Cloudflare’s stated mission is to help build a better Internet. That often means shipping new services or defending against massive cyber attacks. Less frequently, it means taking a stand against regulatory frameworks that threaten the fundamental architecture of the web. The company’s ongoing legal dispute with Italy’s Piracy Shield system falls firmly into that latter category.

After Cloudflare declined to register with the scheme and challenged it in court, the Italian communications regulator, AGCOM, imposed a €14 million (~$17 million) fine. Cloudflare appealed that penalty on March 8, continuing its challenge to the legality of the blocking system itself. The dispute is less about the financial figure than about a systemic issue: whether a group of private entities can force global infrastructure providers to enact massive blocks without adequate oversight, transparency, or procedural safeguards.

How Piracy Shield Operates

Piracy Shield is positioned as a tool to combat copyright infringement. In practice, it functions as an unsupervised electronic portal. An unidentified set of Italian media companies can submit websites and IP addresses that registered online service providers must block within 30 minutes. The system functions as a “black box” with several structural characteristics:

  • No judicial oversight: Private companies, not judges or government officials, make the decisions on what content is blocked.
  • No transparency: The public and the service providers themselves are often not informed about who requested a block or the rationale behind it.
  • No due process: Website owners have no mechanism to contest a block before their site is made inaccessible in Italy.
  • No redress: There is no effective avenue for parties harmed by erroneous blocks to seek a remedy.

The design reflects a clear bias. The system was “donated” to the Italian government by SP Tech, an arm of the law firm representing several of the direct beneficiaries, including Lega Nazionale Professionisti Serie A.

Collateral Damage at Scale

The system’s flaws were apparent almost immediately. Its reliance on IP address blocking is technically risky because IP addresses are commonly shared by thousands of websites. This creates a high risk of overblocking innocent services. The failures have been substantial:

  • Government and educational sites blocked: Tens of thousands of legitimate domains, including Ukrainian government sites for schools and scientific research, became inaccessible in Italy.
  • Small businesses and NGOs hit: Numerous European small enterprises and NGOs working on social programs for women and children were caught in the crossfire.
  • Essential services disrupted: Access to Google Drive was blocked for over 12 hours, impacting students and professionals relying on critical files.
  • Prolonged collateral blocking: A September 2025 study by the University of Twente found that the system routinely blocks legitimate websites for months at a time.

Despite this evidence of repeated and widespread collateral damage, AGCOM did not modify the system’s approach. Instead, it moved to expand Piracy Shield’s scope to include global DNS providers and VPNs, and it took increasingly aggressive steps to compel global providers, including those with no legal or operational presence in Italy, to register.

Cloudflare has highlighted Piracy Shield’s risks since its inception. In 2024, the company met with AGCOM to outline the scheme’s structural flaws and propose collaborative methods that would not compromise the Internet’s core architecture. Those concerns were ignored. The subsequent steps were procedural:

  • Cloudflare challenged AGCOM’s effort to force its participation in the Italian administrative courts.
  • Together with the Computer & Communications Industry Association (CCIA), the company filed a complaint with the European Commission.

Cloudflare’s position is that Piracy Shield is incompatible with EU law, particularly the Digital Services Act (DSA), which requires content restrictions to be proportionate and subject to strict procedural safeguards.

The European Commission has signalled similar concerns. After the complaint, it issued a letter on June 13, 2025, criticizing the lack of oversight in the framework. On December 23, 2025, the Italian administrative court ruled that AGCOM must share with Cloudflare all records purportedly supporting Piracy Shield blocking orders. Those records have not yet been received.

A Disproportionate Penalty

AGCOM did not wait for the outcome of the legal challenges. Less than a week after being ordered to disclose records, it issued the fine on December 29, 2025. The timing was not the only questionable aspect; the calculation itself appears legally flawed. Italian law caps fines for non-compliance at 2% of a company’s revenue within the relevant jurisdiction. Based on Cloudflare’s Italian earnings, that cap would limit any fine to approximately €140,000. By calculating the penalty based on global revenue, AGCOM arrived at a figure nearly 100 times higher.

Separately, AGCOM resisted complying with the disclosure order. Days before the deadline, it indicated that some records would be available only for inspection at an AGCOM facility in Naples, under the supervision of its own officials. This restrictive approach contradicts the letter and spirit of the court’s order.

Next Steps

Cloudflare plans to continue the fight on multiple fronts. The company is appealing the €14 million fine and pushing for full access to AGCOM’s records. It will also continue challenging the legality of the Piracy Shield blocking orders in the Italian administrative courts.

The company recognizes that rightsholders hold a legitimate interest in content protection, and it indicates that it works with them on precise and effective anti-piracy measures. The core objection is that those interests cannot override legal due process or the technical integrity of the global Internet. The fight centers on ensuring that infrastructure rules remain transparent and accountable, rather than being subject to opaque systems that block large swaths of the web without recourse.