This blog is served from Cloudflare's edge, which means that if you tried to read it from Spain on a weekend sometime in the last eighteen months, there is a real chance it simply didn't load. Nothing here would have broken. Somewhere on an IP address this site shares with a few thousand strangers, someone was streaming a LaLiga match without paying for it, and Spain's largest ISPs — acting on a court order the league obtained in December 2024 — blocked the whole address until the final whistle. The order runs to the end of the 2026/27 season , the one that kicked off three weeks ago, and every August since it was granted the blocks have come back with the fixture list.
The mechanism deserves precision, because its bluntness is the story. The order — sought jointly by LaLiga and Telefónica Audiovisual Digital, the broadcaster paying €1.29 billion for domestic rights through 2026/27 — lets the league hand ISPs lists of IP addresses to block during match windows, with no per-address judicial review and no procedure for anyone wrongly swept up to get themselves out. Everyone involved knows what a shared CDN address is: block one and you take down every site behind it, ignoring SNI and making no effort to distinguish between hosts , as Vercel put it. The collateral isn't a targeting error, it's the accepted cost of the method — accepted, specifically, by a Barcelona commercial court that dismissed Cloudflare's challenge in March 2025 on the reasoning that no evidence had been presented that the blocking caused any damage .
The evidence arrived anyway, in the form of network measurements. In June, OONI published six months of data from Spanish vantage points, January to June 2026: 554,510 domains — roughly 5.8 percent of the 9.2 million most popular domains on the internet — were blocked in Spain at some point during LaLiga broadcasts. Blocking as few as 4 to 20 addresses in a one-hour window took over 400,000 domains down with them; Cloudflare's shared infrastructure accounted for 501,305 of the affected domains, ninety percent of the total, from just 2,218 blocked addresses. The measurements show restrictions switching on before kickoff and off after full-time — internet reachability with a fixture list. And the casualties read like a random sample of the internet because that is statistically what they are: Docker Hub went dark across Spain on April matchdays , which meant CI pipelines failing because of a football match; the US State Department's Freedom.gov portal was caught, along with the Australian Senate, Linux Mint, and Amnesty International chapters . One ISP, Digi, went a step past blocking and served self-signed certificates in a TLS man-in-the-middle configuration across 10,759 domains — a live security failure introduced in the name of rights enforcement.
The infrastructure companies fought this publicly, and mostly lost. Vercel named the two blocked IPs and the innocent customers sitting on them — Tinybird, a Spanish data startup, and Hello Magazine — called the practice "an unaccountable form of internet censorship," and got the addresses unblocked in mid-April 2025; within a month LaLiga blocked Vercel again , collaboration notwithstanding. Cloudflare, having exhausted the ordinary courts, has taken the question to Spain's Constitutional Court . The league's own account of the same period is that blocking cut piracy 40 to 60 percent, "without collateral impact" . Both sides cannot be describing the same internet, and OONI's probes say which one is.
What makes this more than a Spanish curiosity is the direction of travel. In February 2026 a Córdoba court extended the enforcement perimeter to VPNs, ordering NordVPN and Proton VPN to block addresses during match windows — a striking demand of tools Spaniards were by then buying specifically to reach the legal internet on Saturdays , with Proton reporting demand spikes of 200 percent — though the same court later declined to fine NordVPN for non-compliance, one of the few walls the campaign has hit. In November 2025 LaLiga made ISP participation in the blocking a condition of bidding for its broadcast rights , converting a court order into a commercial term. And it is lobbying Brussels to make the model an EU-wide standard, where the Commission has so far judged reported overblocking "minimal in comparison to the total number of dynamic blocking measures" — a conclusion OONI's half-million domains sit uncomfortably beside. Spain's own legislature is less sure: a proposal to protect innocent sites was rejected in October 2025 , but this April a congressional commission voted to rein the regime in — not yet statute, and none of it has stopped a single matchday block.
Strip out the legal drama and what remains is an economics question wearing an enforcement costume. The order is not football defending itself in the abstract; it is a broadcaster defending a €1.29 billion rights bill against the observable fact that large numbers of people will not pay the current price to watch Spanish football legally. Piracy at that scale is what unmet demand looks like, and IP blocking is what defending the price looks like when repricing is off the table — enforcement conducted at internet-infrastructure altitude precisely because that is the only layer where the demand can be made to disappear rather than be served. The strange thing is that the rest of the market spent the same two years running the opposite experiment: while LaLiga was blocking half a million domains to protect a paywall, DAZN paid roughly a billion dollars for a World Cup-sized tournament and streamed every match free. What "free" is actually selling — and who is paying for it — is the next post.
No comments yet