VPNs with servers in Spain

Data goes, on a court order, to the judicial police, customs surveillance officers and, in security investigations, the intelligence centre (CNI); the operator may not disclose it. Under articles 588 ter e and 588 ter m of the Criminal Procedure Code, telecommunications and information-society providers, and anyone helping to facilitate communications, must assist an interception order and keep it secret, on pain of a disobedience offence.

Neither text mentions VPNs. Whether a VPN operator is covered by Law 25/2007, or by the wider wording of article 588 ter e, is not established.

A ruling of Barcelona Commercial Court No. 6 of 18 December 2024, obtained by LaLiga, has been used to have internet providers block IP addresses during matches; the blocks have also cut off unrelated sites that share those addresses. Cloudflare and the association RootedCON have each taken the matter to the Constitutional Court by amparo.

In February 2026 LaLiga announced that Commercial Court No. 1 of Córdoba had granted precautionary measures, without hearing the defendants, against NordVPN and Proton VPN, requiring IP addresses it identifies as streaming unlicensed matches to be made inaccessible from Spain. In May 2026 the court declined to fine NordVPN for non-compliance, calling it a genuine technical dispute; the proceedings continue.

Yes. The Penal Code punishes glorification of terrorism or humiliation of its victims (article 578) with one to three years’ imprisonment and a fine, in the upper half of the range where it is done through the internet or electronic communications.

For an IP address used to commit an offence online, police may ask an investigating judge to order providers to hand over the data identifying the device and the suspect (article 588 ter k). Police may also ask a provider directly who holds a given telephone number or other means of communication (article 588 ter m).

Intelligence interception of communications in Spain needs the authorisation of a Supreme Court magistrate, for up to three months at a time, renewable (Organic Law 2/2002). Law 11/2002 subjects the CNI to parliamentary and judicial control (article 2.2); it reports to the Congress of Deputies through the committee that oversees reserved funds, in secret sessions, and that committee cannot see information on the CNI’s sources and means (article 11).

In May 2022 the CNI was reported to have told a Congress committee that it had monitored Catalan independence figures under court authorisation. The order of the rows is the security score, and a server’s location is not a recommendation.