VPNs are legal tools: what that means for your SaaS

A client of mine blocked every login coming from a VPN on his system dashboard. The idea sounded good: if the guy hides his IP, he is suspicious. Two weeks later, the sales team could not get in from inside the office, because the company had just rolled out a corporate VPN to everyone. Support turned into a circus. And the "security block" got switched off in a hurry on a Friday night.

That story came back to me now, because a European court has ruled that a VPN is lawful technology. Just like that. Using a VPN is not evidence of a crime, it is not a way around the law, it is not piracy by definition. It is a neutral tool, like a car or a phone. If someone does something stupid with it, the problem is the stupid thing, not the tool. It sounds like a distant legal detail, but it goes straight to how you build access rules, geoblocking and antifraud in your product.

What the court decided, in plain words

The case involved copyright holders trying to push liability onto VPN providers, arguing that VPNs exist to get around content blocks. The court did not buy it. The reasoning was that VPNs have broad legitimate uses: privacy, remote access to work, protection on public wi-fi, corporate data security. Treating every VPN user as an offender would punish the majority for the behavior of a minority.

That sets a precedent with practical weight. If a court recognizes the technology as legitimate, it gets much harder to defend the internal policy of "VPN equals risk, block it". You are no longer just in technical territory. You are in territory where assuming bad faith from a legitimate user can turn into a compliance and contract problem.

Blocking VPNs is not security. It is friction sold as security.

Why this matters if you sell software

If your business has a login, a dashboard, a client area or an API, you probably have some rule that looks at IP addresses. Maybe geoblocking ("only accept access from Brazil"). Maybe a risk score that penalizes datacenter IPs. Maybe a "suspicious access" alert that fires an email every time the geolocation changes.

All of those rules produce false positives with VPNs. And here is the detail a lot of people ignore: the heaviest VPN users are exactly your best corporate clients. A company with a serious security policy puts everyone behind a VPN. Law firms, accounting firms, clinics, anywhere that handles sensitive data. You end up creating friction with precisely the client who pays more and complains less, right up until the day they complain and cancel.

Real cases I have seen:

• A management system that required email reconfirmation on every IP change. A user on a corporate VPN with rotating exits got that three, four times a day.
• A checkout that refused payments from IPs outside Brazil. A client traveling for work, on a company VPN exiting through Miami, could not renew the subscription.
• An admin panel with a fixed IP allowlist. Worked beautifully until the company switched VPN providers and nobody could get in on Monday morning.

None of those cases caught a fraudster. All of them caught paying clients.

So I open everything up and pray?

No. The lazy reading of this ruling is "VPNs are legal, so filter nothing". That is terrible advice. Fraud exists, credential attacks exist, and anonymous IPs are still used by bad people.

The point is different: an IP is a weak signal and you are treating it as a strong one. An IP answers "where does this connection appear to come from", and nothing else. It does not tell you who the person is, whether the device is known, whether the behavior matches their history. When you block by IP, you are making a high-impact decision with low-quality information.

What works better, in practice:

• Decent authentication. Strong passwords, 2FA at minimum for admin accounts. That solves more than any geoblock.
• Known devices. Flag the browser the user has already used and trusts. An IP change on a known device is noise. A new device is what deserves attention.
• Behavior, not location. Ten login attempts in a minute is a signal. Downloading the entire client base at three in the morning is a signal. Being in Lisbon is not a signal.
• Escalate instead of blocking. A risk signal does not have to become a closed door. It can become a second factor, a confirmation, a temporary limit.

The rule I use: an IP can raise the level of verification, never deny access on its own.

The product side, not just the security side

There is a commercial angle here that almost nobody sees. If you sell SaaS to companies, your stance on VPNs is part of the product. During the client's security checklist, someone will ask: "does it work with our corporate VPN?". If the answer is "you need to turn the VPN off to use it", you just became the system that weakens the client's security policy. That stalls deals.

The reverse is worth more. Supporting VPN access properly, offering SSO, letting clients configure their own access rules: that is a differentiator in B2B sales. It is not a cost, it is a selling point.

And the European ruling gives you backing to defend that position internally, when someone on the team insists that "VPNs are for people hiding something". They are not. A court just wrote that down.

What to do this week

None of this requires rebuilding the system. You can check it in an afternoon:

1. List every place where an IP decides something. Login, checkout, API, admin panel, antifraud alerts. Write it on paper. Usually there are three or four spots and nobody remembers all of them.
2. Look at how many real blocks happened. Pull the logs from the last ninety days. How many were confirmed fraud? If the answer is zero or close to it, the rule is working against you.
3. Swap blocking for verification. Where it says "deny" today, make it "ask for a second factor". Same level of protection, without slamming the door on your client.
4. Test it yourself with a VPN on. Spin up any VPN, exit in another country, and use your product the way a client does. You will find something in fifteen minutes.
5. Write the policy down. One page. What you monitor, what triggers verification, what never blocks on its own. It serves the team and it answers the corporate client.

Step 4 hurts the most and delivers the most. I recommend doing it before coffee, while your patience is still intact.

The honest summary

IP-based access rules are the kind of solution that feels productive and is not. They take work, they generate support tickets, they push away good clients and they almost never catch the bad ones. The European ruling just formalized what anyone running a system already knew: a VPN is a work tool, not a clue about a crime.

If you are not sure how many rules like that exist in your system today, that uncertainty is already the answer. It is the kind of thing I usually map out in the first conversation with a new client, because there is generally some forgotten block costing sales somewhere. If you want to talk through your case, take a look at who I am and how I work.

A client of mine blocked every VPN login on his dashboard. Two weeks later, the sales team could not get in from inside the office.

The reason? The company had just rolled out a corporate VPN to everyone.

Now a European court has ruled the obvious: a VPN is lawful technology. It is not evidence of a crime, it is a work tool.

And here is the detail almost nobody sees: the heaviest VPN users are your best corporate clients, the ones who pay more and complain less. Right up until they cancel.

Blocking by IP is not security. It is friction sold as security.

The rule I use: an IP can raise the level of verification, never deny access on its own.

Test it today: spin up a VPN, exit in another country, and use your own product the way a client does. In fifteen minutes you will find something that is costing you sales.

#SaaS #InformationSecurity #DigitalProduct #TechForBusiness #VPN