LaLiga's IP blocks reach parliament

Spain's Commission on Economy, Trade and Digital Transformation voted on 29 April 2026 to direct the government to reform the legal framework enabling LaLiga's mass IP blocking regime, a cross-party initiative backed by PSOE, ERC, Sumar, Bildu, PNV, and Compromís that marks the first institutional challenge to a court order giving a private sports league unilateral, real-time control over Spanish internet routing.

The blocking regime rests on a single judgment issued on 18 December 2024 by Commercial Court No. 6 of Barcelona. The order authorises Spanish ISPs, Movistar, Vodafone, Orange, and DIGI, to block IP addresses that LaLiga identifies as carrying unauthorised streams of its matches. Critically, the ruling empowers LaLiga to update those lists in real time, without returning to a judge for each new block.

The technical flaw is structural. Modern content delivery networks such as Cloudflare and Vercel use shared IP infrastructure where a single address can host hundreds of thousands of unrelated websites simultaneously. LaLiga is not blocking specific infringing domains. It is blocking entire IP ranges.

"The strategy of blocking broadly through ISPs based on IPs is bonkers because so much content, including emergency services content, can be behind any IP. The collateral damage is vast and is hurting Spanish citizens from accessing critical resources." — Matthew Prince, CEO, Cloudflare, May 2025.

LaLiga blocks roughly 3,000 IP addresses every weekend. Trackers at Hayahora Futbol have logged more than 13,500 legitimate websites knocked offline at various points. Documented casualties include the Madrid City Council website, banking apps, ChatGPT, GitHub Pages, Microsoft services, and Twitch. In February 2026, the blocks also took down Freedom.gov, the US government portal designed to help citizens bypass internet censorship. ERC's economic spokesperson Inés Granollers cited a geolocation app used to monitor a family member with dementia going offline after its server shared a blocked IP, and Transporta'm, a real-time transport information platform, losing service every matchday.

The conflict of interest embedded in the blocking architecture compounds the legal concern. Telefónica Audiovisual Digital, which paid €1.29 billion for domestic LaLiga broadcasting rights through the 2026/27 season, jointly obtained the original injunction with LaLiga. Telefónica also owns Movistar, the primary ISP implementing the blocks. Vodafone, Orange, and DIGI all sell access to LaLiga matches, meaning all four ISPs enforcing the order hold active revenue stakes in the rights being protected.

Rather than narrowing its approach as collateral damage mounted, LaLiga expanded it. On 17 February 2026, Commercial Court No. 1 of Córdoba issued a ruling, issued without notifying either company and with no appeal mechanism, ordering NordVPN and Proton VPN to block specific IP addresses during match times. Both companies discovered the ruling through press reports.

"I should make it clear: Proton is not trying to enable piracy. Rights holders have the right to defend their rights. What we don't believe that they have the right to do is cause such huge collateral damage." — David Peterson, General Manager, Proton VPN, February 2026.

The Córdoba order classifies VPN services as technological intermediaries under the European Digital Services Regulation, a categorisation that, if upheld, would make privacy tools legally responsible for the content of every IP address their users can access. Spain's own National Cybersecurity Institute recommends VPNs to consumers.

Cloudflare exhausted the ordinary courts. Commercial Court No. 6 dismissed its appeal in March 2025 and has since filed with Spain's Constitutional Court, arguing LaLiga withheld from judges the fact that targeted addresses are shared infrastructure. The company has also communicated concerns to the European Commission, arguing the regime violates Regulation (EU) 2015/2120, the Open Internet Regulation, which prohibits disproportionate traffic blocking. A European Commission letter dated 13 June 2025 addressed to Italy's government over its comparable Piracy Shield system cited lack of transparency, overblocking of legitimate sites, and absence of prior judicial review as DSA compliance failures, providing a direct precedent for the Spanish challenge.

"LaLiga now compiles and updates lists of IP addresses and domain names that it wants to see blocked. This process is completely opaque: these lists are not publicly disclosed, there is no independent technical or judicial validation before new addresses are added, and the court does not appear to continuously review any additions. Once someone gets blocked, there is no redress mechanism to remove addresses from the list. Therefore, these practices are fundamentally incompatible with the rule of law." — Disruptive Competition Project analysis, May 2026.

LaLiga president Javier Tebas has insisted the measures are proportionate and estimates online piracy costs Spanish football €600, 700 million per season. LaLiga's own data, however, acknowledges the blocks successfully prevent only approximately 60% of pirated streams. Sophisticated infringers adapt through VPNs and IP hopping. Ordinary users lose access to their bank.

The April 29 initiative calls for incorporating technological proportionality, graduated measures, and third-party protections into Spain's Digital Services Act framework. Non-legislative initiatives direct the government to pursue reform but do not change the law on their own. The December 2024 court order remains in effect. The 2024/25 season ends 24 May 2026. When the new season begins in August, the blocks resume unless a court rules otherwise.

For every Spanish startup or developer routing traffic through shared CDN infrastructure, the parliamentary vote is the first sign that the state recognises the problem. It is not yet a solution.