reached a subscriber.
What happened instead was a private dispute about football rights. A league and a broadcaster obtained measures against two companies, in a court neither attended, with a list that changes during play.
Then the same court declined to fine one of them. That refusal, and a parliamentary motion about proportionality, are the first signs in this series of a European court pushing back on the method rather than extending it.