When football decides
A few days ago, I tried to access a client’s website from my mobile phone. The browser appeared to…
A few days ago, I tried to access a client’s website from my mobile phone. The browser appeared to be loading, but the page did not respond. Several seconds passed until, eventually, a timeout message appeared.
My first thought was that it might be a server issue. However, when I tried from my computer, connected to a VPN, the website worked correctly.
The situation was puzzling. The site was operational, but it was not accessible from certain connections. It did not seem to be an issue with the code, the hosting or a failed update. Something was preventing the connection from reaching its destination.
After several checks and some research, I discovered that what had happened could be related to the IP address blocks being applied in Spain to combat illegal broadcasts of football matches.
LaLiga, Cloudflare, operators such as Movistar and a court ruling were at the centre of a controversy that had been affecting websites and services entirely unrelated to football for months.
What initially appeared to be an isolated technical incident raised a far more troubling question: how is it possible for a legitimate website to become unavailable to its visitors when there is no issue with its operation?
When an IP address no longer represents a single website
To understand the problem, we first need to clarify something: an IP address does not necessarily correspond to a single website.
When we type an address into a browser, the DNS system helps locate the infrastructure that must respond to our request. But that infrastructure may host or handle requests for many different websites using the same IP address.
This is common on the Internet. Services such as Cloudflare act as intermediaries between visitors and the servers of millions of websites. Their infrastructure helps improve performance, distribute content and protect pages against certain attacks.
Under this model, several websites can share the same IP address. The server identifies which site we want to access using additional connection information, such as the requested domain name.
The problem arises when that IP is blocked in order to prevent access to a specific piece of content.
Imagine a building with dozens of businesses sharing the same postal address. If someone decides to close access to the building because one of them is carrying out an illegal activity, the others will also suffer the consequences, even if they have no connection whatsoever with that activity.
Something similar can happen with shared IP addresses.
Blocking an IP does not necessarily mean blocking just one website. Depending on how the restriction is applied, the result may be that hundreds or thousands of legitimate domains become inaccessible to users of a particular operator.
And this is where an important distinction emerges: blocking specific content is not the same as blocking the infrastructure through which many other pieces of content are also delivered.
That is why, when a page stops responding, it does not always mean that its server is down. It may continue operating normally and remain accessible from other networks or countries, while certain users receive connection errors or timeout messages.
It is precisely this difference between the actual operation of a website and its accessibility from the Internet that makes indiscriminate IP address blocking a problem that goes far beyond the fight against piracy.
LaLiga, the operators and a ruling that changed the rules
The origin of this situation lies in a ruling by Barcelona Commercial Court No. 6, issued on 18 December 2024, following a claim brought by LaLiga and Telefónica Audiovisual Digital against several Spanish telecommunications operators.
The ruling authorised the blocking of IP addresses used to distribute LaLiga audiovisual content illegally. But it introduced a particularly significant element: the blocks could be updated dynamically, incorporating new addresses identified before or during matches, without requiring a new ruling for each one.
Since February 2025, operators such as Movistar, Orange, Vodafone and DIGI have begun applying these restrictions. In many cases, the blocks coincide with broadcast times and disappear once the matches have ended.
The stated aim is to combat audiovisual piracy, an activity that causes financial harm to the holders of broadcasting rights. However, the procedure chosen has generated a controversy that goes far beyond football.
LaLiga maintains that its actions are supported by the courts, that the blocks are temporary and that they target IP addresses used to distribute illegal content. It also holds Cloudflare responsible for the collateral damage, arguing that its infrastructure allows addresses to be shared between legitimate services and platforms that infringe intellectual property rights.
Cloudflare, for its part, challenged the measure in court and warned of the consequences of blocking shared infrastructure. The company believes that these restrictions can harm users and businesses with no connection to piracy. In March 2025, the court dismissed the applications for annulment submitted by Cloudflare and other interested parties.
The operators, meanwhile, are responsible for technically implementing the restrictions on their networks, in compliance with the court ruling.
The result is a scenario involving audiovisual rights holders, infrastructure providers, telecommunications operators and courts. But there is also a fifth group that did not take part in the proceedings and may suffer their consequences: the owners of legitimate websites and their visitors.
And this is where the fundamental question arises. The fact that a measure has judicial backing does not mean that its technical effects are irrelevant, nor does it remove the need to assess its proportionality.
Because preventing access to an illegal broadcast is one thing, but making it more difficult to access services that have committed no infringement in order to achieve that is quite another.
Collateral damage is no longer hypothetical
For months, reports of pages becoming inaccessible during football matches could have seemed like isolated incidents. However, independent research has shown that the problem is much larger in scale.
In June 2026, the Open Observatory of Network Interference (OONI), an organisation specialising in analysing interference and restrictions on the Internet, published a study based on measurements taken from different Spanish networks between January and June that year.
The results are difficult to ignore.
Of the 9.2 million domains analysed, 554,507 were affected by blocks at some point during the period studied, approximately 5.8% of the sample. The research identified 7,441 affected IP addresses belonging to 36 infrastructure providers, including Cloudflare, Amazon, Akamai and Microsoft.
One of the most revealing findings is that, during certain broadcasts, blocking between four and twenty IP addresses could affect more than 400,000 domains within a one-hour window.
These figures do not mean that half a million pages remained inaccessible simultaneously throughout the whole season. The blocks were generally temporary, and their impact varied according to the operator and each domain’s configuration. But the scale of the problem is still concerning.
And, above all, the affected sites did not necessarily have any connection to football or to the illegal distribution of content.
Among the domains identified in the research were pages belonging to Amnesty International, Greenpeace, UNICEF, Cáritas, UNIDA and various universities, as well as technology services such as the Terraform registry and the Linux Mint project.
Incidents have also been reported in everyday services. As RTVE reported in September 2026, WikiDex, a well-known Pokémon encyclopaedia, experienced issues with its image servers. The blocks have even been linked to failures in payment confirmations through Redsys, an infrastructure used by numerous Spanish online retailers.
But perhaps one of the most striking episodes occurred recently, on 7 November 2026. According to RedesZone’s documentation, Movistar’s own support forum, Comunidad Movistar, became inaccessible from certain connections during blocks associated with that round of football fixtures. The outlet reproduced the incident from a DIGI connection, although neither LaLiga nor the operator officially confirmed its cause.
The case is particularly significant: a customer support platform belonging to one of the operators involved in implementing the restrictions can also be affected by them.
LaLiga, for its part, questions whether all the detected blocks can be attributed to its actions. This is an important distinction: not every connectivity incident is necessarily a consequence of these measures.
However, the temporal overlap between numerous blocks and broadcasts, together with the results of independent measurements, provides strong evidence of a recurring problem.
And although these restrictions usually last a few hours, their consequences do not always disappear when the match ends. For a business, a few hours of inaccessibility can mean lost orders, enquiries that never arrive or customers who simply leave the website.
The question, then, is no longer whether collateral damage exists, but who bears its consequences.
Who is accountable when your business disappears from the Internet?
Imagine an online shop that stops receiving orders for several hours. Or a business whose customers cannot access its catalogue, request a quote or complete a contact form.
The server is working. The website is up to date. There are no errors in the code or issues with the hosting. Yet, for some of its visitors, the business has simply disappeared from the Internet.
And most worrying of all, those responsible may not even know that it is happening.
A block of this kind can cause financial losses, service interruptions, reputational problems and business opportunities that will be difficult to recover. Moreover, not all consequences can be measured: how can we assess the impact of a customer who tries to access a site, cannot, and decides to go to a competitor instead?
This raises an uncomfortable question: who takes responsibility when a measure intended to combat illegal activity harms businesses that have committed no infringement?
The answer is not straightforward. LaLiga requests the measures to protect its audiovisual rights, operators implement the blocks under the authority of a court ruling, and infrastructure providers manage shared services used by millions of pages. Determining possible legal liability requires analysing each case and cannot be resolved simply by pointing to one of these actors.
But there is one matter that should stand above the dispute between companies: proportionality.
Fighting piracy is a legitimate aim. However, any measure that restricts access to content or services should be precise enough to avoid unnecessary harm to third parties.
There should also be transparency. If a page is blocked, how can its owner find out? Who informs them of the cause? What process is available to request a review? How long might it take to restore access for their visitors?
It is not enough for a restriction to be temporary if those affected do not have clear mechanisms to identify it, report it and seek redress for its possible consequences.
There is another dimension that deserves attention: the inequality between those who can respond and those who cannot. A large platform may have the technical and legal resources to investigate the problem, change its infrastructure or submit claims. A small business, an association or a self-employed professional may not even be able to find out why their website has stopped working.
Paradoxically, those with the least ability to defend themselves may be the ones who depend most on every visit, every contact or every sale.
The underlying issue is not about choosing between protecting audiovisual rights and keeping the Internet accessible. It is about demanding that both responsibilities can be addressed without unjustifiably shifting the costs of illegal activity onto those who do not take part in it.
Because protecting some people’s rights should not turn the harm suffered by others into an inevitable and acceptable consequence.
What those of us who develop and maintain websites can do
In a situation like this, the first reaction is usually to review the server, check error logs or contact the hosting provider. These are reasonable steps, but perhaps we need to broaden the way we diagnose availability issues.
The fact that a website is working does not necessarily mean that all its users can access it.
That is why, when we receive an incident that is difficult to explain, it is worth checking access from different connections: a fibre network, a mobile connection, another operator or a VPN. If the page works from some networks and fails from others, we have an important clue, although not definitive proof that a block exists.
We can also review DNS resolution, identify the IP addresses used by the service and check whether connections consistently fail towards particular addresses. Tools such as OONI Probe and the records of Is there football on now? can help us investigate possible restrictions and compare them with independent measurements.
Another useful practice is to document incidents: date and time, operator, affected IP address, error messages and the results of tests carried out. This information can be essential when reporting the problem to the infrastructure provider, contacting the operator or supporting a possible claim.
But perhaps we also need to review how we monitor our websites.
Many monitoring tools check availability from one or more servers located outside Spain. They may indicate that everything is working correctly while users connected to certain Spanish networks cannot gain access. Adding checks from different locations and, where possible, from different operators provides a more realistic picture of the service.
Of course, contingency measures exist, such as reviewing traffic distribution or considering infrastructure alternatives. However, these decisions must be assessed carefully: changing provider or IP address does not guarantee that the problem will disappear and may introduce new costs or technical risks.
Nor should we present the use of a VPN as a solution. It may help diagnose the incident or allow access for a particular user, but it does not solve the underlying problem: a legitimate website should be accessible without its visitors having to seek alternative routes to reach it.
As professionals, our responsibility is to identify, document and reduce the impact of these situations. But we cannot assume that every external restriction should be resolved by modifying our clients’ infrastructure.
There is an important difference between designing more resilient systems and accepting as normal that third parties can interrupt their accessibility without sufficiently transparent mechanisms.
And perhaps that is one of the most important lessons of this case: we need to monitor our websites better, but we must also ask why we are obliged to do so in response to decisions that should never harm them in the first place.
Conclusion
What began as an incident while trying to access a client’s website ended up revealing a problem that goes far beyond a failed connection.
For years, we have worked to build websites that are faster, safer and more reliable. We have improved servers, optimised applications and developed tools to detect errors before they affect users. Yet all that effort can prove insufficient when the availability of a service depends on external decisions over which those responsible for it have very little control.
The fight against piracy is necessary. Intellectual property rights deserve protection, and those who distribute content illegally must face the consequences of their actions. But the effectiveness of a measure should not be assessed solely by what it manages to block, but also by the harm it causes in the process.
The Internet is shared infrastructure. Decisions that affect one part of it can have far broader consequences than expected. That is why intervening in that infrastructure requires precision, transparency and mechanisms that make it possible to correct mistakes when they occur.
This is not about choosing between protecting audiovisual rights and guaranteeing access to legitimate services. It is about finding solutions that do not require sacrificing some rights in order to defend others.
Meanwhile, thousands of businesses and professionals continue to depend on an infrastructure whose complexity they barely notice until something stops working.
Perhaps the real problem is not that a website can become inaccessible during a football match, but that we have come to regard it as acceptable for that to happen.
To what extent are we willing to accept that protecting some rights limits other people’s legitimate access to the Internet?
Comments