Websites get blocked in Spain every week. That’s nothing new: the court order that forces an ISP to cut access to a domain has existed for more than a decade. What has changed over the last two years is the instrument. Blocking has shifted from targeting specific domains to blocking entire IP addresses during set time windows, and those IP addresses almost never belong to a single service. The result is that cutting access to a pirated broadcast can leave a payment gateway, a video game, or a store that has nothing to do with football without service for ninety minutes.
This guide pulls together what we’ve published on the subject and puts it in order: what blocking a website technically means, why IP filtering is the bluntest method of all, what collateral damage has been documented, how the major infrastructure providers have reacted, where the judicial and regulatory front stands, and why — in the end — the targeted websites are still there, simply under another domain.
What “blocking a website” actually means
It’s worth starting with the obvious, because it’s almost never explained: a blocking order doesn’t delete anything. The server stays on, the content stays published, and anyone outside Spain keeps accessing it normally. What a block does is put an obstacle between a given ISP’s user and that server. And there are three places where that obstacle can be placed, each with very different cost and precision.
DNS blocking
It’s the oldest and the most surgical. The ISP tampers with its own DNS server’s response: when the user asks for the address of example.com, the ISP’s resolver returns an error or a notice page instead of the real IP. It only affects the flagged domain and touches no one else.
It’s also the easiest to dodge. Just switching the device’s DNS to a public resolver makes the block disappear. That’s why it’s stopped being the preferred method when the target is a live broadcast that only lasts an hour and a half.
SNI blocking
One layer down. During a TLS connection’s initial handshake, the browser announces in the clear which domain it wants to connect to: that’s the SNI field (Server Name Indication). An inspection system on the ISP’s network can read that field and cut the connection without touching DNS at all.
That gap is closing. Encrypted Client Hello (ECH) is now an official IETF standard, and it encrypts precisely that initial handshake. As it rolls out, SNI filtering will stop working, leaving, once again, a single blunt instrument.
IP address blocking
The hammer. The ISP stops routing traffic to a specific IP address, without checking what domain sits behind it. It can’t be dodged by switching DNS, and it works even if the traffic is encrypted end to end.
And that’s the underlying problem, which is purely architectural: on the modern web, an IP address doesn’t identify a site. Behind a single CDN IP there can be tens of thousands of domains sharing the same infrastructure. Blocking the IP is like cutting power to an entire building to evict one tenant.
The Spanish case: how IP blocking became the norm
The escalation has a specific driver: sports broadcasts. Unlike a movie, a match loses nearly all its value after two hours, so the anti-piracy strategy stopped chasing stable domains and started targeting real-time infrastructure instead, with dynamic blocks switched on during the match window and lifted afterward.
On paper, it’s effective. In practice, it has shown just how fragile IP-based internet filtering really is: Movistar users at one point found themselves blocked from domains linked to LaLiga itself. When the instrument hits the very people wielding it, the debate over its precision stops being theoretical.
The pattern isn’t limited to football, either. The CNMC has forwarded court-ordered blocks to every ISP registered with it, in an administrative procedure that has become routine and leaves barely any public trace.
The collateral damage, documented
For months, the official response was that overblocking was anecdotal. The documented cases say otherwise.
- Payments. The intermittent blocking of 3ds.redsys.es from Vodafone’s network exposed how chasing pirate sites is breaking legitimate services — in this case, card payment authentication.
- Video games. Thousands of players were locked out of Blue Protocol by mass blocks of Cloudflare address ranges. Even the sports press covered it.
- Independent measurement. The OONI Foundation has documented the real technical scope of these cuts: the blocks are hitting Spain’s shared internet infrastructure, not just their intended targets.
The cost isn’t limited to the services that go down. It’s also reputational, and it affects the country’s standing as a digital hub: it’s hard to sell data centers, submarine cables, and interconnection while it’s accepted that the internet gets cut over football. A provider weighing where to host a service looks, among other things, at how predictable a country’s network is.
The response from infrastructure providers
The companies that hold up much of the web have moved from silence to open confrontation, and each has chosen a different path.
- Cloudflare has gone further than anyone. First it publicly went after the blocks; then it asked Spanish users to help measure them with a dedicated app; and finally it took the issue to the U.S. Trade Representative, citing Spain as a textbook case.
- Vercel took the operational route: it published its protocol for minimizing collateral damage to customers who share its address ranges.
- Fastly chose the other side of the board and put AI and edge computing at LALIGA’s service, promising finer-grained detection. That’s precisely the test it faces: not taking down half the web along the way.
- Google has taken the fight to Brussels and asked the European Commission for limits on orders targeting IPs, DNS resolvers, VPNs, and CDNs.
The judicial and regulatory front
Here the balance is ambiguous for now, with progress in the courts and a striking gap in oversight.
In the courts, the Commercial Court of Córdoba refused to impose coercive fines on NordVPN and questioned the scope of IP blocking. In parliament, Congress took a first step toward reviewing how they’re applied.
The deadlock is in oversight: the body responsible for policing net neutrality has declared itself not competent to review them. The biggest net-neutrality conflict Spain has seen is, for now, left without a technical referee.
In parallel, enforcement continues through police work and international cooperation, as in Operation KRATOS 2 against illegal IPTV networks, an approach that targets the operator of the service rather than everyone else’s routing.
The workarounds and their ceiling
Every blocking regime produces its own technical response, and in Spain the measurable effect has been growth in the use of privacy tools: VPN usage has risen, pushed by the network blocks. Add to that encrypted DNS resolvers and, once it’s widespread, ECH.
The consequence is awkward for whoever designs the policy: the more aggressive the block, the more users shift to encrypted channels the block can no longer reach, and those users don’t come back afterward. The instrument loses effectiveness against its target while keeping its capacity to cause collateral damage fully intact. It’s the worst of both worlds.
It’s also worth looking at this with some perspective. IP blocking belongs to the same family of tools used in far harsher contexts: Iran went more than ten days with almost no global internet access. The difference is one of degree and purpose, not of mechanism, and that resemblance is exactly why the instrument needs clear limits.
Why blocked sites are still there: the domain shuffle
The question almost no one asks is the most revealing one: after years of blocking orders, what’s happened to the targeted sites? The answer is that they haven’t disappeared — they’ve learned to move.
The pattern repeats: register backup domains in advance, often under country extensions with slow takedown procedures; keep the same server and the same database behind them; and announce the active domain through channels no court order against a registrar can touch, typically messaging apps or social media. When one domain falls, migration is a matter of hours.
The most studied case in Spain is DonTorrent, which has spent years hopping between domains to stay online: in practice, it’s the playbook for this entire strategy. At the opposite extreme is the resistance built into decentralized networks by design, where there’s no domain to block because there’s no central server: eMule is still alive in 2025, more than two decades on, precisely because of that.
It’s worth being clear about what this does and doesn’t mean. A block being technically avoidable doesn’t make it illegitimate, nor does it make downloading copyrighted material legal — the legal and security risks for the user are still there. What it does mean is something more uncomfortable for public-policy design: IP blocking is expensive for innocent third parties and cheap for its target to dodge. Any serious assessment of the tool has to start from there.
What to watch from here
- Whether Brussels sets limits. Google’s request to the European Commission is the most serious attempt yet to formally rein in orders against IPs, DNS, VPNs, and CDNs. If it succeeds, it changes the framework for every member state.
- Whether anyone takes on technical oversight. Until a body exists to verify overblocking before and after every order, the only counterweight is independent measurement.
- Whether transparency gets imposed. Today there’s no public, searchable record of which ranges get blocked and when. Without that data, an affected business can’t even find out why it went down.
- How long ECH takes to roll out. Once TLS handshake encryption becomes the norm, mid-path filtering loses its second-to-last lever, leaving only the IP — the most damaging one.
The conclusion running through all this coverage is easy to state and hard to apply: protecting a legitimate right — that of whoever produces content — can’t be done with a tool that can’t tell who it’s switching off. As long as the instrument stays the IP address, the collateral damage isn’t an implementation bug. It’s a property of the design.
Frequently Asked Questions
How is a website blocked in Spain?
There are three technical routes. By DNS, tampering with the ISP resolver’s response so it doesn’t return the domain’s real address. By SNI, inspecting the domain name the browser announces in the clear when starting a TLS connection. And by IP address, no longer routing traffic to that address regardless of what domain sits behind it. The last one is the bluntest and also the least precise.
Why does an anti-piracy block take down services that have nothing to do with it?
Because on today’s web, an IP address doesn’t identify a single site. Behind a CDN’s IP there can be tens of thousands of domains sharing infrastructure, so blocking the address takes all of them down at once. In Spain, this has been documented with Redsys’s payment authentication on Vodafone’s network and with thousands of Blue Protocol players locked out by blocks of Cloudflare ranges.
What is IP overblocking?
It’s the collateral damage that occurs when an order targeting one specific service ends up cutting access to other legitimate services hosted on the same address or range. The OONI Foundation has documented its technical scope in Spain and concludes that the blocks hit shared internet infrastructure, not just their intended targets.
Who oversees whether blocks in Spain break net neutrality?
For now, effectively no one. The body responsible for overseeing net neutrality has declared itself not competent to review these blocks, leaving Spain’s biggest net-neutrality conflict without a technical referee. The only available counterweights are independent measurements and case-by-case court rulings.
Why are blocked websites still accessible under another domain?
Because blocking doesn’t remove anything: the server stays on and the content stays published. Targeted sites register backup domains in advance, keep the same infrastructure behind them, and announce the active domain through channels an order against a registrar can’t reach. Migration after a takedown is a matter of hours.
Do VPNs and encrypted DNS make blocks useless?
They cut their effectiveness a lot. DNS blocking is dodged by switching resolvers, and SNI filtering will stop working as ECH — already an official IETF standard — rolls out. In Spain, VPN use has grown, pushed by the blocks. The net effect is that the tool loses reach against its target while keeping its capacity for collateral damage fully intact.
