Copyright protection is fundamentally territorial in nature. Although copyright law has been substantially harmonised across the European Union, copyright remains a bundle of national rights whose existence, scope and duration are determined by the law applicable in each Member State. This structure sits uneasily with the inherently borderless nature of the internet. Content made lawfully available online in one Member State can potentially be accessed almost instantaneously from another. This becomes problematic where a work has entered the public domain in one Member State but remains protected by copyright in another. Can a work be lawfully placed online for users in the former while remaining technically capable of being accessed from the latter? Does the availability of virtual private networks (VPNs), which can circumvent geographical restrictions, make such territorial differentiation legally ineffective?
The Court of Justice of the European Union (CJEU) tackled these questions in its judgment of 9 July 2026 in Anne Frank Fonds v Anne Frank Stichting and Others (Case C-788/24). Its answer is both technologically pragmatic and legally significant: effective geo-blocking can define and restrict the group of internet users to whom an online work is communicated, and the mere possibility that such restrictions may be circumvented using a VPN does not necessarily result in a communication to the public in the protected territory.
Background facts: From Anne Frank's manuscripts to a question of territoriality
The dispute concerned a scholarly digital edition of Anne Frank's manuscripts published online in 2021 by the Anne Frank Stichting and other institutions. Although the relevant works had entered the public domain in a number of Member States, including Belgium, parts remained protected by copyright in the Netherlands until 2037.
The website was operated through a Belgian domain and made the manuscripts available free of charge. Crucially, however, its operators implemented geo-blocking intended to prevent access from jurisdictions where copyright continued to subsist. A user connecting from the Netherlands would therefore ordinarily be denied access. Nevertheless, the Anne Frank Fonds, which holds the relevant copyright, argued that the publication infringed its rights in the Netherlands because Dutch users could circumvent the geo-block through VPNs and similar technologies.
The resulting preliminary reference required the CJEU to consider the concept of "communication to the public" under Article 3(1) of Directive 2001/29/EC (InfoSoc Directive) and, in particular, whether an online communication could be regarded as occurring within a protected Member State despite technological measures intended to exclude users located there.
The difficulty underlying the dispute was significant. If the mere technical possibility of circumvention were sufficient to establish communication in the Netherlands, a work that had entered the public domain across most of the EU might effectively have to be withheld throughout the Union merely because copyright continued to subsist in one Member State. Conversely, accepting nominal geographical restrictions irrespective of their effectiveness could substantially undermine the rights enjoyed by copyright holders in territories where protection remained.
Geo-blocking and the relevant 'public'
Article 3(1) of the InfoSoc Directive grants authors the exclusive right to authorise or prohibit any communication of their works to the public, including making them available online. The CJEU reiterated that the concept must be interpreted broadly and involves two cumulative elements: an "act of communication" and the communication of that work to a "public". There was little difficulty in finding that placing the manuscripts online constituted an act of communication. The more difficult issue was whether users situated in the Netherlands formed part of the public to whom that communication was directed.
Drawing on its earlier judgment in VG Bild-Kunst (Case C-392/19), the Court recognised that technological measures may objectively define the circle of internet users to whom a work is made available. Where effective technological measures restrict access to particular users, they can therefore be relevant to identifying the intended public.
Geo-blocking based on geographical location and IP address is capable of constituting such a technological measure. This gives technology a substantive role in copyright analysis. Geo-blocking is not simply an operational mechanism controlling website access; properly implemented, it may determine whether an act falling within the copyright holder's exclusive rights has occurred in a particular territory.
'Effective' does not mean impenetrable
The most practically significant aspect of the judgment concerns what makes a technological measure "effective". The CJEU rejected the proposition that geo-blocking ceases to be effective simply because a VPN may circumvent it. Effectiveness does not require technological invulnerability. Rather, the assessment must take account of whether the measure is suitable for achieving its protective objective, together with factors including technological developments, available alternatives, their costs and the practical consequences of implementation. A "state of the art" geo-blocking mechanism capable, in its normal operation, of preventing users connecting from the protected Member State from accessing the work may therefore be effective notwithstanding the possibility of circumvention.
The approach is commercially and technologically realistic. VPNs are widely available and virtually any location-based restriction may potentially be circumvented by a sufficiently determined user. If the mere existence of circumvention techniques rendered geo-blocking legally ineffective, territorial restriction of online copyright content would become exceptionally difficult, if not impossible.
Importantly, however, a warning or declaration is not equivalent to a technological restriction. Requiring users simply to declare that they are accessing content from a territory where the work is in the public domain depends on their honesty and cannot, by itself, amount to an effective technological measure. Contractual or declaratory restrictions may supplement technological controls, but they cannot substitute them.
What happens where the technology is inadequate?
The judgment does not provide publishers with a blanket defence merely because some form of geo-blocking has been deployed. The measure must actually satisfy the required standard of effectiveness. Where effective measures have not been implemented, the communication may be attributable to the publisher in the protected territory. Whether the particular system used was sufficiently effective ultimately remains a factual assessment for the national court.
This has an important evidential consequence. Future copyright disputes involving territorial online dissemination are likely to turn increasingly on technical evidence: whether IP-based restrictions were appropriately configured and maintained, whether the technology used reflected contemporary standards, and whether reasonable steps were taken to address known methods of circumvention.
Conclusion: A pragmatic approach to digital territoriality
Anne Frank Fonds does not resolve the inherent tension between territorial copyright and global internet access. It does, however, reject two problematic extremes. A publisher cannot merely upload content and state that users in protected territories are not intended to access it. Genuine technological measures are required. Equally, a rightholder cannot insist that those measures must be impossible to circumvent before they acquire legal significance.
What matters is not simply whether cross-border access is theoretically possible, but whether effective and contemporary technological measures have been adopted to exclude the protected territory from the public to whom the work is made available.
For Malta, where businesses frequently provide digital services across borders from a comparatively small domestic market, that distinction is particularly relevant. The concepts considered by the CJEU are reflected in the Copyright Act (Chapter 415 of the Laws of Malta), which recognises the exclusive right of copyright holders to authorise or prohibit communication of their works to the public, including online making available. Maltese copyright legislation also expressly recognises technological measures and provides protection against their unlawful circumvention. The CJEU's interpretation will consequently be important for Maltese businesses and organisations operating across borders, including publishers, broadcasters, gaming and digital-service operators, educational institutions, archives and cultural organisations. The judgment offers greater legal certainty to operators seeking to structure territorially differentiated online offerings, while preserving the ability of rightholders to enforce their rights where technological restrictions are absent or inadequate.
Ultimately, the CJEU has recognised a practical reality: preserving territorial copyright online cannot depend on digital borders being impenetrable. It can, however, require those relying on those borders to ensure that they are reasonably and technologically effective.
Michela Zammit Lupi is an Associate at Ganado Advocates within the IP and TMT department. The author wishes to thank Ryan Caruana, Legal Intern within the same department for his invaluable help with drafting this article.
This article is for informational purposes only and does not contain or convey legal advice. The information contained in this article should not be used or relied upon in regard to any particular facts or circumstances without first obtaining legal advice.