How LaLiga got the power to switch off parts of the internet

In short: a December 2024 ruling from Commercial Court No. 6 of Barcelona lets LaLiga and Telefónica require Spanish ISPs to block entire IP addresses during matches. Because Cloudflare places thousands of unrelated websites on the same shared IPs, the blocking sweeps up hundreds of thousands of domains with no connection to piracy. The ruling stands and the appeals against it have been dismissed.

On Sunday 16 August 2026, this website stopped being reachable from Spain. Not a server fault. The domain returned a plain white page carrying this text:

“Access to this IP address has been blocked in compliance with the Judgment of 18 December 2024, issued by Commercial Court No. 6 of Barcelona […] brought by the Liga Nacional de Fútbol Profesional and Telefónica Audiovisual Digital, S.L.U.”

Capital Fútbol is published on Cloudflare. Cloudflare gives its customers shared IP addresses. One of those addresses, 188.114.96.5, sits among the IPs LaLiga has blocked on matchdays. A site built to explain football’s power structures was switched off by one of them.

What the ruling actually authorises

The decision is judgment nº 310/2024, dated 18 December 2024, from Commercial Court No. 6 of Barcelona, in ordinary proceedings brought jointly by the Liga Nacional de Fútbol Profesional and Telefónica Audiovisual Digital.

Authorising blocks is not the novel part. Anti-piracy blocking has existed across Europe for years. The novel part is what may be blocked: not specific domains or URLs, but entire IP addresses, dynamically, during matchdays.

It remains in force through the 2026/27 season.

Why unrelated sites go down with it

Here is the technical failure, and it is worth understanding because it is the whole problem.

An IP address is not a website. In modern infrastructure thousands of sites share a single IP and are told apart by SNI (Server Name Indication), the field in the TLS handshake that names which domain the visitor is asking for.

An ISP wanting to block a pirate site without harming anyone else can inspect SNI and cut off only that domain. That is standard practice.

According to Vercel, Spanish ISPs are instead “blocking entire IPs, ignoring SNI and making no effort to distinguish between hosts.” The precision tool exists. It is not being used.

	SNI-based blocking	IP-based blocking
Scope	The infringing domain	Every domain on that IP
Collateral damage	None	Hundreds of thousands of sites
Technical effort	Higher	Minimal

The scale

Until recently the true reach was known only in fragments, pieced together by users. In June 2026 the Open Observatory of Network Interference (OONI) published the first systematic measurement, combining its Spanish network data with DNS scans against the internet’s 9.2 million most popular domains.

Metric	Figure
Domains affected (1 Jan – 1 Jun 2026)	554,507
Share of the 9.2M sample	5.8%
Hosted on Cloudflare	501,305 (90.4%)
Cloudflare IPs blocked	2,218 (30% of total)
Unique IPs blocked	7,441
Providers affected	36

One figure captures the disproportion better than any argument: across most broadcasts, blocking just 4 to 20 IP addresses for one hour took more than 400,000 distinct domains offline.

Documented collateral victims include Google Fonts, payment platforms, media outlets and institutional sites. Vercel recorded two of its own IPs being blocked while serving the Spanish startup Tinybird and Hello Magazine, “services that have no connection to piracy.”

Beyond blocking: encrypted traffic is being intercepted

OONI’s most serious finding is not the blocking. It is what happens on some networks when the secure connection is attempted.

The report documents TLS man-in-the-middle interception on Digi Mobil (AS57269), covering 7,334 unique IPs hosting 10,759 domains. The signature is a self-signed certificate injected into the connection:

• CN: core1.netops.test
• Organisation: Widgits Pty Ltd
• Validity: 19 February 2026 to 18 September 2124
• SHA-1 fingerprint: D5:EB:30:1E:5A:00:4C:8B:6C:39:36:A5:DA:81:B1:E8:FC:F6:D7:7F

On 16 August 2026, from a domestic Digi connection — the same network OONI identifies — reaching this website over HTTPS returned precisely that certificate. The SHA-1 fingerprint matches the report’s published value digit for digit.

In the report’s own words, “a single observation of the injected certificate confirms the connection was intercepted.”

This is not an anecdote or an isolated incident. It is a reproduction, on one specific and verifiable domain, of a finding an independent observatory had already documented on that same network.

It is worth being precise about what this means. An IP block cuts off access. A TLS interception places a third party inside a connection the browser and the user believe is encrypted end to end. Those are different things, and the second belongs in a different category.

The legal fight

Cloudflare and RootedCON, one of Spain’s principal cybersecurity associations, sought annulment of the proceedings. The court dismissed them in full, first through order nº 295/2025 of 25 March 2025, then by rejecting the clarification requested on 31 March.

RootedCON took the case to Spain’s Constitutional Court via a recurso de amparo, and has said it would consider European routes if that fails. Cloudflare has followed the same path.

The judgment meanwhile remains fully in force, and the blocks resumed with the new season.

Why this is a power story rather than a tech story

The case fits the pattern this site keeps returning to: a private body acquiring, through the courts, a capability that used to belong to the state.

LaLiga is not a regulator. It is an association of clubs that runs a competition and sells its broadcasting rights. Under this judgment, its decisions about which IP goes dark on a Saturday afternoon directly govern internet access for millions of people who are not its customers, have pirated nothing, and have no practical way to appeal.

The asymmetry is what stands out. Blocking requires only that an IP be named. Unblocking would require the affected party — who usually does not even know they are blocked — to intervene in proceedings they were never part of.

You do not need a position on piracy to see the design flaw. The cost of error falls entirely on third parties who have no role in the dispute.

Frequently asked questions

Why can LaLiga block IP addresses in Spain?

Judgment nº 310/2024 of 18 December 2024, from Commercial Court No. 6 of Barcelona, brought by LaLiga and Telefónica Audiovisual Digital, requires Spanish ISPs to block the IP addresses LaLiga identifies during matchdays.

Why do legitimate websites get blocked?

Because the block applies to the whole IP rather than to a domain. Thousands of sites share IPs on services like Cloudflare, and the blocking ignores the SNI field that would distinguish between them.

How many domains have been affected?

According to OONI’s June 2026 report, 554,507 domains were affected between 1 January and 1 June 2026 — 5.8% of a 9.2 million domain sample. Of those, 501,305 were on Cloudflare (90.4%), across 2,218 IPs out of 7,441 blocked in total spanning 36 providers.

Are ISPs intercepting encrypted traffic?

OONI documented TLS interception on Digi Mobil (AS57269), covering 7,334 IPs hosting 10,759 domains, using a self-signed certificate with the CN core1.netops.test. This is not the same as blocking: it means positioning a third party inside a connection the user believes is encrypted end to end.

Can the blocking be appealed?

Cloudflare and RootedCON tried and the court dismissed their claims. RootedCON has filed a constitutional appeal and has not ruled out escalating to European courts.

Are the blocks permanent?

No. They are applied during match windows, mainly weekends and some midweek fixtures, and lifted afterwards. A site can be unreachable on Saturday evening and work normally on Monday.