Website Blocking Needs More Than a Name on ACM’s List

For Dutch internet providers, lawful restriction depends on ownership, judgment and review.

Picture the operations desk of a small regional internet provider. A report arrives about a website that appears to mirror a sanctioned Russian media outlet. The domain is unfamiliar, yet customers can still reach it. The network team can restrict access quickly. First, someone must decide whether the legal ground is sound.

That decision carries pressure in both directions. Blocking internet traffic is not an ordinary commercial choice. Leaving a sanctioned distribution route open creates a different exposure. Engineers need an answer, customer support needs an explanation, and management needs to know who can decide.

On 26 August 2026, the Authority for Consumers and Markets, ACM, published guidance and a practical list of websites connected with Russian media entities sanctioned by the European Union. The list helps providers navigate the issue. It does not remove the decision.

The exception remains narrow

Net neutrality is the starting point. Dutch internet providers generally may not block or unnecessarily restrict traffic. Open internet access is the rule, rather than a preference providers can set aside when a website looks controversial or commercially inconvenient.

European sanctions create a specific exception. Article 2f of Regulation 833/2014 prohibits broadcasting, facilitating or otherwise contributing to the online dissemination of content from listed media entities. Measures needed to comply with European law can therefore fall within the legal-compliance exception to the Open Internet Regulation.

ACM’s practical list gives providers a clearer supervisory position. When a website appears on that list, ACM will not enforce against a provider for breaching net-neutrality rules by blocking it. That is useful certainty within ACM’s role as supervisor.

The list is not a blocking order. The duty to comply with sanctions law remains with the provider, while enforcement of those rules belongs to the competent authorities, including the Public Prosecution Service in the Netherlands. Providers need to understand which authority has clarified what, and where their own judgment begins.

A list is useful, not complete

The practical list is non-exhaustive. New domains and mirror websites may still fall within the sanctions rules. Providers must assess those cases while treating restrictions outside the published list with care.

This is a familiar compliance problem in a technically demanding setting. The external list is an input. The real control is the route from that input to a reasoned decision. Who received the update? Who checked the domain? Who approved the restriction? What exactly was implemented? When will the decision be reviewed?

Return to the regional provider. Suppose the reported domain closely resembles one on ACM’s list but also hosts other material. A quick decision may affect lawful content and bring customer complaints. A slow decision may leave prohibited dissemination available. Legal counsel and the network team cannot leave that question sitting between them.

Ownership matters more than the spreadsheet. A monitored mailbox without a named person is not ownership. An automated supplier feed without a tested handover is not ownership either. A responsible person needs the authority to move a report through assessment, approval, implementation and review.

The cost sits around the block

For a smaller provider, the technical action may be the cheapest part. The continuing cost sits around it: monitoring official changes, obtaining legal input, testing implementation, handling challenges, keeping records and explaining restrictions to customers without inventing a new legal answer on every support call.

Those costs belong in the operating model. Treating each sanctions update as an exceptional legal project creates delay and repeated work. A modest recurring budget for monitoring, review and technical maintenance may be less visible than network equipment, but it supports the same promise: reliable access within lawful boundaries.

The sanctions environment moves often. The European Union adopted its 21st sanctions package against Russia on 23 July 2026. The package included measures concerning oil income, banks, companies, the shadow fleet and sanctions circumvention. That wider movement shows why sanctions controls cannot depend on an annual policy meeting alone.

ACM will keep its list current, review it at least annually and update it when there is a direct reason. A provider’s internal rhythm may need to be faster. A new mirror report, ACM update or challenge from an affected party should reach someone who can assess it while the information still matters.

Know what role the business holds

The guidance addresses internet access providers. Hosting companies, cloud suppliers, platforms and managed-service businesses should first establish the role they perform in the route between content and user.

That question prevents both neglect and overreach. A company should not dismiss a sanctions issue simply because it calls itself a technology supplier. It should also avoid restricting access merely because another party has sent an urgent request. The legal role, contractual position and factual service need to be clear before action follows.

Back at the operations desk, the strongest answer is not merely that a domain appeared on a list. It is a short account of the decision: the official signal, legal ground, responsible person, scope of action, implementation date and next review point.

A good sanctions process does not celebrate blocking. It treats restriction as an exceptional act requiring care on both sides. ACM has reduced uncertainty for Dutch providers. The remaining task is to turn that clarity into disciplined judgment before the next unfamiliar domain arrives.

The data, sourcing, and analysis behind this article were conducted by Paolo Maria Pavan. AI was not used to identify sources, build the factual basis, or produce the analytical judgment contained here. AI was used only as a drafting aid. The final English text was personally reviewed, edited, and approved by Paolo Maria Pavan before publication.

References

• ACM publiceert leidraad gesanctioneerde websites | ACM
• Autoriteit Consument & Markt - ACM practical list and residual provider responsibility
• Autoriteit Consument & Markt - Net neutrality remains the default rule
• Rijksoverheid - Sanctions regime remains a moving target
• De Nederlandsche Bank and Autoriteit Financiële Markten - Official sanctions updates reinforce the need for current records
• Rijksoverheid - DNS blocking had already become an operational government-telecom issue
• Autoriteit Consument & Markt - Leidraad praktische lijst met websites van gesanctioneerde entiteiten