LaLiga's IP blocks hit Spanish startups

Spain's Commission on Economy, Trade and Digital Transformation voted on 29 April 2026 to rein in LaLiga's court-authorised mass IP blocking regime, a non-legislative initiative that, if it produces binding statute, would force the first structural reform of how copyright enforcement can weaponise shared internet infrastructure in Spain.

The entire blocking regime rests on a single seven-page judgment issued on 18 December 2024 by Commercial Court No. 6 of Barcelona. That ruling authorised Spanish ISPs, Movistar, Vodafone, Orange, and DIGI, to block IP addresses that LaLiga identifies as carrying unauthorised streams, with no requirement to return to a judge for each new block. LaLiga updates those lists in real time, every weekend.

The technical flaw is fundamental. Modern content delivery networks, Cloudflare and Vercel are the named examples in this case, use shared IP infrastructure where a single address can host hundreds of thousands of unrelated websites simultaneously. LaLiga is not blocking specific infringing domains. It is blocking entire IP ranges.

"It's only a matter of time before a Spanish citizen can't access a life-saving emergency resource because the rights holder in a football match refuses to send a limited request to block one resource versus a broad request to block a whole swath of the internet." — Matthew Prince, CEO, Cloudflare, February 2026.

LaLiga blocks roughly 3,000 IP addresses every weekend. Trackers at the monitoring site Hayahora Futbol have logged more than 13,500 legitimate websites knocked offline at various points. Services disrupted have included banking apps, the Madrid City Council website, ChatGPT, Microsoft services, GitHub Pages, Twitch, and Grammarly. During the parliamentary debate, ERC's economic spokesperson Inés Granollers cited a geolocation app used to monitor a family member with dementia, taken offline because it shared a server with a blocked IP. In February 2026, the blocks also took down Freedom.gov, the US government-funded portal built to help citizens bypass internet censorship.

"It is a bizarre situation. Usually, this kind of indiscriminate blocking of large slabs of the internet is something that you don't expect from a Western country." — David Peterson, General Manager, Proton VPN, February 2026.

A structural conflict of interest sits at the centre of the regime. The original blocking order was sought jointly by LaLiga and Telefónica Audiovisual Digital, the entity that paid €1.29 billion for domestic LaLiga broadcasting rights through the 2026/27 season. Telefónica also owns Movistar, the ISP that implements the blocks. A new Telefónica deal worth €2.64 billion covers 2027/28 through 2031/32. The blocking regime protects the value of that rights stack, and none of the four ISPs subject to the order challenged the original application, all sell LaLiga TV packages commercially.

Rather than narrowing its approach as collateral damage mounted, LaLiga expanded enforcement to VPNs. On 17 February 2026, Commercial Court No. 1 of Córdoba ordered NordVPN and Proton VPN to block specific IP addresses during match times. The order was issued without notifying either company and with no appeal mechanism. Both discovered it through press reports. Despite Vercel establishing a direct channel giving LaLiga access to its site reliability engineering incident management system, LaLiga ignored it and continued demanding excessively wide blocks, evidence that voluntary proportionality was available and rejected.

Cloudflare has exhausted the ordinary courts. Commercial Court No. 6 dismissed its appeal in March 2025, finding insufficient evidence of harm despite the documented record. The company has since filed at Spain's Constitutional Court, arguing LaLiga withheld from judges the fact that targeted IP addresses are shared infrastructure. Cloudflare has also communicated concerns to the European Commission, arguing the regime violates Regulation (EU) 2015/2120, the Open Internet Regulation, which prohibits ISPs from disproportionate traffic blocking except within narrow exceptions. In June 2025, the Commission sent Italy's Minister of Foreign Affairs a letter warning that Italy's structurally similar Piracy Shield may not be DSA-compliant, a precedent directly applicable to Spain.

"The number of problems that we are seeing with Italy's Piracy Shield is remarkable, and we want the rest of Europe to see that as a cautionary tale. We do worry, though, that a lot of other member states are looking to Italy's Piracy Shield as a model, and we think it's a model of exactly what not to do." — Christian Dawson, Executive Director, i2Coalition, 2025.

LaLiga's own data exposes the enforcement gap. The league acknowledges it successfully blocks only approximately 60% of pirated streams. Sophisticated infringers use VPNs and IP hopping to stay ahead of the blocks. Ordinary users lose access to their bank. LaLiga president Javier Tebas has insisted the measures are proportionate and has lobbied the European Commission to formalise dynamic blocking regimes across member states through binding EU-level anti-piracy law.

The April 29 initiative, backed by PSOE, ERC, Sumar, Bildu, PNV, and Compromís, calls for incorporating technological proportionality, graduated measures, and third-party protections into Spain's Digital Services Act framework. Non-legislative initiatives direct the government to pursue reform through the legislative process. The December 2024 court order remains in effect through the 2026/27 campaign. The 2024/25 season ends 24 May 2026. When the new season begins in August, the blocks resume unless a court rules otherwise.

For every Spanish startup, fintech, or developer platform running on shared cloud infrastructure, the parliamentary vote changes the political signal but not the matchday risk. Reform in statute and relief on the pitch are not the same deadline.