The CJEU Anne Frank judgment and its broader implications (including for the internet and, obviously, AI too)

A few days ago, the Court of Justice of the European Union (CJEU) issued its judgment in Anne Frank, C-788/24, a referral from the Netherlands concerning the right of communication to the public under Article 3(1) of the InfoSoc Directive and liability for the online publication of a work – The Diary of Anne Frank – partly protected in some Member States but in the public domain in others.

Despite its peculiar and specific factual background, the resulting judgment is an important one and has at least 3 broader implications:

• How consent or lack thereof needs to be exercised on the internet;
• Whether targeting is needed or mere accessibility is enough to trigger the application of a Member State’s copyright law; and
• Liability of VPN providers.

The Court’s response? Read on!

Background

As The IPKat reported at the time when the Opinion of Advocate General (AG) Rantos was published, the referral was made in the context of litigation concerning alleged infringement of copyright in The Diary of Anne Frank in the Netherlands (where the Diary is still partly a copyright work) through its publication made in Belgium (where the Diary is no longer protected) on a website that is geoblocked from countries where the work is still protected (including the Netherlands).

The national proceedings eventually reached the Dutch Supreme Court, which decided to stay them and seek guidance from the CJEU on 2 main issues:

1. Whether it is an act of communication to the public under Article 3(1) of the InfoSoc Directive to publish a work that is still protected in certain Member States but not others on the internet, if the geoblocking measures adopted by the website operator in question can be circumvented by the website users;
2. If so, who undertakes the act of communication to the public: is it the website operator or the provider of the means (e.g., VPN) allowing for the geoblocking measure to be circumvented?
   

1. Whether the online publication of a work protected in some Member States but not others is an act of communication to the public in a Member State where it is protected

Regarding the first issue, the CJEU started by recapping the requirements under Article 3(1) of the InfoSoc Directive, and preliminarily concluded that the online publication of the Diary would qualify as an act of communication to the public.

That said, in the present case (which concerns, as stated, a work partly protected in some Member States but not others) what matters is whether the ‘public’ encompasses internet users in Member States like the Netherlands, given the presence of a geoblocking measure.

As a result, the Court turned to Article 6 of the InfoSoc Directive. It recalled previous case law – notably Nintendo [IPKat here, here, here] and VG Bild-Kunst [IPKat here, here, here; my own extended case analysis here] – and noted that online consent cannot but be limited through the implementation of effective technological measures. That is needed to ensure legal certainty and the smooth functioning of the internet.

Applying all the above analogically to the present case, the Court agreed with the position expressed by AG Rantos in his Opinion (and, before him, AG Szpunar in his Opinion in Grand Production): whether the website operator has performed an act of communication to the public in the Netherlands would depend on the effectiveness of the technological measures (that is: geoblocking) implemented to restrict access from that Member State. The effectiveness of the measure in question would need to be assessed against the guidance provided in Nintendo and in light of technological advancements.

While it is for the referring court to make such a determination, the CJEU noted the insufficiency of a measure (like the one at issue here) by which an internet user would simply need to declare/acknowledge that they are accessing the website from certain Member States and not others.

2. If there is a communication to the public, who’s responsible for it?

Turning to the second issue concerning the attributability of the act of communication to the public, the Court concluded that it would be the operator of the website that implemented ineffective technological measures that should be responsible under Article 3(1) of the InfoSoc Directive:

That is so because the VPN provider would not undertake an ‘indispensable role’ within the meaning of Article 3 of the InfoSoc Directive and would be actually ‘saved’ by recital 27 instead ("The mere provision of physical facilities for enabling or making a communication does not in itself amount to communication within the meaning of this Directive.")

Comment

The judgment largely follows the earlier AG Opinion and, despite its peculiar factual background, has broader consequences.

I will limit myself to briefly highlighting 3 of them here.

The first is the confirmation on the side of the Court that Nintendo and VG Bild-Kunst are ‘good (case) law’. On the internet, the implementation of effective technological measures is necessary to determine the existence and type of consent. It is difficult not to read this part of the judgment with the rights reservation possibility under Article 4(3) of the DSM Directive in mind. The judgment indirectly indicates how such rights reservation needs to be done.

The second is that the Court implicitly dismisses any decisive relevance of targeting of a certain Member State. Yes, the language version of the Diary published by the defendant is Dutch, but the Court – like the AG – did not really consider this element in detail. What appears to matter is whether there is accessibility from the Netherlands, not targeting thereof. This is a very important point, including having regard to Artificial Intelligence and the ‘ambition’ of provisions like Article 53 of the AI Act. Interested in reading more on this? See here.

The third concerns the attributability of acts of communication to the public. The Court dismissed the idea that a VPN provider would in itself perform an act of communication to the public. However, the Court did not say that a VPN provider could never be liable. Liability could for example subsist under national laws in the form of secondary/accessory/indirect liability. This, however, would be something for the referring court to determine. It is just the case that – as AG Szpunar also recalled in crystal-clear terms in his Opinion in Louboutin – secondary liability remains unharmonized and, thus, a matter of Member States’ own laws.

[Originally published on The IPKat on 19 July 2026]