Absolutely, see the recent HideMyAss fiasco. At the same time though, they cannot shut down VPNs nor really monitor them too much -- that would create problems for businesses, and lose votes. Also, even acting at the EU level would leave out "rogue" states; I'm sure lots of ex-soviet states would love nothing better than kickstarting a specialized IT sector. We'll eventually get the internet equivalent of XIX century "free trade ports" around China.