With the start of every football season, one of the most aggressive digital filtering mechanisms in Europe also comes back. Backed by court rulings, LaLiga, the employers' association chaired by Javier Tebas, orders Spanish operators to block in real time hundreds of IP addresses allegedly linked to the illegal broadcasting of matches.
The initial aim is to curb piracy, but the real effect is another: the internet does not work with dedicated servers for each website, so when an IP is cut off it drags down with it a whole range of services that have nothing to do with football. In other words, LaLiga has court-granted rights that allow it to submit lists of IPs and have them blocked in Spain. And this clearly runs counter to the principle of net neutrality.
The crux of the problem is that not every website or online service has its own IP address as if it were an ID number. There are services that host multiple websites under a single parent address and this is where the problems begin, because when that address is blocked, all the services and websites hanging from it also stop working. It is collateral damage for any internet user who tries to access them while a match is being played.
To illustrate the problem, it is as if someone were to say that in Madrid (the hosting service) there is at least one resident, among the millions of people in the city, who is stealing electricity (pirating LaLiga's IPTV signal), and so they order the power to be cut off across the whole city.
In an interview, Tebas even claimed that there were no mass blocks and that the complaints they were receiving came from "four geeks". The facts, however, speak for themselves, with blocks that do affect third-party services and between 500 and 1,000 IPs being blocked per match.
How do the blocks work?
The blocking starts shortly before kick-off and is lifted once the broadcast ends. LaLiga identifies IP addresses associated with pirate services and asks operators to cut them off during that time slot. On the opening matchday of the 2026-2027 season, 15 August 2026, some 550 IP addresses were blocked simultaneously. Since then, the blocks have continued every matchday.
The Open Observatory of Network Interference (OONI) estimates that in the first half of 2026, 7,441 addresses belonging to 36 different providers were blocked, including Amazon AWS, Cloudflare, Akamai, Alibaba Cloud, Microsoft and Meta.
LaLiga argues that these are dynamic blocks which are neither massive nor indiscriminate, and justifies them by pointing to annual losses of between 600 and 700 million euros caused by piracy of its broadcasts. Yet innocent parties are bearing the brunt.
The underlying problem is the way the internet works, which clashes head-on with the method LaLiga is proposing as a solution and which, contrary to what it claims, does end up splashing thousands of websites every time there is a match in Spain. In fact, there is a web service that allows users to check whether this kind of outage is taking place: hayahora.futbol (source in Spanish).
A content delivery network (CDN) such as Cloudflare (source in Spanish) caches under a single IP address thousands of pieces of content belonging to separate services. It improves loading speeds by serving content from locations closer to the end user with lower latency and also reduces the impact of DDoS attacks.
If the IP of the CDN is blocked, content from thousands of services and websites is blocked as well, and the current system cannot tell whether the user was looking for that pirate stream or for a website like those of the RAE, Amnesty International, Greenpeace, Unicef, UNHCR or Caritas, courts, universities and projects such as Hugging Face, which hosts AI LLM models, or even some football clubs' own websites and those of their sponsors, a neat piece of rhetorical irony about this blocking method.
The OONI report, which cross-checked measurements taken in Spain between January and June 2026 against a list of 9.2 million domains, estimates that more than 554,000 legitimate domains were affected at some point. Cloudflare took the bulk of the hit: with only 30% of the blocked IPs, it accounted for 90% of the affected domains, more than 501,000.
In Spain, one of the best-known cases is the Redsys payment gateway, which has suffered repeated failures in confirming online payments during LaLiga matchdays, with affected retailers not even knowing where the problem lay. On previous occasions, WikiDex, the largest Spanish-language encyclopaedia on Pokémon, has also been affected, complaining of access problems to its image servers.
Case study during Real Madrid's match on 15 September
In my own case, with fibre from DIGI, I have noticed blocks during earlier matches when downloading open LLM models from my server from Hugging Face (normally hosted on AWS), when using services linked to a pair of smart glasses (Halliday) or even when trying to access some websites. If anyone can see how those websites or services have anything to do with the piracy LaLiga talks about, please do let me know.
The number of blocks began to increase after kick-off in the Elche C. F. v Real Madrid match, with Cloudflare IPs being blocked by Spain's five main internet operators.
During the match, some websites were completely inaccessible, such as mandalaweb.es, a site offering mandalas to colour in, or todopuntodecruz.com, a site with a shop selling kits and patterns for cross-stitching.
If we use a VPN from outside Spain, both mandalaweb.com and todopuntodecruz.com load properly, even though they have nothing to do with pirating LaLiga's IPTV signal.
Tebas has said that the complaints come from only a few people, labelling them geeks, but it is not a question of a few domains or just small ones. Among the inaccessible sites are linuxmint.com, the supermarket chain froiz.es and the website of the Centro de Investigación Biomédica en Red (Networked Biomedical Research Centre). The verdict is clear: this is a nationwide block applied by internet providers, DIGI in my case.
Another example: the following day, Wednesday 16 September 2026, I tried to download the Qwen 3.8 27b LLM model from Ollama to my server, and the requests failed because the TLS certificate could not be delivered in time during that day's matches, at 19:41, when I tried to download it. Ollama's models are hosted on Cloudflare, and of course an AI LLM model has nothing whatsoever to do with football.
As can be seen below, there is also a series of blocks linked to LaLiga matches. The blocks include Cloudflare domains. On 15 September, the outages from the previous day started at around 21:20 and ended after midnight, meaning almost three hours of blocking.
On Wednesday 16 September, the block began at 18:45 and lasted until just before midnight, so we are talking about between five and six hours of disruption. In these two cases, they were midweek days; at weekends, in the best of cases, the duration is similar.
Technical alternatives, legal framework and expiry date
There are now far more precise ways of acting than taking down an entire IP: targeting the domain, the URL, the account or the specific server distributing the pirate signal, and requesting its removal from the relevant provider.
The rule should be to block the infringing content, not the shared infrastructure, because the damage caused is incalculable, with collateral effects on services and users who are unable to use the internet and apps normally while football matches are on. Several websites are reporting losses suffered by services and portals. LaLiga's blocks have already caused more than 3.1 million in losses.
The legal basis for these blocks is the ruling handed down by Commercial Court No. 6 of Barcelona on 18 December 2024, which upheld the claim brought by LaLiga together with Telefónica Audiovisual Digital.
The judgment authorises the immediate suspension of access to identified IPs and allows them to be updated dynamically on a weekly basis, even during matches, without the need for a fresh court order for each address. Movistar, Vodafone, DIGI and MásOrange did not contest the proceedings, effectively accepting the measures without challenge.
In Congress there has been a first move, although it has no legal force yet: on 29 April 2026, a non-binding motion to amend the Digital Services Act (source in Spanish) was approved, tabled by ERC and agreed with the PSOE, with the backing of Sumar, Bildu, the PNV and Compromís. The PP and Vox voted against and Junts was absent. If it goes ahead, the reform would introduce proportionality requirements and limits on court rulings so that they do not delegate to industry bodies the management of blocking lists without oversight.
In response to the outages, some users have chosen to use virtual private networks (VPNs) to get around them, a tool that European courts regard as neutral software and a legitimate tool.
LaLiga counters that VPNs, as technological intermediaries, also bear responsibility for the content that flows through their infrastructure, and notes that the Commercial Court of Córdoba has already ordered interim measures along those lines.
Nor has ECH encryption, promoted by Cloudflare and Apple to conceal the domain a user is connecting to, yet managed to displace IP blocking as the main containment tool.
The 2026/2027 season will be, in any case, the last one covered by the current ruling, which expires on 20 June 2027, coinciding with the end of the Second Division.
LaLiga and Telefónica are expected to seek an extension of a match they have been winning for several years. However, the legal and regulatory landscape has shifted compared with two years ago, creating real uncertainty as to whether they will once again obtain such a broad mandate.
This text was translated with the help of artificial intelligence. Report a problem : [[email protected]].
