Cloudflare Appeals €14 Million Fine Over Italy’s Piracy Shield Blocking System

Cloudflare’s appeal of a €14 million Italian fine puts the practical costs of Piracy Shield in focus: the system can require providers to block websites within 30 minutes, while giving affected sites little visibility or recourse. The company says it will challenge both the penalty and the blocking framework in Italian administrative courts.

The fine, imposed by Italy’s communications authority, AGCOM, followed Cloudflare’s refusal to register for Piracy Shield. Cloudflare says it appealed on March 8. The dispute also raises a technical concern beyond the penalty: blocking shared IP addresses can make unrelated websites unreachable when they use the same address as a targeted service.

How Piracy Shield works

Piracy Shield is an electronic portal through which a set of Italian media companies can submit websites and IP addresses for blocking. Providers registered with the system must act within 30 minutes. Cloudflare describes the process as a black box because it says requests can be made without judicial review, with limited disclosure of who requested a block or why, and without a clear way for site owners to challenge a decision before access is cut off.

The system was presented as a way to address copyright infringement. Cloudflare argues that its design gives media companies broad control over access while leaving users and service providers with inadequate safeguards. It also points to the system’s origins: Piracy Shield was donated to Italy by SP Tech, which Cloudflare describes as an arm of a law firm representing several major beneficiaries, including Lega Nazionale Professionisti Serie A, Italy’s top soccer league.

That account comes from a company directly involved in the dispute. The underlying operational question, though, is concrete: can a fast blocking process distinguish targeted services from the many unrelated sites sharing an IP address? Cloudflare’s position is that the technical design makes mistakes hard to avoid.

Outages from shared-address blocking

IP addresses are often shared by thousands of websites. Blocking one address to restrict access to a particular service can therefore affect other sites hosted on it. Cloudflare says Piracy Shield caused outages within months of launch, including blocks affecting tens of thousands of legitimate sites in Italy.

Among the examples it cites are Ukrainian websites used for education and scientific research, European small businesses, and nonprofit groups working on social programs for women and children. Piracy Shield also blocked access to Google Drive for more than 12 hours, according to Cloudflare, disrupting access to files for thousands of students and professionals in Italy.

A September 2025 study from the University of Twente found that the system routinely blocked legitimate websites for months at a time, Cloudflare says. The duration matters: a mistaken block can extend well beyond the initial disruption if site operators lack information about the request or a workable route to contest it.

Cloudflare says AGCOM expanded Piracy Shield to cover global DNS providers and VPNs despite these problems. It also says the authority has pressed providers without an operational or business presence in Italy to register. Expanding a blocking system across services that help route or protect internet traffic increases the number of intermediaries expected to act quickly on submitted targets.

Cloudflare’s challenge and the fine

Cloudflare says it raised concerns with AGCOM in 2024 and proposed alternatives for addressing infringement without disrupting core internet infrastructure. It later challenged the effort to require its registration in Italian administrative courts. Together with the Computer & Communications Industry Association, it also filed a complaint with the European Commission.

The company argues that Piracy Shield conflicts with European Union law, particularly the Digital Services Act, which it says requires restrictions on content to be proportionate and governed by procedural safeguards. After the complaint, the Commission sent a letter on June 13, 2025, criticizing what it characterized as a lack of oversight in the system.

On December 23, 2025, an Italian administrative court ordered AGCOM to provide Cloudflare with records supporting Piracy Shield blocking orders. Cloudflare says it has not received the records. On December 29, less than a week after the ruling, AGCOM issued the €14 million fine.

Cloudflare also disputes how the fine was calculated. It says Italian rules cap penalties for noncompliance at 2% of a company’s revenue in the relevant jurisdiction. Based on its Italian revenue, Cloudflare estimates that the cap would have produced a fine of about €140,000. AGCOM instead used global revenue, according to the company, producing a penalty nearly 100 times larger.

The records dispute remains unresolved. Cloudflare says that four days before the disclosure deadline, AGCOM offered to make some records available for inspection at its Naples facility under staff supervision. The company calls those conditions burdensome and inconsistent with the court’s order. Access to the underlying records could help clarify how blocking decisions were submitted and handled.

What comes next

Cloudflare plans to appeal the fine, seek full access to the records, and continue contesting Piracy Shield’s blocking orders in Italian administrative courts and through the European Commission. It says it works with rights holders to address infringement and accepts that protecting copyrighted material is a legitimate goal. Its objection is that this system, in its view, lacks safeguards and can interrupt access to unrelated services.

The case will test how far a rapid blocking mechanism can reach when it relies on shared internet infrastructure. For providers, rights holders, and users, the practical measure to watch is whether the process can disclose the basis for a block and correct mistakes quickly enough to limit collateral outages.