Why Cloudflare Is Appealing Italy's 'Piracy Shield' Fine to Protect the Open Internet

Cloudflare criticized Italy's Piracy Shield, saying that while it claims to protect copyright, it is in fact a black box capable of indiscriminately blocking the entire web. The system forces blocking of websites and IPs submitted by certain media companies within 30 minutes, with virtually no judicial review, transparency, due process, or remedies.

The problems became apparent immediately. Because of the IP address blocking structure, countless legitimate sites were blocked alongside targeted ones, harming Ukrainian government and education sites, NGOs supporting women and children, and small businesses. At one point, access to Google Drive was blocked for over 12 hours, and a September 2025 University of Twente study also confirmed long-term collateral blocking.

Since 2024, Cloudflare has notified AGCOM of these structural flaws and proposed a safer cooperative approach, but it was not accepted. Cloudflare subsequently filed a lawsuit with the Italian administrative court over the mandatory registration requirement, and together with CCIA, also raised the issue with the European Commission. Cloudflare believes Piracy Shield fails to meet the proportionality and strict procedural safeguards required by the Digital Services Act (DSA).

The European Commission has expressed similar concerns. In a letter dated June 13, 2025, it pointed out the lack of oversight of Piracy Shield, and on December 23, 2025, the Italian administrative court ruled that AGCOM must disclose to Cloudflare the records supporting its blocking orders. However, AGCOM delayed disclosure of the records and instead notified Cloudflare that it would only allow viewing under supervisor observation at AGCOM's facility in Naples.

The €14 million fine imposed by AGCOM is also controversial. Under Italian law, penalties are capped at 2% of revenue within the relevant jurisdiction, but AGCOM calculated the fine based on Cloudflare's global revenue, resulting in a fine nearly 100 times the legal cap. Cloudflare stated that it is appealing this fine while also demanding disclosure of the records and continuing to challenge the legality of the Piracy Shield blocking orders themselves.

Cloudflare's message is clear: it is not denying the protection of rights itself, but insisting that the method of enforcement must not harm the technical integrity of the global internet and legal due process. It emphasized that 30-minute blocking and unverified black-box enforcement only produce excessive false positives and damage, and that such a burden should not be placed on global infrastructure providers.