Cloudflare Stands Up for the Open Internet Against Italy's "Piracy Shield"

When governments want to control what people can access online, they rarely announce it that way.
It’s rare that governments would straight-up announce wanting to control what people can access online. Instead, the preferred method is to hand the keys to a private industry body while dressing it up as copyright enforcement and letting the lawyers do the talking. Italy has been playing this trick for a while now, and one of the world's largest internet infrastructure companies has finally had enough.

On December 29, 2025, Italy's communications regulator AGCOM fined Cloudflare €14 million for refusing to register with Piracy Shield, the country's controversial website blocking system. Cloudflare filed its appeal on March 8, 2026, and has made its position clear: the fight isn't over, and registration was never on the table.

A Black Box With a 30-Minute Deadline

Piracy Shield is marketed as an anti-piracy tool, but the mechanics tell a different story. An unidentified group of Italian media companies can submit websites and IP addresses through an unsupervised portal, and any internet service provider registered with the system is required to block them within 30 minutes. There are no judge sign-offs, no public records, and the owner doesn’t even get an advance notice.

The system was donated to the Italian government by SP Tech, the tech arm of a law firm that represents several of Piracy Shield's biggest direct beneficiaries, including Lega Nazionale Professionisti Serie A, Italy's top soccer league. Whatever Piracy Shield is, it was built by the people who profit the most from it, and that alone is a huge red flag.

The Collateral Damage Nobody Fixed

The overblocking started almost immediately after launch. Because Piracy Shield relies on IP address blocking, and because thousands of legitimate websites share IP addresses, innocent sites kept getting swept up in blocking orders intended for piracy platforms. A September 2025 study by the University of Twente confirmed that the system routinely blocks legitimate websites for months at a time.

Among the casualties were Ukrainian government websites for schools and scientific research, European NGOs focused on social programs for women and children, and Google Drive, which was knocked offline for Italian users for over 12 hours. AGCOM's response to all of this was to expand Piracy Shield to cover DNS providers and VPNs, services closely associated with privacy and free expression, rather than fix what was already breaking things.

A Fine Calculated to Punish, Not to Comply

The €14 million figure deserves some scrutiny, because it didn't come from nowhere. Italian law caps fines for non-compliance at 2% of a company's revenue within the relevant jurisdiction. Based on Cloudflare's Italian earnings, the legal maximum should have been around €140,000. AGCOM calculated the fine using Cloudflare's global revenue instead, producing a penalty nearly 100 times higher than the law actually permits.

The timing is equally revealing. The fine was issued on December 29, 2025, just six days after an Italian administrative court ordered AGCOM to share its Piracy Shield records with Cloudflare. Rather than comply with that disclosure order, AGCOM offered to make some records available for in-person inspection at its Naples facility, under the supervision of AGCOM officials. The regulator demanding transparency from internet companies has apparently decided transparency doesn't apply to itself.

Why Backing Down Would Cost Everyone More

Cloudflare's legal argument is that Piracy Shield violates the EU's Digital Services Act, which requires content restrictions to be proportionate and subject to strict procedural safeguards. The European Commission agreed, issuing a letter in June 2025 criticizing the system's lack of oversight, and AGCOM's response was a fine 100 times the legal limit.

What's actually at stake goes well beyond Cloudflare's balance sheet. Piracy Shield is a working model for privatized internet censorship, with no courts, no transparency, no appeals, and a 30-minute execution window that makes errors irreversible by design. If this model survives legal challenge, every government that wants to control what its citizens see online has a ready blueprint for handing blocking authority to a private body, calling it copyright protection, and fining anyone who pushes back.

The DSA was supposed to prevent exactly this. The fact that Italy built Piracy Shield anyway, expanded it to VPNs and DNS providers when the overblocking became embarrassing, and then punished Cloudflare for pushing back tells you how seriously some EU member states take their obligations when media industry money is involved. Cloudflare holding the line matters because if companies with the resources to fight this don't, the rest of us are left with an internet where private lobbying groups decide what loads and what doesn't.