Offshore VPS: the test rankings

Fell to a copyright notice

From most to least resistant, by the notice that triggered the cut-off.

Stopped for other reasons

Figures from the test and consulted sources, with their calculation methods.

15

offshore VPS hosts rentedSubscriptions paid at the public price, without announcing the test.

6

months of continuous observationFrom 1 March to 1 September 2026.

80–100

copyright notices received per serverSent by the rights holders and their automated systems, not by the testers. Hosts that dropped out early received fewer.

6/15

services still working at the end of the periodService state checked on 1 September 2026. The other 9 had been cut off, each with its reason and the rank of the notice that ended the service.

4

server countriesFinland, Romania, Iceland and Switzerland. The country is the server’s, never the company’s: several of these hosts are established elsewhere. Attributing each instance to its country remains a provider claim, absent independent verification of the routing layers.

2 GB

of memory on the plan chosen everywhereThe same tier at every host, to make comparison possible. At no fewer than four of the six services still running, that tier is the entry plan.

5/15

hosts publishing no dedicated copyright policyReading their terms, acceptable use policies and abuse pages, and testing the usual paths, which return 404.

10/15

hosts publishing the name of a legal entitySearched on contact pages and legal notices. For the other four there is no identifiable recipient, neither for a customer nor for a rights holder.

1 hour

the only numeric removal deadline in European Union lawIt concerns terrorist content and runs from an authority’s removal order. No numeric deadline exists for copyright.

6 %

of worldwide annual turnover: cap on the administrative fineThe sanction for how notices are handled under the Union regime. It depends on no court decision.

6

mandatory elements of a United States noticeA notice that does not substantially comply with them is disregarded when assessing the provider’s knowledge.

39

legal references cited article by articleEach read on its official source, then put through a review tasked with refuting it. References that could not be verified were removed.

The text the whole industry calls “DMCA” is a United States federal law of 28 October 1998. Its title II inserted section 512 into title 17 of the United States Code, and that is where — and only where — the notice-and-takedown procedure lives.

That procedure is not written as an obligation to remove. Every limb of section 512 opens with the same formula: a service provider shall not be liable if certain conditions are met. Acting promptly after a notice is one of those conditions, not a duty. The text even states expressly that failing those conditions does not count against the provider when its other defences are examined.

So what is presented as the law forcing hosts to take content down is in fact a liability shelter that a host is free not to seek. The United States Copyright Office itself writes that responding to a notice is always voluntary — bearing in mind that this is a public frequently-asked-questions page, an administrative explanation with no normative force, and that the same Office adds that a service targeting United States users may incur liability under United States law.

It would be wrong, however, to conclude that section 512 imposes nothing on anyone. The recipient of a properly issued subpoena must disclose the information required, whether or not it acted on any notice. And the text provides for injunctions which do bind the provider.

What “DMCA ignored” actually describes

A stance towards a mechanism that conditions a liability shelter, not a refusal to obey an obligation to remove. The phrase says nothing about the law applicable to the host, nor about what it will do with a court order.

What the text does not require

No monitoring of the service, no active search for infringing material. Designating an agent with the Copyright Office, often presented as a mandatory formality, is a condition for the hosting limb alone: not designating one forfeits that shelter, it is not a breach sanctioned as such.

What is not settled

The United States definition of a service provider contains no criterion of nationality, seat or equipment location. Whether a foreign host can invoke section 512 before a United States court is settled by no text we were able to read. We therefore assert it in neither direction.

A false statement carries a price

Anyone who knowingly and materially misrepresents that material is infringing is liable for the damages, costs and fees incurred by the person targeted, by a rights holder, or by the host that relied on the statement.

In the European Union the framework is the Digital Services Act. It applies wherever a service is offered to recipients located in the Union, whatever the provider’s place of establishment. It neither displaces the United States text nor makes it applicable: these are two regimes answering different questions.

The important point lies elsewhere. Under this regime what counts is not the receipt of a message but what the notice makes it possible to establish. It gives rise to actual knowledge where it allows a diligent provider to identify the illegality without a detailed legal examination. An automated, imprecise notice, or one without the exact location of the material, may therefore have no legal effect — while a substantiated notice produces one, whatever its form. The Court of Justice so held on 22 June 2021, in joined cases C-682/18 and C-683/18, under the provision the regulation has since replaced.

Losing the benefit of the exemption is not being found liable. The regulation’s rules determine cases of non-liability; they provide no positive basis. An inactive host exposes itself to the ordinary law, not to an automatic finding against it.

A word on deadlines, because they circulate widely: the only numeric removal deadline in Union law is one hour, it concerns terrorist content, and it runs from an authority’s removal order. The twenty-four or forty-eight hours often presented as standards appear in none of the texts we verified.

Finland

Since 17 February 2024 there is no national copyright-specific procedure left: it was repealed, no regulation running parallel to the Union regulation being able to survive. No numeric deadline, only the requirement to act promptly. Compelled removals go through the courts — cessation action, interruption order, interim order that may be made without hearing the alleged infringer, blocking order where the infringer is unknown. The reputation for inertia rests on that requirement of a court decision; it holds up poorly against two findings: those interim orders can be made urgently, and the administrative fine for mishandling notices — up to 6 % of worldwide annual turnover — depends on no court decision at all. We verified no published decision applying these orders to a host: the practice remains unknown.

Romania

Of the three, this is the country where the announced regime is the least favourable — the exact reverse of its reputation. On top of the Union regime, Romania kept national obligations the Union regime does not impose: informing the competent public authorities without delay of apparently illegal activity, disclosing on request the data identifying hosting customers, and interrupting on an authority’s order. The implementing norms add informing the authorities within 24 hours of a complaint, and a free electronic complaint procedure published on the provider’s site. Qualification to carry: those norms refer to articles repealed since 18 April 2024, and no source consulted establishes whether they were adapted.

Iceland

No formalised national procedure: the one that existed for copyright was repealed in 2019. The applicable regime remains that of the e-commerce directive, transposed in 2002. The Digital Services Act is not applicable there as our sources stand — the Icelandic Ministry for Foreign Affairs’ European affairs database, consulted on 7 September 2026, classifies it among acts under review, with no decision of the European Economic Area Joint Committee; the primary EFTA record was inaccessible to us, so the finding rests on a single source. The consequence: no notice-mechanism obligation, no coordinator, no capped administrative fine. The constraint there is judicial, and it exists: an injunction against hosting data can target the host without it being liable, and breaching it intentionally or through gross negligence is punishable.

What the Icelandic reputation rests on

A parliamentary resolution of 2010, which is a mandate to the government with no substantive rule and no provision on hosting, and whose committee report explicitly rejected the idea of an extraterritorial position. What is established in Iceland is not immunity: it is an earlier regime.

The records describe service status at the end of the test and, for cut-offs, the trigger. They do not measure individual notice handling or the legal validity of complaints.

Results cover the stated period. Server country and company country are separate data points.

Prices paid and notice details for each service still active: unpublished. The legal analysis of Switzerland remains to be completed.

Official texts cited in the legal analysis.

Sources consulted on September 7, 2026