FTA: "The list of IP addresses and domain names to be blocked is drawn up by private bodies authorised by AGCOM"

Edit: You're correct, you could run a VPN on your own server and sell access, as this would only block known VPN services.