Why streaming services block VPNs

If you've seen "You seem to be using a VPN or proxy" on Netflix or "available to play in the UK only" on BBC iPlayer, this page explains why. It covers the business reason, the technical methods, and what the services' own terms say. Tunnelcheck hasn't tested which VPNs get through which services, and we don't publish such claims.

The reason: rights are sold by territory

Film and TV rights are usually sold separately for each country or region. A studio might license a show to one service in the US, another in the UK, and a local broadcaster in Germany. Each buyer pays for exclusivity in its own territory. If a service let anyone anywhere watch its US catalogue, it would be showing content in places where someone else paid for the rights.

Netflix explained this in a January 2016 post by David Fullagar, its vice president of content delivery architecture. Because of its historic licensing model, "the TV shows and movies we offer differ, to varying degrees, by territory", and Netflix said it would "continue to respect and enforce content licensing by geographic location". From then on, people using proxies and unblockers would "only be able to access the service in the country where they currently are" (Netflix).

Ads add a second reason. Ad-supported plans sell ad space to advertisers targeting a specific country. Hulu's help center cites "contracts with our content partners and advertisers" when it tells proxy users to switch off (Hulu Help). Netflix says VPNs aren't supported at all on its ad-supported plans or for live events (Netflix Help). Live sports add a third: leagues set blackout areas, and services enforce them by location.

Public broadcasters have their own version. The BBC is funded by the UK licence fee, and it began blocking VPN addresses from iPlayer in 2015, saying it couldn't be confident where VPN users were (TorrentFreak).

What the terms of service say

Sources: Netflix Help, Disney+, ESPN and Hulu Subscriber Agreement, Hulu Help, HBO Max Help, Peacock Terms, TV Licensing.

How services detect VPNs

Streaming services don't publish their detection systems in detail. What we can describe is how the commercial tools they can buy work, based on the vendors' own documentation and on published research.

1. 1. Lists of known VPN addresses Companies such as MaxMind sell databases that tag IP addresses as anonymizers. MaxMind's Anonymous IP database flags addresses registered to VPN services, hosting providers and data centers, Tor exit nodes, public proxies and residential proxies. It lists geoblocking and content distribution as a use case: businesses use it to check that visitors aren't using VPNs or proxies to reach their content (MaxMind).
2. 2. Datacenter address ranges Most commercial VPN servers sit in data centers. Home internet connections almost never come from data center address space, so traffic from a hosting company's network is a strong signal of a VPN or proxy. IP data company IPinfo says flagging hosting and datacenter networks removes the bulk of casual VPN traffic (IPinfo).
3. 3. Many users behind one address A VPN server puts many customers behind a few IP addresses. A single home address that suddenly streams to hundreds of accounts looks nothing like a household. Detection vendors say they combine address data with behavior and session signals like this (Spur).
4. 4. Location mismatches Apps can compare the IP address's location with other clues, such as the device's time zone, language, or GPS location on phones. Disney's terms say it may use "different technologies and methods to verify your location", and several services ask for device location access for some content (Subscriber Agreement).
5. 5. Traffic fingerprinting Researchers have shown VPN protocols themselves can be recognized. A 2022 USENIX Security paper by Xue and colleagues identified over 85% of OpenVPN flows on a network with about a million users, with negligible false positives, and detected 34 of 41 "obfuscated" VPN setups (USENIX). That study was about internet providers and censors watching network traffic, not streaming apps, but it shows how much a VPN connection can give away.

Why results keep changing

Detection depends on lists, and lists are updated. When a VPN adds fresh addresses, they may work until they're flagged; then the VPN rotates again. That's why a review saying "this VPN works with Netflix" can be wrong a week later, and why Tunnelcheck doesn't make such claims. The same addresses can also be blocked by banks, shops and other sites that use the same databases, which is a common side effect for VPN users.

What this means for you

• Using a VPN to change your streaming country usually breaks the service's terms, even when you pay for the subscription. The usual result is a blocked stream; the terms also let services act on accounts.
• A VPN doesn't change the licensing problem. The catalogue you see is set by where the service thinks you are.
• If you're an EU resident travelling in the EU, you don't need a VPN for paid services: the portability regulation requires them to give you your home catalogue.
• VPNs are still useful while streaming for privacy on public Wi-Fi and to hide your viewing from your network operator. See what a VPN does.
• Legal free services exist in most countries; see our list of free streaming sites.