Over 500,000 websites wrongly blocked in Spain as La Liga anti-piracy campaign backfires

• Spain's LaLiga anti-piracy blocks disrupted at least 554,507 legitimate domains between January and June 2026, OONI reveals
• Blocking just 4 to 20 IP addresses during a one-hour match window knocked out over 400,000 unrelated websites
• Researchers also uncovered alarming TLS Man-in-the-Middle (MitM) interception tactics on one Spanish ISP

Football fans in Spain aren't the only ones feeling the impact of LaLiga's aggressive war on illegal streaming. A staggering new report shows that the league's court-authorized anti-piracy campaign has accidentally disrupted access to more than 500,000 legitimate websites, taking down everything from human rights platforms to vital cloud infrastructure.

According to a June 2026 report published by the Open Observatory of Network Interference (OONI), Spain's IP-based blocking campaign caused widespread collateral damage between January and June 2026.

The nonprofit organization, which specializes in measuring global internet censorship, found that at least 5.8% of the 9.2 million most popular internet domains were blocked at least once during football match broadcasts.

The sheer scale of this collateral damage highlights a fundamental flaw in current anti-piracy tactics. Because much of the modern web relies on shared hosting and content delivery networks (CDNs), attempting to block a single illegal stream by banning its IP address often drags hundreds of thousands of innocent websites down with it.

If you want to bypass these broad regional blocks, using the best VPNs is increasingly becoming a necessity for Spanish internet users trying to maintain access to the open web.

The collateral damage of La Liga's anti-piracy blocking

The collateral damage stems directly from how the internet is built. Providers like Cloudflare, Amazon, Microsoft, and Meta use shared reverse-proxy architectures, meaning thousands of entirely unrelated domains sit behind a single IP address.

OONI’s data shows that blocking as few as four to 20 IP addresses in a typical one-hour LaLiga broadcast window was enough to make over 400,000 unique domains completely inaccessible.

Throughout the observation period, OONI discovered the enforcement impacted 7,441 unique IP addresses across 36 infrastructure providers. Cloudflare bore the brunt of the outages, with the report identifying over 501,000 impacted domains hosted behind just 2,218 blocked IPs.

Among the collateral damage were benign and critically important websites, including those belonging to Amnesty International and Greenpeace.

Beyond the widespread outages, the anti-piracy tactics have introduced alarming security vulnerabilities.

OONI researchers noted in a post on X that they "detected TLS Man-in-the-Middle (MitM) attacks on Digi Mobil (AS57269), raising privacy and security concerns."

This privacy invasion affected 7,334 unique IPs hosting over 10,759 domain names, exposing Spanish users to potential data interception just to stop them from streaming football matches.

As we covered on Tuesday, there is growing pushback against these reckless enforcement measures. European ISP groups have strongly argued that rightsholders must be liable for collateral damage in piracy blocking, as erroneous court orders from rightsholders like LaLiga are repeatedly breaking the internet.

While OONI admits its methodology has limitations and likely understates the true scale of the impact, the findings paint a bleak picture of IP-based blocking. When taking down a handful of pirate streams knocks out half a million legitimate websites, the cure may very well be worse than the disease.