Italy’s site-blocking law
Firm says requiring site blocks within 30 minutes breaks core Internet architecture.
Credit: Getty Images | NurPhoto
Cloudflare said it has appealed a fine issued by Italy over the company’s refusal to block access to websites on its 1.1.1.1 DNS service. The appeal is the latest step in Cloudflare’s fight against Italy’s Piracy Shield law.
Piracy Shield is “a misguided Italian regulatory scheme designed to protect large rightsholder interests at the expense of the broader Internet,” Cloudflare said in a blog post this week. “After Cloudflare resisted registering for Piracy Shield and challenged it in court, the Italian communications regulator, AGCOM, fined Cloudflare… We appealed that fine on March 8, and we continue to challenge the legality of Piracy Shield itself.”
Cloudflare called the fine of 14.2 million euros ($16.4 million) “staggering.” AGCOM issued the penalty in January 2026, saying Cloudflare flouted requirements to disable DNS resolution of domain names and routing of traffic to IP addresses reported by copyright holders.
Cloudflare had previously resisted a blocking order it received in February 2025, arguing that it would require installing a filter on DNS requests that would raise latency and negatively affect DNS resolution for sites that aren’t subject to the dispute over piracy. Cloudflare co-founder and CEO Matthew Prince said that censoring the 1.1.1.1 DNS resolver would force the firm “not just to censor the content in Italy but globally.”
Piracy Shield was designed to combat pirated streams of live sports events, requiring network operators to block domain names and IP addresses within 30 minutes of receiving a copyright notification. Cloudflare said the fine should have been capped at 140,000 euros ($161,000), or 2 percent of its Italian earnings, but that “AGCOM calculated the fine based on our global revenue, resulting in a penalty nearly 100 times higher than the legal limit.”
Despite its complaints about the size of the fine, Cloudflare said the principles at stake “are even larger” than the financial penalty. “Piracy Shield is an unsupervised electronic portal through which an unidentified set of Italian media companies can submit websites and IP addresses that online service providers registered with Piracy Shield are then required to block within 30 minutes,” Cloudflare said.
Cloudflare warns of “widespread overblocking”
Cloudflare said Piracy Shield relies on a system provided to Italy’s government by SP Tech, an arm of the law firm that represents Serie A and other major beneficiaries of the law. The system has no judicial oversight, transparency, due process, or redress for erroneous blocking, Cloudflare said.
“Global connectivity is too important to be governed by ‘black boxes’ with 30-minute deadlines that result in widespread overblocking with no means of redress,” Cloudflare said.
AGCOM rejected Cloudflare’s arguments when it issued the fine, saying that the required blocking would impose no risk on legitimate websites because the targeted IP addresses were all uniquely intended for copyright infringement. AGCOM also said in January that Piracy Shield had disabled over 65,000 domain names and about 14,000 IP addresses in AGCOM in the previous two years.
Cloudflare and others have pointed to failures with Piracy Shield, such as a mistaken blocking of Google Drive in October 2024. Google has also been ordered to block pirate sites at the DNS level. In a September 2025 report, researchers at the University of Twente in the Netherlands found “hundreds of legitimate websites unknowingly affected by blocking” in what they called “a conservative lower-bound estimate.”
AGCOM decisions can be appealed in the Regional Administrative Court of Lazio in Rome. As for what happens if Cloudflare loses the appeal, the company previously threatened to discontinue certain services in Italy and remove all of its servers from the country.
Cloudflare hopes for EU action
Cloudflare said it met with AGCOM in 2024 to discuss Piracy Shield’s flaws and proposed different methods “that wouldn’t break the Internet’s core architecture,” but said its “concerns were ignored.” It then challenged Piracy Shield in Italian administrative courts and filed a complaint with the European Commission. Cloudflare argues that “Piracy Shield is incompatible with EU law, most notably the Digital Services Act (DSA), which requires that any content restriction be proportionate and subject to strict procedural safeguards.”
In addition to appealing the fine, Cloudflare said it will continue to challenge the legality of Piracy Shield blocking orders in Italian courts, engage with EU officials, and push for full access to AGCOM’s Piracy Shield records. While AGCOM hasn’t backed down, Cloudflare said it has seen hopeful signs that its complaints are being taken seriously by the European Commission and Italian courts.
“The European Commission, following our complaint, expressed similar concerns, issuing a letter on June 13, 2025, criticizing the lack of oversight inherent in the Piracy Shield framework,” Cloudflare said. “And on December 23, 2025, the Italian administrative court issued an encouraging ruling requiring AGCOM to share with Cloudflare all the records that purportedly support Piracy Shield blocking orders. While we have not yet received those records, we expect them to shed significant light on Piracy Shield’s operations.”
While Cloudflare faces Piracy Shield enforcement for its DNS resolver, the law also applies to Internet service providers. A trade group that represents Italian ISPs objected to the law, saying that “potentially unlimited filtering creates high collateral damage even greater than the social benefit of combating piracy.” The group said that “any system activated at [the] national level has strong impacts outside the borders, as content and resources located in third countries are filtered.”
Jon is a Senior IT Reporter for Ars Technica. He covers the telecom industry, Federal Communications Commission rulemakings, broadband consumer affairs, court cases, and government regulation of the tech industry.
