Spain's Internet Censorship Is a Cartel Enforcement Operation. The Stock Market Knows.

On a Saturday in February, Americans clicking to Freedom.gov found the U.S. government's portal blocked. Not by hackers. Not by a foreign adversary. By a Spanish soccer league's court order.

The incident was confirmed by TechRadar and Proton VPN, and it is not an isolated glitch. It is the logical output of a legal and economic architecture that Spain has spent three decades building — one in which privatization was always a performance, judicial independence was always negotiable, and the internet was always going to be the next frontier to bring to heel.

The Mechanics of the Block

The disruption traces to a December 2024 ruling by Barcelona Commercial Court No. 6, which granted La Liga "dynamic injunctions" — the power to demand real-time IP blocking from Spanish ISPs without a fresh judicial signature for each block. La Liga and Telefónica Audiovisual (Movistar Plus+) filed the blocking campaign jointly, but La Liga president Javier Tebas directs the blocks himself from his own war room — a detail that reveals everything about the nature of this operation. This is not a legal mechanism administered by courts. It is a private enforcement apparatus with a judicial rubber stamp.

The technical damage spreads far beyond the intended targets. Cloudflare uses shared anycast IP addresses, where a single IP can serve hundreds of thousands of domains. When Spanish ISPs block entire IP ranges rather than filtering at the domain level, the collateral destruction spreads indiscriminately. Services running behind Cloudflare, BunnyCDN, Vercel, and GitHub all fall in the crossfire — confirmed casualties include Madrid City Council's website, banking apps, Microsoft services, Steam's 132 million monthly active users, the Royal Spanish Academy's website, and the United States government's Freedom.gov portal.

The original court order listed 123 IP addresses but allows additional "successor" addresses at La Liga's and Telefónica's discretion. Tebas himself has stated that around 3,000 IPs are currently being blocked, of which between 35 and 45 percent belong to Cloudflare. No judge reviews the expanded list. No independent body audits the targets. Tebas decides, and Spain's ISPs comply.

The campaign has since expanded to VPN providers. On February 17, 2026, Spain's Commercial Court No. 1 of Córdoba ordered NordVPN and ProtonVPN to block 16 IP addresses linked to alleged La Liga streams. The order was issued inaudita parte — the companies were not present, were not notified, and had no opportunity to defend themselves.

"We were not part of any Spanish judicial proceedings to our knowledge, and therefore had no opportunity to defend ourselves," NordVPN's Laura Tyrylyte said. Proton VPN General Manager David Peterson called the situation "bizarre," adding that this kind of indiscriminate blocking "is something that you don't expect from a Western country."

It escalated further on March 4, 2026, when Madrid Investigating Court No. 50 summoned Cloudflare CEO Matthew Prince to appear on April 7 as a criminal suspect — the first time a global tech executive has faced criminal charges for enabling third-party content through shared infrastructure. La Liga's accusations against Cloudflare include "actively enabling human trafficking, prostitution, pornography, counterfeiting, fraud, and scams." The allegations are unsubstantiated. Tebas compared Prince to Venezuelan dictator Nicolás Maduro on X, calling him the "Narco Maduro of the Internet."

What This Looks Like From the Inside

Codely is a Spanish software education platform — a small company selling programming courses to developers and businesses. It has nothing to do with football. It has nothing to do with piracy. Since February 2025, La Liga's blocks have routinely taken down Codely Pro, the platform's learning portal, because it runs on Cloudflare infrastructure.

When the platform goes dark, users see a loading screen that never resolves. Most don't understand why. What they think, understandably, is that Codely is down — and the reputational damage lands squarely on Codely. The company has been forced to publish a help page explaining to its paying subscribers how to install a VPN just to access content they already paid for.

Codely's team puts it plainly: even granting La Liga's premise that they are a website "for four nerds," those nerds deserve the service they paid for. They add that they find it unconscionable for any entity to decide that protecting its streaming revenue justifies collateral damage to every business caught in the crossfire.

But what makes Codely's situation genuinely enraging is not just the blocking — it is what happens when businesses push back. A small online gymnastics equipment retailer, LB Store GR, complained on social media that La Liga's blocks were preventing customers from reaching her shop during football weekends. La Liga's response was a certified letter threatening civil and criminal legal action unless she personally demanded that Cloudflare stop broadcasting La Liga content from an IP address that happened to be shared with her shop. La Liga informed her that by failing to do so, she was "deliberately failing to comply with her obligations in relation to the commission of crimes."

A gymnastics equipment store. Threatened with criminal charges. For sharing an IP address.

RootedCON, Spain's largest cybersecurity conference, filed a formal petition with the court to reconsider the indiscriminate blocks. The judge rejected it.

Movistar's Particular Contempt

Not all ISPs implement the blocks equally. Among Spain's major carriers, Movistar — Telefónica's consumer brand — stands out for a pattern of behavior that goes well beyond legal compliance into something that looks remarkably like contempt for its own customers.

While other operators lift blocks promptly when matches end, Movistar has repeatedly been the last to restore service — sometimes leaving blocks active until 9:30 the following Monday morning. Movistar routes blocked IPs to a black hole, meaning connections simply hang with no response and no explanation to the user, causing maximum confusion for anyone trying to diagnose the problem. Digi, by contrast, at least shows users a message identifying La Liga as the responsible party.

The most recent episode is particularly telling. During the 29th matchday weekend, every other operator — MásOrange, Vodafone, and Digi — lifted their blocks when the last match ended. Movistar did not. It left 84 IP addresses from multiple cloud providers inaccessible through the following Monday morning, making the outage visible during normal working hours with no matches scheduled and no legal basis for the continuation of the block.

When the situation was reported, Telefónica's technicians eventually fixed it — but only after the damage was done and the story was public.

This is not a technical failure. A company with Telefónica's resources does not accidentally leave 84 IP addresses in a black hole through a Monday morning. This is a culture — one in which the inconvenience to customers is simply not a factor that anyone at Movistar is required to weigh.

This Is Not About Piracy

La Liga recently sold domestic audiovisual rights for over €6 billion through the 2031–32 season. It simultaneously asserts €859 million in damages from piracy — a figure without independent audit that contradicts its own estimate that piracy costs Spanish clubs €600–700 million annually. The league seeks more in damages from a single infrastructure provider than it says the entire piracy ecosystem costs it per year.

These numbers are not meant to be scrutinized. They are meant to intimidate.

The blocking regime carries judicial authority through the end of the 2026–27 season. To continue beyond that, La Liga will need a new court order — and if Telefónica wins the next rights auction, the ISP will be contractually obligated not just to implement the blocks but to actively support La Liga in court to extend and expand them, targeting VPNs, proxies, and DNS providers.

What this is actually about is a broadcasting monopoly protecting its revenue model — and a state apparatus willing to provide the tools to do it.

The Company That "Privatized" But Never Left

Telefónica was privatized by the Spanish government in the late 1990s. The scare quotes are warranted. The Spanish state has retained significant influence over the company's strategic direction, its regulatory environment, and — as the Cloudflare episode makes clear — the judicial machinery deployed in its interests.

Telefónica's pay-TV arm, Movistar Plus+, is not merely a participant in Spanish football broadcasting. It is Spanish football broadcasting. Movistar Plus+ is the largest subscription TV provider in Spain, with 3.8 million customers and roughly 45 percent market share. Its average revenue per user runs at €90.70 per month — nearly double that of competitors like Vodafone and MásOrange, sitting around €50. That premium is almost entirely football-driven.

Together with DAZN, Telefónica pays a combined €1.05 billion per season for La Liga top-flight rights alone. It also holds exclusive Champions League, Europa League, and Conference League rights in Spain through to 2031. Every major live sporting event in Spain flows through Movistar Plus+ and its partners.

This is the business Spain's courts protect when they block Cloudflare's servers on a Saturday afternoon. Not a principle. Not intellectual property as an abstract legal value. A subscription revenue stream — one whose defense Tebas personally oversees from a war room, in real time, every football weekend.

What the Stock Market Quietly Knows

The most damning commentary on all of this comes not from a journalist or a regulator, but from the market itself.

Telefónica currently trades at a price-to-book ratio of 0.93 to 0.95. That means investors value the company at less than the stated worth of its own assets. For a company with a near-monopoly on premium live sport in its home market, exclusive UEFA rights through 2031, and a subscriber ARPU that dwarfs its competitors, that is not a valuation. It is a verdict.

Compare it to the landscape of its peers. T-Mobile trades at a price-to-book of over 4.0. Verizon, long derided as a lumbering incumbent, trades at roughly 1.95. AT&T — burdened by years of disastrous acquisitions — trades at around 1.59. Even Comcast, whose stock has spent years going nowhere, clears 1.0. Deutsche Telekom, another semi-state European incumbent still partially owned by the German government, trades at a significant premium to book — because it owns a controlling stake in T-Mobile US, a company that actually has to compete.

The pattern is not subtle. When a telecom must fight for customers in an open market, investors price in growth and future returns. When the state that nominally sold it off shields it from competition, investors see through the fiction and price it accordingly. Telefónica is a company whose monopoly position is maintained not by innovation or customer value, but by regulatory capture — and the market has known this for years.

A P/B below 1.0 on a company holding exclusive rights to every major sporting event in the country is the market saying, politely but clearly: this is not a business. It is a toll booth with a government contract.

The Architecture of Capture

Spain's media landscape cannot be understood separately from this. Every major outlet operates within a web of dependencies — advertising relationships, broadcast licensing, political access — that makes systemic criticism of Telefónica's position, or of the judicial mechanisms protecting it, effectively off the table. There are no Spanish newspapers running the P/B comparison above. There are no Spanish broadcasters interrogating why a commercial court in Barcelona can unilaterally block the U.S. government's internet portal on behalf of a sports association.

When the government has been forced to respond to parliamentary questions about the collateral damage, it has deflected — first claiming no complaints had reached the Ministry of Culture, then acknowledging it was "maintaining active dialogue" with affected parties while insisting the matter was judicial and therefore outside its competence. The Ministry of Telecommunications, meanwhile, signed a cooperation agreement with La Liga in January 2026 — framed around "cybersecurity culture" — while the blocks continued and expanded.

Vercel CEO Guillermo Rauch described what is actually happening as "unaccountable internet censorship," noting that Vercel's IPs were blocklisted despite a dedicated communication channel with La Liga. "IPs are being blocklisted wholesale," he said. The framing matters: this is not surgical enforcement of intellectual property law. It is infrastructure-level coercion, executed through a judicial system made available for the purpose, administered in real time by a man running a private war room.

A private sports organization in Spain can now force a U.S. tech company and Swiss VPN providers to comply with its blocking orders — criminalize those who resist — send threatening legal letters to gymnastics equipment retailers — and leave 84 cloud IP addresses in a black hole through Monday morning — all without any of those affected parties having had a meaningful opportunity to defend themselves in court.

A country that cannot produce a telecom worth more than its own assets on paper has found another way to extract value from its infrastructure. It just needed a soccer league, a compliant judiciary, and the quiet understanding that nobody in the press was going to ask the obvious question.

The blocks go up on Saturday. They come down — if Movistar remembers — sometime Monday. The market has already priced in what kind of country does this. The only ones who haven't noticed are the ones who'd have to report it.