Italy Fines Cloudflare €14.2M Over DNS-Based Pirate Site Blocking Refusal

Italian telecommunications regulator AGCOM has fined Cloudflare €14.2 million ($15.4 million) for refusing to block access to piracy-focused websites through its 1.1.1.1 public DNS resolver service. The penalty, announced January 10, 2026, stems from Cloudflare's non-compliance with an Italian court order requiring DNS-level blocking of several copyright-infringing domains. Cloudflare CEO Matthew Prince stated he will escalate the matter to US government officials, framing the conflict as a threat to fundamental internet architecture.

The Technical Standoff

At issue is Cloudflare's 1.1.1.1 DNS service, a recursive resolver handling over 2.8 trillion DNS queries daily. Unlike traditional ISPs that operate authoritative DNS servers mapping domains to IP addresses, Cloudflare's resolver acts as an intermediary that caches responses from authoritative servers globally. AGCOM demanded Cloudflare alter 1.1.1.1 responses in Italy to prevent resolution of specific pirate domains. Cloudflare refused, arguing DNS resolvers should return accurate domain information without manipulation.

"Implementing regional blocking at the recursive resolver layer fundamentally breaks how DNS is designed to work," Prince said in a statement. "It would require us to inspect and filter queries based on both content type and geographic origin—a precedent that could splinter the global internet." Technical analyses confirm DNS resolvers lack contextual awareness to distinguish legitimate from infringing content, as they process encrypted queries without inspecting subsequent traffic.

Legal Fault Lines

Italy's action follows the EU Copyright Directive's Article 17, which permits member states to mandate "effective measures" against piracy. However, legal experts note DNS resolvers operate differently from hosting providers or access networks. Cloudflare contends that as a neutral infrastructure provider, it shouldn't be forced to police content—a position previously upheld in US courts regarding its CDN services.

The fine coincides with intensifying global pressure on DNS providers. Russia, China, and India have implemented DNS-blocking regimes, but this marks Europe's first major penalty against a US-based resolver operator for non-compliance. AGCOM's order technically applies only to Italian users, but Cloudflare maintains that geofencing DNS responses isn't technically feasible without compromising performance or privacy.

Implications for Internet Governance

Prince's pledge to involve US officials signals a potential diplomatic clash. The US Commerce Department historically opposes extraterritorial application of national laws to core internet services, citing risks to digital trade and free expression. With Cloudflare operating under US jurisdiction, Italy's penalty tests boundaries of cross-border enforcement.

Critics warn that forcing DNS resolvers to block sites creates dangerous precedents:

• Technical Fragmentation: Custom filtering could undermine DNS's role as a universal addressing system
• Privacy Erosion: Query inspection conflicts with encrypted DNS protocols like DNS-over-HTTPS
• Overblocking Risks: Inaccurate blocks could suppress legitimate content

Cloudflare may appeal to the EU Court of Justice, arguing DNS resolvers qualify for liability protections under the Digital Services Act. The case could redefine obligations for neutral infrastructure providers as governments increasingly target intermediary services for content regulation.

What Comes Next

Cloudflare's 1.1.1.1 service remains unaltered in Italy pending legal challenges. The company has not disclosed if it will pay the fine. Prince emphasized that capitulating would invite similar demands worldwide: "If every country mandates local DNS filtering, the internet becomes a patchwork of incompatible networks." Outcomes will hinge on whether courts view DNS resolvers as passive conduits or active content gatekeepers—a decision with ramifications for all recursive DNS operators, including Google Public DNS and Quad9.