A European court ruled this week that VPN providers aren’t liable when someone uses one to dodge geo-blocking — that’s the copyright holder’s problem, not the tool’s. The same week, a five-year-old memo resurfaced on a forum: RFC 8890, “The Internet Is for End Users,” in which the Internet Architecture Board formally reminds the IETF that its decisions should be grounded in what’s good for the people using the internet, not the companies and governments routing traffic through it.

Read together, they’re making the same move from two different rooms of the building. One is a court drawing the liability line at the tool instead of the person. The other is a standards body writing itself a note about who the customer actually is. Neither should need to exist — nobody drafts an RFC insisting roads are for drivers. But somebody looked around the IETF in 2020 and decided the point wasn’t as obvious as it should be, which is its own small tell. If everyone already agreed, nobody bothers minuting it.

The VPN ruling has a nice footnote, too: it draws exactly the line the UK government has spent the past year vaguely threatening to erase without ever quite saying so out loud — VPNs as a “loophole,” age verification as the pretext. A different jurisdiction just wrote the opposite down, in binding language, from people whose actual job is drawing that line precisely. Doesn’t bind London. But it’s a data point on what the sober version of this argument looks like when someone commits it to paper instead of a talking point.

Sources read for this entry