Piracy Shield, the TAR of Lazio rejects the appeals of Cloudflare and confirms the 14 million euro fine

The Regional Administrative Tribunal (TAR) of Lazio has rejected the appeals filed by Cloudflare against the Piracy Shield system and against the fine of over 14 million euros imposed by the Authority for Communications Guarantees (AGCOM).
The decision represents a first-instance ruling and can be appealed to the Council of State. The news was also made public by AGCOM commissioner Massimiliano Capitanio, who emphasized how the reasoning behind the ruling outlines a significant legal direction.
The issue arises from Cloudflare's failure to comply with an order issued by AGCOM in February 2025. The Authority had requested Cloudflare to block access to the domains and IP addresses reported through Piracy Shield, intervening on DNS resolution, traffic routing, or adopting alternative measures capable of achieving the same result. According to AGCOM, the reported resources were still accessible through the company's public DNS even in the months following the order.
The TAR deemed the Authority's action legitimate, confirming that disabling orders can also be directed at service providers established abroad when the effects of the infringement occur in Italy. According to the judges, the Digital Services Act distinguishes between oversight of procedural obligations and the exercise of inhibiting and sanctioning powers, which continue to be governed by national and sector-specific regulations. For this reason, it was deemed irrelevant that Cloudflare's European legal representative is based in Portugal.
The judges also rejected the argument that AGCOM could not issue binding orders to a foreign company, reiterating that such measures can pertain to service providers "wherever they are located," as long as the effects concern Italian users and the Authority operates within the limits of its legal framework.
Among the grievances presented by Cloudflare were alleged violations of the principles of proportionality and adequacy, arguing that Piracy Shield did not ensure a proper balance between copyright protection, freedom of expression, the right to information, and business freedom, in contrast to European law and the Digital Services Act.
The company also criticized the functioning of the platform, highlighting cases of erroneous blocking of legitimate sites, claiming that AGCOM had relied on reports from Serie A without conducting sufficiently thorough independent investigations.
These criticisms were also rejected. The TAR highlighted that Cloudflare had been invited to participate in the technical table dedicated to defining the operational requirements of Piracy Shield, a circumstance that, according to the judges, would have allowed it to monitor the project's evolution and contribute to the regulatory process. Furthermore, the ruling noted that the functioning mechanisms of the platform were already clearly outlined by the decision made in July 2023, rendering some of the company’s objections late.
On the delicate balance between copyright protection and other fundamental rights, the TAR excluded that the system leads to a disproportionate expansion of intellectual property. According to the judges, the regulations introduced by law no. 93 of 2023 maintain a consistent balance with European Union law, also thanks to the presence of whitelists and the possibility of filing complaints against any erroneous blocks. The ruling also emphasizes that Cloudflare did not register on the platform nor did it use the available complaint tools, a behavior classified as voluntary non-compliance.
Also dismissed was the challenge related to the amount of the fine. Cloudflare argued that the fine should have been calculated based on the revenue generated in Italy, estimated at around 140,000 euros, rather than on its total global revenue. The TAR instead considered the criterion adopted by AGCOM to be correct, which imposed a fine equivalent to 1% of global revenue, exceeding 1.4 billion euros in the reference year. The regulations allow a fine of up to 2% of revenue in cases of non-compliance with copyright protection orders, while the Authority chose a lower percentage also considering the absence of similar precedents.
Commenting on the decision, Massimiliano Capitanio reminded that this is only a first-instance ruling, but stated that the reasons "indicate a clear direction." According to the commissioner, Piracy Shield does not pose a risk to the functioning of the Internet or to freedom of expression, but rather constitutes an infrastructure aimed at effectively combating the spread of pirated content in accordance with the law.
Cloudflare, for its part, has already announced that it will appeal against the decision. In a statement released after the publication of the ruling, the company describes the verdict as "deeply disappointing" and reiterates that, in its opinion, Piracy Shield presents "fundamental flaws regarding European Union law," while deeming AGCOM's attempt to impose fines considered disproportionate for what it defines as legitimate objections as inappropriate.
The company further argues that attributing to private entities the power to block large portions of online content without government oversight, without significant checks, and without an effective right of appeal can have significant consequences.
"Legitimate businesses are harmed. Freedom of expression suffers. Innovation comes to a halt. Indiscriminate blocks, adopted without adherence to due process guarantees, do not represent an effective way to combat online piracy: they are just collateral damage."
"This approach is also in contrast to the requirements of the EU's Digital Services Act, resulting from careful negotiation and made to safeguard rights. The attempt to include fundamental tools for freedom of expression around the world - like VPNs and public DNS resolvers - within the scope of Piracy Shield further exacerbates its problems."
"Cloudflare will continue to fight this regulatory excess. We remain firmly committed to defending an open, reliable, and secure Internet, and we will continue to bring these crucial issues to the attention of European policymakers."