Spain's Soccer Piracy Blocks Are Taking Down Banks, GitHub, and the U.S. Government
A Spanish court handed La Liga the power to block thousands of IP addresses every weekend — no judge required. Banks, GitHub, and the U.S. government's own website have all gone dark on football Saturdays. Not content with that, Madrid has now summoned Cloudflare's CEO as a criminal suspect.
One Saturday in February, Americans clicking to Freedom.gov found the U.S. government's portal blocked — not by hackers, not by cyberwarfare, but by a Spanish soccer league's court order. The incident, confirmed by TechRadar and Proton VPN, lays bare how a legal framework can hand a private sports organization the power to block IP addresses at will.
The disruption traces to a December 2024 ruling by Barcelona Commercial Court No. 6, which granted La Liga "dynamic injunctions." These injunctions let the league demand real-time IP blocking from Spanish internet providers without a judge's fresh signature for each block. Under that framework, La Liga blocks roughly 3,000 IP addresses every weekend during match periods.
The technical architecture amplifies the wreckage. Cloudflare uses shared anycast IP addresses, where a single IP can host hundreds of thousands of domains. When Spanish ISPs block entire IP ranges rather than filtering at the domain level, the collateral damage spreads far beyond piracy sites. Casualties have included Madrid City Council's website, banking apps, Microsoft services, GitHub, and Docker.
"We cannot guarantee that your assigned IP addresses are not blocked by any country or ISP," Cloudflare's community team wrote in February. "Cloudflare does not offer dedicated or exclusive IP addresses for users on Free, Pro, or Business plans."
The campaign has since reached VPN providers. On Feb. 17, Spain's Commercial Court No. 1 of Córdoba ordered NordVPN and ProtonVPN to block 16 IP addresses linked to illegal La Liga streams. The order came through "inaudita parte" proceedings — the VPN providers were absent, with no chance to defend themselves.
"We were not part of any Spanish judicial proceedings to our knowledge, and therefore had no opportunity to defend ourselves," NordVPN spokesperson Laura Tyrylyte said. "Given such judgments' impact on how the internet operates, such an approach by rightsholders is unacceptable."
Proton VPN General Manager David Peterson called the situation "bizarre," adding that indiscriminate blocking "is something that you don't expect from a Western country."
The most consequential move came March 4, when Madrid Investigating Court No. 50 summoned Cloudflare CEO Matthew Prince to appear April 7 as a suspect in criminal proceedings. The court alleges intellectual property offenses, threats, and obstruction of justice, with damages totaling €859 million — the first time a global tech executive has faced criminal charges for enabling third-party content through shared infrastructure.
La Liga has backed the offensive with sweeping accusations. In a February 2025 statement, the league asserted that Cloudflare is "actively enabling illegal activities such as human trafficking, prostitution, pornography, counterfeiting, fraud, and scams." The allegations remain unsubstantiated.
La Liga president Javier Tebas took to X in January to compare Prince to Venezuelan dictator Nicolás Maduro, dubbing him the "Narco Maduro of the Internet." Tebas has framed the conflict as a battle against crime, not censorship.
The economics invite scrutiny. La Liga recently sold domestic audiovisual rights for over €6 billion through the 2031-32 season. Yet the league simultaneously seeks €859 million in piracy damages — a figure lacking independent audit and sitting in tension with its own estimate that audiovisual piracy costs Spanish clubs €600–700 million annually.
Vercel CEO Guillermo Rauch has described the blocking as "unaccountable internet censorship," noting that Vercel's IPs remained on blocklists even while the company worked with La Liga to remove illegal content. "IPs are being blocklisted wholesale," Rauch said in April 2025.
The European Commission, which reviewed the matter in November, concluded that "the number of reported incidents involving the blocking of legitimate content has been minimal." The assessment remains internal, and no public registry of collateral damage exists.
A private sports league in Spain can now force a U.S. tech company and Swiss VPN providers to comply with its blocking orders — and criminalize those who resist. The legal architecture lets a single entity weaponize national courts to override global internet infrastructure, with minimal judicial oversight and no immediate right of appeal. For every developer, banker, or ordinary citizen who found their tools dark on a football Saturday, that architecture is no longer theoretical.