The Court of Justice of the European Union has held that virtual private networks are lawful technical tools, in a ruling that arose from copyright litigation connected to the writings of Anne Frank.

The Luxembourg-based court delivered its judgment in a dispute with its roots in the Netherlands, where competing claims over rights in the young diarist's wartime texts produced a reference on the legal status of circumvention technologies. The question before the judges was whether the use of a VPN — software that masks a user's location and identity — could itself amount to unlawful circumvention of technological protection measures under the EU Copyright Directive.

The Court said no. VPNs are, in the formulation now circulating widely in coverage of the decision, "lawful technical tools." The court treated the technology as having substantial legitimate uses, and its reasoning signals that rights-holders cannot treat the mere deployment of a VPN as an act of circumvention infringing Article 6 of the directive.

The ruling matters well beyond the Anne Frank context that generated it. The underlying Dutch proceedings concerned efforts to control access to digitised texts whose copyright status had itself been contested for years across European jurisdictions. Whatever the fate of the specific literary claims, the reference gave the CJEU an opportunity to clarify the boundary between protecting works and policing ordinary internet infrastructure.

For practitioners, the practical consequence is straightforward. Clients who operate VPN services, and clients who use them, gain a measure of certainty: the technology does not fall within the circumvention prohibitions of the Copyright Directive merely because it can, in some scenarios, facilitate access to geo-restricted or protected content. Rights-holders, by contrast, must anchor claims to specific infringing acts — reproduction, communication to the public, or targeted circumvention of effective technological measures — rather than to the tools a defendant happened to use. Expect the judgment to feature in disputes involving geo-blocking, access controls, and platform liability, where parties frequently try to characterise everyday technologies as circumvention devices.

The decision also fits a pattern in Luxembourg case law: the Court has repeatedly declined to expand copyright enforcement mechanisms to cover general-purpose technologies, keeping the directive's anti-circumvention regime tied to measures genuinely designed to protect works. Lawyers advising technology companies will read the ruling alongside that line of authority when assessing exposure under EU law.

The judgment dates from the Court's November 2024 sitting and has drawn attention across European media precisely because the underlying dispute involved one of the most closely watched literary estates on the continent. Its significance, however, lies in the holding on VPNs, which applies across the European Union in any national proceeding where a party alleges that use of a virtual private network constitutes unlawful circumvention.

National courts in the member states are bound to apply the interpretation. Dutch courts handling the remainder of the Anne Frank dispute will do so first, but the reasoning travels to every jurisdiction applying the Copyright Directive.