The Court of Justice of the European Union has held that virtual private networks are lawful technical tools, delivering the finding in a copyright dispute concerning texts associated with Anne Frank.

The decision addresses a question that has grown more pressing for rights holders and technology providers alike: whether the use of a VPN — software that routes a user's internet traffic through a server in another jurisdiction, often masking location and identity — can itself constitute a copyright infringement or amount to circumvention of technological protection measures.

The Court answered in the negative. VPNs, the EU Court made clear, are neutral instruments of network security and privacy. The operative language of the ruling characterises them simply as lawful technical tools. The technology serves a wide range of legitimate purposes: securing connections on public networks, protecting corporate communications, and allowing users in different member states to access services available to them.

What the case concerned

The dispute arose from efforts to enforce copyright in writings connected to Anne Frank, the diarist who died in the Bergen-Belsen concentration camp in 1945. Her diary is among the most litigated literary works in Europe, with the question of when the texts entered the public domain having produced conflicting national rulings for decades.

In this instance, the enforcement action touched on the role of VPNs because the technology can be used to reach online publications of the disputed texts from jurisdictions where they remain protected. Rights holders argued, in essence, that facilitating such access should carry legal consequences for the providers or users of VPN services.

The EU Court rejected that reasoning. It drew a line between the tool and the infringing act. A VPN provider does not itself commit copyright infringement merely by supplying software capable of being used — lawfully or unlawfully — by others. The same logic applies to users who deploy VPNs for ordinary privacy and security purposes.

Practical consequences for practitioners

For lawyers advising technology companies, the ruling provides a degree of certainty that has been lacking at the intersection of copyright enforcement and privacy technology. VPN providers operating in the EU can now point to an express judicial statement that their core product is a lawful technical instrument. Claims that seek to hold such providers liable solely on the basis that their software can be misused will face a high bar. Enforcement strategy must instead target the actual infringers — those who upload, reproduce or disseminate protected works — rather than the neutral infrastructure they may use along the way. For rights holders, the judgment narrows the toolkit: geoblocking enforcement against anonymous or rerouted traffic will need to rely on other legal theories, such as communication to the public under the InfoSoc Directive, rather than on arguments that VPN use is per se unlawful.

The broader context

The decision sits within an established line of EU case law that distinguishes neutral technology from infringing conduct. European courts have repeatedly held that providers of dual-use services — hosting platforms, search engines, connectivity services — do not automatically incur liability for the misconduct of users. The VPN ruling extends that principle to privacy software specifically.

The judgment also arrives at a moment of heightened regulatory attention to VPNs across Europe, where national authorities have occasionally moved to restrict access to such services on other grounds. A ruling from the EU's highest court confirming the lawfulness of VPNs as a category carries weight well beyond the copyright context.

For the Anne Frank litigation itself, the copyright questions remain live and contentious, and the ruling resolves the VPN issue without ending the underlying dispute over the status of the texts.

Legal teams on both sides will now assess how the holding shapes venue strategy, evidence gathering and the framing of future claims. What the Court has settled is narrower but significant: in EU law, the tool is not the wrong.